Analysis
- user interaction
yes - max time kernel
1049s - max time network
450s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 18:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
- Size 22.8MB
- Sample260824-xle18sysht
- SHA256 6c61bd9fef98c21750b021e0450896749cb25e75b91716bf22423d7ca64c1cb4
- MD5 5c9f6836c0720e829adf3ecda42ebf86
- SHA1 f9e9dc31850d1a83c49052d06f29382dada7ba30
- SHA512 ed79f9057113468d44d7f346c0611c98a5abaffe0b4ad49c21decbb64703bac12a1c7fdef4430415dcb082bcaa94360f7dc58b2616b2853569f3e65d401b5f1f
- SSDEEP 393216:bI1ufAq/F1Ru20THfW7HiQydLaXWJg21N3RY3D3v00EoUiHEjlSIwKbnaEsw9Uwy:bI1un/k28OG7LwCdhso0NPYl8EswOdLL
- TLSH T1D13723CE67744004D18E0F3497AA91D0391E6D6717F0E87BEA27F0D9ADB5ACA46CE90C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe - Downloads MZ/PE file 64 IoCs
flow pid Process 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe 104 4848 prismlauncher.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation prismlauncher_updater.exe Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation javaw.exe Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation vc_redist.x64.exe Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation VC_redist.x64.exe Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation prismlauncher.exe - Drops file in System32 directory 51 IoCs
description ioc Process File created C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\e591864.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2505.tmp msiexec.exe File created C:\Windows\Installer\e591851.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53} msiexec.exe File opened for modification C:\Windows\Installer\MSI1F85.tmp msiexec.exe File created C:\Windows\Installer\e591879.msi msiexec.exe File opened for modification C:\Windows\Installer\e591851.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e591863.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2842.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI1C58.tmp msiexec.exe File opened for modification C:\Windows\Installer\e591864.msi msiexec.exe File created C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF} msiexec.exe - Executes dropped EXE 12 IoCs
pid Process 3792 vc_redist.x64.exe 1812 vc_redist.x64.exe 3520 VC_redist.x64.exe 4672 VC_redist.x64.exe 464 VC_redist.x64.exe 4572 VC_redist.x64.exe 4848 prismlauncher.exe 4248 VC_redist.x64.exe 4284 prismlauncher_updater.exe 848 prismlauncher.exe 4128 javaw.exe 2268 javaw.exe - Loads dropped DLL 64 IoCs
pid Process 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 1812 vc_redist.x64.exe 4576 VC_redist.x64.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4572 VC_redist.x64.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4848 prismlauncher.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe 4284 prismlauncher_updater.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier PrismLauncher-Windows-MSVC-Setup-11.0.3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 prismlauncher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString prismlauncher.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ javaw.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 javaw.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision javaw.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 prismlauncher.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ prismlauncher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString javaw.exe - Kills process with taskkill 1 IoCs
pid Process 2248 TaskKill.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{43B0D101-A022-48F4-9D04-BA404CEB1D53}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Version = "237799819" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.44.35211" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\VC_Runtime_Additional msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\InstanceType = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\curseforge\shell\open\command PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}v14.44.35211\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle VC_redist.x64.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\curseforge\shell\open PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\9CC2BA68DB8034640B9F8FD200D627FF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\PackageName = "vc_runtimeAdditional_x64.msi" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\prismlauncher PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\prismlauncher\shell PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\101D0B34220A4F84D940AB04C4BED135 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\PackageCode = "51FBA0EFEFDB3494A815FAF727EE72D7" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\VC_Runtime_Minimum msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.44.35211" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\prismlauncher\URL Protocol PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Dependents VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\curseforge\shell PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\prismlauncher\shell\open\command PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Version = "237799819" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\curseforge PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PrismLauncher\\prismlauncher.exe\" \"%1\"" PrismLauncher-Windows-MSVC-Setup-11.0.3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Version = "14.44.35211.0" VC_redist.x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier PrismLauncher-Windows-MSVC-Setup-11.0.3.exe - Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 4848 prismlauncher.exe 4284 prismlauncher_updater.exe 848 prismlauncher.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 780 msiexec.exe 780 msiexec.exe 780 msiexec.exe 780 msiexec.exe 780 msiexec.exe 780 msiexec.exe 780 msiexec.exe 780 msiexec.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe 2268 javaw.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 4848 prismlauncher.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2248 TaskKill.exe Token: SeBackupPrivilege 4468 vssvc.exe Token: SeRestorePrivilege 4468 vssvc.exe Token: SeAuditPrivilege 4468 vssvc.exe Token: SeShutdownPrivilege 3520 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 3520 VC_redist.x64.exe Token: SeSecurityPrivilege 780 msiexec.exe Token: SeCreateTokenPrivilege 3520 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 3520 VC_redist.x64.exe Token: SeLockMemoryPrivilege 3520 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 3520 VC_redist.x64.exe Token: SeMachineAccountPrivilege 3520 VC_redist.x64.exe Token: SeTcbPrivilege 3520 VC_redist.x64.exe Token: SeSecurityPrivilege 3520 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 3520 VC_redist.x64.exe Token: SeLoadDriverPrivilege 3520 VC_redist.x64.exe Token: SeSystemProfilePrivilege 3520 VC_redist.x64.exe Token: SeSystemtimePrivilege 3520 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 3520 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 3520 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 3520 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 3520 VC_redist.x64.exe Token: SeBackupPrivilege 3520 VC_redist.x64.exe Token: SeRestorePrivilege 3520 VC_redist.x64.exe Token: SeShutdownPrivilege 3520 VC_redist.x64.exe Token: SeDebugPrivilege 3520 VC_redist.x64.exe Token: SeAuditPrivilege 3520 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 3520 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 3520 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 3520 VC_redist.x64.exe Token: SeUndockPrivilege 3520 VC_redist.x64.exe Token: SeSyncAgentPrivilege 3520 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 3520 VC_redist.x64.exe Token: SeManageVolumePrivilege 3520 VC_redist.x64.exe Token: SeImpersonatePrivilege 3520 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 3520 VC_redist.x64.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe Token: SeRestorePrivilege 780 msiexec.exe Token: SeTakeOwnershipPrivilege 780 msiexec.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 1812 vc_redist.x64.exe 1812 vc_redist.x64.exe 4572 VC_redist.x64.exe 4848 prismlauncher.exe 4848 prismlauncher.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2268 javaw.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 5012 wrote to memory of 2248 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 91 PID 5012 wrote to memory of 3792 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 99 PID 3792 wrote to memory of 1812 3792 vc_redist.x64.exe 100 PID 1812 wrote to memory of 3520 1812 vc_redist.x64.exe 101 PID 4672 wrote to memory of 464 4672 VC_redist.x64.exe 112 PID 464 wrote to memory of 4572 464 VC_redist.x64.exe 113 PID 3520 wrote to memory of 3720 3520 VC_redist.x64.exe 114 PID 3720 wrote to memory of 4576 3720 VC_redist.x64.exe 115 PID 4576 wrote to memory of 3996 4576 VC_redist.x64.exe 116 PID 5012 wrote to memory of 4848 5012 PrismLauncher-Windows-MSVC-Setup-11.0.3.exe 117 PID 4572 wrote to memory of 4248 4572 VC_redist.x64.exe 118 PID 4848 wrote to memory of 4284 4848 prismlauncher.exe 124 PID 4284 wrote to memory of 848 4284 prismlauncher_updater.exe 125 PID 4848 wrote to memory of 4128 4848 prismlauncher.exe 127 PID 4848 wrote to memory of 2268 4848 prismlauncher.exe 128 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.3.exe"C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.3.exe"1⤵
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\TaskKill.exeTaskKill /IM prismlauncher.exe /F2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exeC:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe /install /passive /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\Temp\{35805A04-16BC-4457-B488-587930E8F11E}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{35805A04-16BC-4457-B488-587930E8F11E}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe" -burn.filehandle.attached=804 -burn.filehandle.self=808 /install /passive /norestart3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\Temp\{307F278E-B166-4B4C-85DF-BDDDF54AD92C}\.be\VC_redist.x64.exe"C:\Windows\Temp\{307F278E-B166-4B4C-85DF-BDDDF54AD92C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{CF54FD31-7752-41CB-B42A-C3B9885786B1} {FDFBF46C-4D67-4C35-8FDE-8A96D202749F} 18124⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1092 -burn.embedded BurnPipe.{EA05DB14-2C29-4A07-9992-FF400226D528} {53024176-EF9C-4EB4-8916-3288D5F87D31} 35205⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=648 -burn.filehandle.self=668 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1092 -burn.embedded BurnPipe.{EA05DB14-2C29-4A07-9992-FF400226D528} {53024176-EF9C-4EB4-8916-3288D5F87D31} 35206⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0AA8ECEF-62CB-4DEB-B093-166FFF8EF841} {1AB03249-9433-4CA0-9894-53998051054F} 45767⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3996
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exeC:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe --check-only --dir C:/Users/Admin/AppData/Roaming/PrismLauncher --debug3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exeC:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe --version4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:848
-
-
-
C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exeC:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exe -jar C:/Users/Admin/AppData/Local/Programs/PrismLauncher/jars/JavaCheck.jar3⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4128
-
-
C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exeC:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exe -Duser.language=en -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xms512m -Xmx4096m -Djava.library.path=C:/Users/Admin/AppData/Roaming/PrismLauncher/instances/26.2(1)/natives -cp C:/Users/Admin/AppData/Local/Programs/PrismLauncher/jars/NewLaunch.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows-arm64/3.4.1/lwjgl-freetype-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows-x86/3.4.1/lwjgl-freetype-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows/3.4.1/lwjgl-freetype-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype/3.4.1/lwjgl-freetype-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-arm64/3.4.1/lwjgl-jemalloc-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-x86/3.4.1/lwjgl-jemalloc-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows/3.4.1/lwjgl-jemalloc-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc/3.4.1/lwjgl-jemalloc-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows-arm64/3.4.1/lwjgl-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows-x86/3.4.1/lwjgl-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows/3.4.1/lwjgl-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows-arm64/3.4.1/lwjgl-openal-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows-x86/3.4.1/lwjgl-openal-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows/3.4.1/lwjgl-openal-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal/3.4.1/lwjgl-openal-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows-arm64/3.4.1/lwjgl-opengl-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows-x86/3.4.1/lwjgl-opengl-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows/3.4.1/lwjgl-opengl-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl/3.4.1/lwjgl-opengl-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-sdl-natives-windows-arm64/3.4.1/lwjgl-sdl-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-sdl-natives-windows-x86/3.4.1/lwjgl-sdl-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-sdl-natives-windows/3.4.1/lwjgl-sdl-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-sdl/3.4.1/lwjgl-sdl-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-shaderc-natives-windows-arm64/3.4.1/lwjgl-shaderc-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-shaderc-natives-windows-x86/3.4.1/lwjgl-shaderc-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-shaderc-natives-windows/3.4.1/lwjgl-shaderc-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-shaderc/3.4.1/lwjgl-shaderc-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-spvc-natives-windows-arm64/3.4.1/lwjgl-spvc-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-spvc-natives-windows-x86/3.4.1/lwjgl-spvc-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-spvc-natives-windows/3.4.1/lwjgl-spvc-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-spvc/3.4.1/lwjgl-spvc-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows-arm64/3.4.1/lwjgl-stb-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows-x86/3.4.1/lwjgl-stb-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows/3.4.1/lwjgl-stb-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb/3.4.1/lwjgl-stb-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-arm64/3.4.1/lwjgl-tinyfd-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-x86/3.4.1/lwjgl-tinyfd-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows/3.4.1/lwjgl-tinyfd-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd/3.4.1/lwjgl-tinyfd-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vma-natives-windows-arm64/3.4.1/lwjgl-vma-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vma-natives-windows-x86/3.4.1/lwjgl-vma-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vma-natives-windows/3.4.1/lwjgl-vma-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vma/3.4.1/lwjgl-vma-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vulkan/3.4.1/lwjgl-vulkan-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl/3.4.1/lwjgl-3.4.1-unsafe.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw-natives-windows-x86/3.4.1/lwjgl-glfw-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw-natives-windows/3.4.1/lwjgl-glfw-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw/3.4.1/lwjgl-glfw-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/at/yawk/lz4/lz4-java/1.10.1/lz4-java-1.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/azure/azure-json/1.4.0/azure-json-1.4.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/github/oshi/oshi-core/6.9.0/oshi-core-6.9.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/code/gson/gson/2.14.0/gson-2.14.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/guava/guava/33.6.0-jre/guava-33.6.0-jre.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/ibm/icu/icu4j/78.3/icu4j-78.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/microsoft/azure/msal4j/1.24.1/msal4j-1.24.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/authlib/9.0.75/authlib-9.0.75.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/blocklist/1.0.10/blocklist-1.0.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/brigadier/1.3.10/brigadier-1.3.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/datafixerupper/10.0.21/datafixerupper-10.0.21.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/jtracy/1.0.37/jtracy-1.0.37.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/jtracy-natives-windows/1.0.37/jtracy-natives-windows-1.0.37.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/logging/1.7.12/logging-1.7.12.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/patchy/2.2.10/patchy-2.2.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/text2speech/1.19.12/text2speech-1.19.12.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-codec/commons-codec/1.22.0/commons-codec-1.22.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-io/commons-io/2.20.0/commons-io-2.20.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-buffer/4.2.15.Final/netty-buffer-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-codec-base/4.2.15.Final/netty-codec-base-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-codec-compression/4.2.15.Final/netty-codec-compression-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-codec-http/4.2.15.Final/netty-codec-http-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-common/4.2.15.Final/netty-common-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-handler/4.2.15.Final/netty-handler-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-resolver/4.2.15.Final/netty-resolver-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport-classes-epoll/4.2.15.Final/netty-transport-classes-epoll-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport-classes-kqueue/4.2.15.Final/netty-transport-classes-kqueue-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport-native-unix-common/4.2.15.Final/netty-transport-native-unix-common-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport/4.2.15.Final/netty-transport-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/it/unimi/dsi/fastutil/8.5.18/fastutil-8.5.18.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna-platform/5.17.0/jna-platform-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna/5.17.0/jna-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/sf/jopt-simple/jopt-simple/5.0.4/jopt-simple-5.0.4.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/commons/commons-compress/1.28.0/commons-compress-1.28.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/commons/commons-lang3/3.20.0/commons-lang3-3.20.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-api/2.26.0/log4j-api-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-core/2.26.0/log4j-core-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-slf4j2-impl/2.26.0/log4j-slf4j2-impl-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/jcraft/jorbis/0.0.17/jorbis-0.0.17.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/joml/joml/1.10.8/joml-1.10.8.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/slf4j/slf4j-api/2.0.17/slf4j-api-2.0.17.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/fabricmc/intermediary/26.2/intermediary-26.2.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm/9.10.1/asm-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm-analysis/9.10.1/asm-analysis-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm-commons/9.10.1/asm-commons-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm-tree/9.10.1/asm-tree-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm-util/9.10.1/asm-util-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/fabricmc/sponge-mixin/0.17.3+mixin.0.8.7/sponge-mixin-0.17.3+mixin.0.8.7.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/fabricmc/fabric-loader/0.19.3/fabric-loader-0.19.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/minecraft/26.2/minecraft-26.2-client.jar org.prismlauncher.EntryPoint3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2268
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:856
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260824195803.log" /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260824195803.log" /install3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8890AC4F-78FD-4317-AEB5-FD94D6B259B7} {C7C9B09D-9EC8-4EB0-BDB8-41166ED24B37} 45724⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4248
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x510 0x5281⤵PID:440
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:800
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e591856.rbs
- Size 19KB
- SHA256 67fc9a32a158778d7d26b4e15973f017b938e16b00ac96b683676baba61af525
- MD5 9fdbd58c6a775da41ee83a7aaa78142a
- SHA1 6e998d9cb3cfda8575da00b9cdbbf941ea5fac10
- SHA512 edf0fdfb108ecf44dfea24bb0455b0e706d9810e2399f70c189bb940eb5c0b486c4a8e2a2625f333ad9db4b2a2cb86c37075255103464ef6ca67421251467db3
- SSDEEP 192:lJRu1kR115dXcFUADIc1L+W+y4+agPuUH7:lJRu6R1TeC81L/cQH7
- TLSH T18C920C02AA80C9D2D8766B31CD671BA53B76DBD5A350438F50DC90308F93BCA2F9D69D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e591862.rbs
- Size 19KB
- SHA256 c51fa78ed8489d0971234f71b42cd7ef9d9bfe7fc0b2f679f4c3c58ef3bffd40
- MD5 84c1fe5eeb81e7699edf339c59b2d96d
- SHA1 2a5af853024eec4831401337aa23883b867105fb
- SHA512 7ab401455ef3c19591ed8999ac297bd7ddb343cd5503cd2d795853e11ebd22d6c10e6a0fad4eca54c5de69618f2548487fea3b03a36a124e5427092001704c22
- SSDEEP 384:mvOGnJXMjZ7Up+BFqiO69UgJq0uJq0Goa2D8Lfv/8c3zMZxq+nNwzQ6R:mvOGnJXMjZ7Up+BFIkqFqR
- TLSH T1BC92CB026640C5E3D8A62B70DD4B67203BB5D7CA9355A38B41DCC1308FA77CA7F8E24A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e591869.rbs
- Size 21KB
- SHA256 4fdcab1b7f8877037893abf6d0d6626b76c1a613fed3192079b1d084ce199730
- MD5 0f31850e8d3e1736c7cf305bab0dc94d
- SHA1 7ab0b70f1b84ad3f3d9083e612b44272c8916887
- SHA512 e25c80dc2e801ed5fb70167c6d5de9bc4a90a3366b4b25fd9f0321d41b47525eaad984c4850796c11cef603689c41b8965ad4c2a35d77098923fb30fd3052ba4
- SSDEEP 384:m7RBGR0nAKxNAUhUC7xJjrMNYPVIbS/+QYzWaZebc5LkP:mVAsAKhCsD
- TLSH T1B7A20F03768099E3D86227B1DD671BA53B73D7D99350434B10ECD1388F633C72E5AA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e591878.rbs
- Size 21KB
- SHA256 84ccfdcf2b4b17c05ea1be13b045b6884bf23241031b381a54346850dab5c3d9
- MD5 bae37c1e3edb8df460fbdbf4bccc9c0e
- SHA1 6be48ddb10addfcced9af86123228feaae9a15e2
- SHA512 0e781a913ca63f6400b0f6d53b969efd57ba00f0e2d072a0314921068279202ca6615c4d7b3566721407fc249aec1cfb4b3f1e0aac4e3666a8f2d2699f38c40d
- SSDEEP 384:zrNvDIAZxEth/phSYjK4WbJGwaZsalckU72eC67JkE5KmJdUJdsrr6c+0dWg:zdDIAZxEth/phSYujbJBTFo2rr6/0dP
- TLSH T193A20E42BA40D2D3D8A62B70CD97672437B5D3DAA755474B00CC90348F937DA2F9AACB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Core.dll
- Size 9.8MB
- SHA256 e898be1717f33e5be968a5d07c56f6cdf6f236c7888bebf3ada8db55a72dff0f
- MD5 89447589fe6fbaf513cdbb3daf651247
- SHA1 926885a622fb30d93eaac06bb9bd06c4ea5a9b9e
- SHA512 481bfe9288235e4a6d92db5b894faae94a45f2babd36b851b227a0d0e948f417e827c2514cacd3215f748e0e62d9d284e3ea0caeeaebeeb5c858942947966399
- SSDEEP 98304:VVLKyLebAofeVMKFdu9CwJsv6t6mJMSKgVcC/3cz:7WPBSMKFdu9CwJsv6t6mSStZ/36
- TLSH T1D2A6290766FA0011FAFBDA34DAB75112DBB27C466B3496DF025861185E337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
- Size 9.1MB
- SHA256 f872c2b0f6a8aa92c80006dc272f2af0137f1172510a07e5687dd23b9e84d048
- MD5 e9b59907c83d2c1de9e3ad3bc8063b42
- SHA1 cbebf33f189f50ad027e8c713f0ba707d70b5e8a
- SHA512 6b079093760ac5192acc238d1af91f326aa60cb376a131415414a4d36af2d977f8c8b11da795927319f3cb1a93637f1c86f5dab86a00a758ca39cb7b3091e9e5
- SSDEEP 98304:s17B8zKQ16be6OAZl5XWv7StQiYBNXcqQYOPTme3:I6ie6ZZTdtQiYBNMVPTmc
- TLSH T12DA68D57A2AA11D8D57BD13CCB9B9517EBB2701503629BDB01A0CA152F33BF12ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Network.dll
- Size 1.7MB
- SHA256 c99cdc8fe49d4ffef4585616181e977674ffddf5c83e04f8a7bfa710ef7a113c
- MD5 fbaf3b77f1c5ffdb4504fd818c401b21
- SHA1 36b4b0e87c37a80d81015f7637b88ad54a997058
- SHA512 ff406fe6ba25bb2b3f93d9d90744260634c9eb3985e01cde63a33bd183e30a42e423ed73ae45b2a15bdc17ca1b38e0872adcf64211a4d22f347f35110673081b
- SSDEEP 12288:J9onO5TLgx8PlBYyrw3hutJJ5za2rJq9OeBEd4yhexi9TQ75L3EXpX1mQ:A83gxGmFRiJJ51rJq9OvdDhOi+75mXIQ
- TLSH T109856C57A3A441D6D46ED13DCB4B8A0BF772700583669BDF02658A152F73BE22B3E360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6NetworkAuth.dll
- Size 289KB
- SHA256 f72beabb77f4212b2121f29fe6a905860922fc96e065e391e606e7edc57a2970
- MD5 d1cddba1c241821d1b3f8faa3104fd88
- SHA1 60f33ea75429f757fe7b9103e0457ea194ed7766
- SHA512 e1827816625d46c83c09df409d446850fd3cfee4430d2bc67d44faa514a8bd4cf187c7f8ecc3e658617f783dcccf346792a4ae32ba4aea51da0861473ca00e14
- SSDEEP 3072:mPntlHGgash+B1RBKQ5NSuxBqcKu215Pdp8CqhwoLW1kJERAXWBJnuo1kIuxmwBs:4/+B5N5Bqcf215PdpToyyiuGux9Bs9
- TLSH T1C5543957A3A20DC2DC2BC179C65B8613E6B3B4004752CBEF46658B4A1F677E2BE3D244
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6OpenGL.dll
- Size 1.9MB
- SHA256 74bae72a5e3059b47d7213dc0c05319cbf2e27004c96197e35cff6b58f72d83d
- MD5 230bca60642a1ea1285c0eb4541aa9ed
- SHA1 e9dacf09d85980c28c8c1f30ebca99319f3e6ac6
- SHA512 e34a5601fe41039ca80681c86eedcb80f1352a55c776c7d59a2942b5b57ea61715e70e4a1dbda965a4821f9454eac0e9950e75f4a5d9e53ab4b95a25a101ffa6
- SSDEEP 12288:syA2ngdKBJuEum86y+TjfI1CkX9RDYXKI297FcVlE/LY9Q9:vaYum9V/feRzDYucGLY98
- TLSH T1AC95FFD5624AB622C976E2BE934F057E60F3AD53C3424BC388155B490AB57EE0B7FC06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
- Size 6.3MB
- SHA256 96e9e1514101f4a4fad67a7e34aa2b8c2ec135f4eeb7f56ec26f3e00bd97c1fb
- MD5 3e10b5733cbbd0d02ae80f8f205314ad
- SHA1 5a6d7ec633f52ec3612006e3b5498393d4a83a8a
- SHA512 4e6b9bf45dcf0df51155ddba8e0c94a30fad4543e366c24912700533571707a8cec27391e7bfb03430764a88a3ca2427878053268073c3a4acd95182f2b9388f
- SSDEEP 98304:lLNqD/uTGvqxgiJaj4mxHJpd9tozE2XJHTYA:tNqDaGvqxgiJajFxHJpd9tozE2XJzn
- TLSH T19D667B5763EA0185C5AFD13DCB0B8A17E6B2700443229BCB1169CE592F73BE16E7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Xml.dll
- Size 159KB
- SHA256 543669c722f33a40dbafab441e1590a0d8aaa48b17db66a64a7db32e4cccd721
- MD5 5c802efbd8398c3148877e67b4fcc6de
- SHA1 fe5a46cdce53072a75819509063e15961d10342f
- SHA512 d5269bc3a4d215d7e9295634eae7a9aff648fd560259c42c0ef0cd5435467430c89ef0cf98497e9e9597095a050d7bb4dec1b850dfbe55c79e2e2d24fa840cda
- SSDEEP 1536:a7LLdm+5hICv8Q0wCslIfO80V+NFu4jRcDXIDlvxe2obYTQj9sYpxABNqMX1f9pl:arfA7QIm/VWRcDXIDa29YjAPqTA
- TLSH T14FF34B8773684286D46AC278CA1B490FFA73709157229BEF81648A352F63FC27E7D350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\archive.dll
- Size 731KB
- SHA256 812e646111face02ae8492d39582bce216845568513b72ada52cb2c4ca0b3f40
- MD5 bf0da6061ed80e963c5e421ab45c1aed
- SHA1 9a6f15040ea74b5dd54556ed10d2f234fde09b6b
- SHA512 75e98f4e9ed033a869ad8d47f826d069fe5a6e76d6d8ef5794428fadbd597e75786d7ddb982482ee1e0f36e103d860dc26a01a6943198bafabcf1c1b72759704
- SSDEEP 12288:WMSFVwT75qJOwJXSD46qTzWftKgQNjVEcNjzxwPuqCctzicsSW:zSFVwT75qEtXm8KgQNjVTNjzxwjn1rW
- TLSH T124F48D82BBF40669E977C1348546AA27F3F1F0551760DBDF06A483653F23EE22A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\bz2.dll
- Size 90KB
- SHA256 39a7d40a7dcf21fc6b09352907465e941a1a6799aa28f6c0d7875785d33e12e2
- MD5 7a8d80c62e502073fd89e8fc49a90bb1
- SHA1 2326d435cb57f5c268b3b6de11c32c6d5da20d38
- SHA512 1a35ca43d494a68e75be9ede182db4a5b62bc79abe37f0a6cbe011c8cc00d9440cc1f6cfbd5b706b69935f4560fed7be2dc987b7e2ea469c4975b6ddc1f59be0
- SSDEEP 1536:jBVEJbODux1isWQ2d/ZGl3Ta5c/aBPEDDc3hTLe8+ti8ynX1f9P7fIkdECm:JuxAUhbrYVLe8GVysdCm
- TLSH T11B936C4476A2BBBDDE9BC43896620747FF34BE690B1017BF3560D2BA2B12BD10E74116
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\cmark.dll
- Size 155KB
- SHA256 85618e723dc422d863765a427c8fb905d2b26aa3f8f7ad6bdf21441dc488c973
- MD5 78c54ea86d22d4ae6f8b894b5dbc7520
- SHA1 a5828ab5155912b41049edcca221d404ec7b57f9
- SHA512 70d8ff955b24568812791d70f3de34cf1d203e2f11490e444bb1f2a89efb9316dd11c42c75bac113190ff0f1e6d34da6bc6b61ea64c9b22ee2c9989630eb4917
- SSDEEP 3072:M5FnWcwoMEnY4Js2CVskFVtTmjq8yKEsj0oCLIit+jO:YWcBSGsvVlFVtaOmROEit+i
- TLSH T17CF35B86E5BC0066CD1BE07C4D6EE986E3BAF2173310C2E716404E65B9E7BE27635352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\liblzma.dll
- Size 199KB
- SHA256 1f423fcdc9108b8878156ed27109fbdb17b7b90b758935ef308516f42157fbb2
- MD5 bc11b63b4e84f7175da645b3529d24b9
- SHA1 50cf46b1e1a762d8fd28ac6d1f0ca322d6531a92
- SHA512 fd3e02b12c944e12d5e979273e33dfb939106c13038ef2d604a416d3b3db6d0e0406ea5557518b1373ee69c2ef677f0c262fd4f2adb9b76522123a5f530773fc
- SSDEEP 3072:P9w3e7cqOlgA0xUaotDWg+/rXaHaA1HRg7GWUs9mNoP3sowfXiedGChg:P9wuf45dsgka1HudYO/3wfng
- TLSH T1AB14399562A5F0D2E2678C34C6678B17E7F678040310A6EF05EC93BD262FBE4563A317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\lz4.dll
- Size 138KB
- SHA256 91fbd4bd121e1cef7191997ae9cb0027746b3b19641d630f332c1b8df9f5d382
- MD5 e8baa675b3b3965716f0a3d675fe6063
- SHA1 ce841b1e419a4debc0bbc47eba89f77e85b9f52c
- SHA512 d9e589bc76368a7f6f06e7921792c7c8cdc66a118ee7918c166909c1d569aba321da150ab2bdcfb9d360071d4b7589c9ddd3b7a3fd780a34c08070a3a6b7ec44
- SSDEEP 3072:es8r+jQPM8eFnR6bWuzTy0A58/Y1glRrNa:er+j78eFnUbnTy78j/w
- TLSH T1DAD37C87F7A4109DE153D0BA96D7964BF674B95623019FE742A8CE712E13EC08E33362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\lzo2.dll
- Size 127KB
- SHA256 14df059d4d9a3199aa884d99d968c34109934fcfb53c1accfa1bf0387b4f8dc2
- MD5 f3b52a2e8a10511187c2a2434e8da3fd
- SHA1 470856a993833f87df8464028fb0fdcdfd906f6a
- SHA512 3fc9b633c8ae71a95c359bf95dd040d7c7e91e405818702215b12ef2d1031292fe1f04dd2953586344f38c702d9d493a5dc18b17616e71ef8100cbe06b40168a
- SSDEEP 3072:bsSxM+h7JWygE0lE6OEb/Ex0JgxiLxKkv8w1GxOSC8:f7MdEiE/ELES2xiLxKkvbGgq
- TLSH T15DD38E5AF1C65068DCE7C2388A9AD2C6F675B4480310ABEF16D1E97A2F43FC58E35324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
- Size 9.2MB
- SHA256 c24c7c84fce7ff1d12c709e0bcc8993aaa2a8cb662381c960ccb7d93c88bc2e3
- MD5 ba97d01c7a0a9e46a6e87d29fe0ba31e
- SHA1 e80c3cc157df9c2105b194aefcd06ea3c4572ca3
- SHA512 6f956ab5c211eba7df5dac20ef55db532b1f307a8e53fc56078af47338cb0f1e5c931fa8ef2d2dfca669caff191e5db4c6c0a89a69f1962e38c1030e74cb61c8
- SSDEEP 49152:7VlXEGLk78+CMXvOKdZgyf70RaXA0jg/e/vJLiZcfzZpQloJLKZf9E0g0YLK8uYQ:VTd6Wmb9YOHSc6cn+HPiFkls3/9Zo
- TLSH T15DA69E5FA3A841E0D179C278DB4A1943E1767823432099EB711DEEA65F335E23E7DB08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\qrencode.dll
- Size 62KB
- SHA256 3d7ad6fa71b1f258ccf3095a757846d7100370d694de19a4b88b626c153d75b4
- MD5 903aa3e4b252fa29696485b2371df310
- SHA1 8dbe12396f86b83e57be6a689d56bfe55877f09b
- SHA512 da3ba4153f94226e3faafa139977bb29259d7fd6218b711c94c949ada52fd37d4339cda3e6aa38c2e9c86fae15f020ebe9849013ad96d41eba6edc1f539150d6
- SSDEEP 1536:wWnJZv7gLP3iPTLSvnSRX1f9hfIkRECmq5:bnLvsr3LvnS8NCmq5
- TLSH T134537ECA7A580189E5578534C2D7DA87F57076931B419BCF1790E79A0B33BC2A73A31C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\tomlplusplus-3.dll
- Size 391KB
- SHA256 da56668531fe7e4a5f61738276a1d0db0f332c24ef5e7ccb21ea99c96d96502d
- MD5 aef4511b9d4ca735967942484438d5d2
- SHA1 016d9b99df5b0072bf1da6c0fdb85a6c839ed2fc
- SHA512 a9a1d23630244b013effa8c581872f545b61e0bba627a7b62fc591c54e8bba91381748d9304e4e8d6dd80ba580a5890619925497d23f74bb214c83078946240b
- SSDEEP 6144:K80P99pO6Zds36KshHf2rHDf0oTph0lhSMXlBXBWfUjjdVJ8x:qPHdVQ9Tph0lhSMXl+UJy
- TLSH T108849E17FB152076C16AC2BCEAEE4601E7B2BC85874167CF17D995A25F13BC06E3BA04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\zlib1.dll
- Size 103KB
- SHA256 70a21e2388ceed18e2a99933039f1417cfca50f70a00f32c043ec8cb269ff159
- MD5 15845d941b17760edcf5b13d532ba068
- SHA1 259a1d8e6e5a9a4cdb91c727eb566ccb1b81b567
- SHA512 bbcd72cd61575279561fb83fba90d194b213675c8e7355ca39adf9739543fbfc7c0b3a52d584dd5b60b0b79e6ab7ba65b3296787bcdf26cca721ef9d3e08f735
- SSDEEP 1536:dvEyaXGzTqbvqRfSOzhppf/ISUaYuOlqjebaIOcIOZ0dGUL6X1f97fIkGECM:GdXozVhppnURkeboSZ0dGULjkCM
- TLSH T180A39D8A6A741292D6F78574D4D28B9ED334B1510BA04BDF5198A3990F23BD02F393FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260824195803.log
- Size 19KB
- SHA256 3d189bb627da67e80000234d600d7ec288707278dd2587418cfaae151e6d6687
- MD5 edc31867b700be8035a33c7721c3318b
- SHA1 48c09cafcfd99e6da48411402361c5fd7528d7eb
- SHA512 d494f030d630ab97894cf1e8eaa2b2cd29e7c1fb8bb4c4c52c09b9bc71545bbcb6b9a2fa5cb6b55f875b9857396d76830c0aeb40e3de9507ff41822ab71795b4
- SSDEEP 192:rxJNAnf1C141n1f1E1q1x1+M4hF12JQpQVjNjyK1XpwHtbCVGJrJUMSkdZT:rxJCoM4hF1H+Vhm97JUMtdZT
- TLSH T180923F5339F7E5603D92C7DE93D11AE19359B24C7E80306C6799CB8C9934C3A97CE28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260824195803_000_vcRuntimeMinimum_x64.log
- Size 2KB
- SHA256 364f6f9cab40e79a36a2a2f64c1c80372eff39f9af0fbbdfa05f29abc52b6c44
- MD5 c7f58a12c42cf08e14bd042444e343e0
- SHA1 1889577739007f7e15a026d127c5369866af8b09
- SHA512 ed2300332fe1c575012e0ec5be359e641664e34519fa17c1de1482ebc0d233b93ba616ac8ff17060254f9e3f67bea26dc3a5f0b86d9f39f06b5f86218997dd6b
- TLSH T12341F9602EE80C59B1B65747DAF3C453AA33FDD26835DB0C2246831A46AFC0558BC77E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260824195803_001_vcRuntimeAdditional_x64.log
- Size 2KB
- SHA256 d686498d92c578f3a71b42625d8bae11063853cec869036928dc8831b30bd62e
- MD5 89510043212cc4c0c914efdecbb2d446
- SHA1 0f41a8022f3ebc9cf3806a9d891fedadc91939c1
- SHA512 43ff15c566a0ff9e234b350c8cbb4bbf838ac182bde6bd8dab9cc2da9ec71bd440a0a1fe59e0aae417b1cf9890bf06f4c96e908c9991934f5c2ff533e0962030
- TLSH T1D14124251EE80945F2B75647DEF3C463AA33FDD16834DB0C2285832906A7D09697C7AB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna15959273122309020354.dll
- Size 267KB
- SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
- MD5 2d2475f1f026dd54e9f3e787ae4f81da
- SHA1 27ff882ac271db547aee520b38e3ba9aa91e136c
- SHA512 07ef110d202d51f096a8b474d25c66b93b16af8b2ecdbf3ab23138273a0771c94dda6426fb644d43dd26cf53924f37821dca4c539d889d435185fff2198b3e76
- SSDEEP 6144:cZkI0LRMj+xkFxdHuGL0x65sz7QZBx4Cp+slm/mgye4:cZX095x65sz7iP42
- TLSH T1BC441917A7B648E5E9B7C03D44236A16F6B178294320EBEB47844A531F73BE09B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\OpenAL.dll
- Size 1.9MB
- SHA256 5d229e267dcdea81a2c20ca2de401df574ae19f2486e2563dafc43decf057615
- MD5 327d0f8efb2cbb7c638933b360c206cb
- SHA1 4c8d30b2f1e761bc35da48b88628f75aaa7b4831
- SHA512 e8d7df1d985615f24f9ed7881bc8d9569b1a31715cd9598a1a271600ed3712233b4f26c123a39f7f885c4499490598f58042b02d1fb6163347c19899c1d3c788
- SSDEEP 24576:e3yU9YH8BBYrXL43xy17mJOaKR8YPDAsdiE10xNLfbUakNM1Z8aIh0lhSMXlSp:EyU9YH8q43x/OaKRHL58xaNy1
- TLSH T12A95AF17B2A441E8D1BAC179CA576D17F772340603B0AACF03E04A662F67BE45A7F316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\freetype.dll
- Size 2.1MB
- SHA256 49aa563541be1df58acd982f3b9586553078dd3e978ea5385281200eb42b6f9b
- MD5 9fb262550ef57a22e9f672078c348113
- SHA1 9b8fc55c26c6eb7a6097dbb4a366120fdd8669ee
- SHA512 c428fc9232c30ea08c94d62b5a4922d4927f7966a802aa403458f9484fb4effe2862ac5efb4033d1e76fd89842b13140886d2676887c4822fca6331b186682eb
- SSDEEP 49152:uWi2+37Qhbk8TMtaJz6M5Iq0TTL03lu/Z/twx2+dEi3GCBNHy+sr:P3x0
- TLSH T13DA59D46E2A610E8D97BC174C693960BE3B274010714AFEB56E09795BF23BF51AFE310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\glfw.dll
- Size 521KB
- SHA256 b0548e974e03b1bb597f9696b3f9d75df66af3cbea0b8246adcb2c79de0653af
- MD5 2a87d38053c2f9ff493093f6ff285e5e
- SHA1 5456daab94d9d7f577ca664261ce66e56d4d1f32
- SHA512 30e622844d18fa9e87799de51a978371048a0aa526728ccaa58a67ef538077294bd8c2a204fd7e146e8e30e1c2ed85961048db5dcf191959880bf17cff5f597b
- SSDEEP 6144:qXrheMJZDAYSt2fclQhYBddhKsAYnBkOzyxXW+:qXrhrNdSoVYP/iYnWV
- TLSH T194B4A51967B2064EDF2B4433C6CFB9219477B04C3FDBA49E7E9019E57D21FA180A9B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\jemalloc.dll
- Size 390KB
- SHA256 557cc5f6dc2e7b410111afe83a11f3a8da8963ca8eddf0c542559329cbc0a5c2
- MD5 0b3dbce09db0a089cb9a202bfb409e3d
- SHA1 c333cffa3bd364f12b8918b8755d7155e51b80ee
- SHA512 ce89dc3a101f11b5344c54f862bb3f3f207868ee46ac75a7ff14bc071f659f74fb14d768d15aa17a209c415df81fa6ff7a492a62d46b4adc914df73be4513bae
- SSDEEP 6144:b9xOYD5LY/t+X/6RWqKE5I5lR4xC1IAeuYNaEv1v66fFeGDn:3OC/6RWFE5I4C6vNaQPRn
- TLSH T1DC843A46F3A944B5D5A7D03889774607E7B2BD284726ABCB13A04B552F33FE95A3D300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\lwjgl.dll
- Size 509KB
- SHA256 6a1469be51e2fa8be8c70d8aa7bcaa4a1704055c62291490ea453f3ce3128377
- MD5 5fba38b92efa71a21f01d2b0256f72ca
- SHA1 eb335b881e81315e93c8bed725d9bab75eb5986f
- SHA512 b0f35b4bf9636c9a2db5a1c5f9d8f03d777aa1c442e241d288b7f3a5435fe538fcb521638d5b887324cfb2061be2880f75803c3c5995509aea43ba9b5812de3f
- SSDEEP 6144:0mQ2XkbiOWkzsLB5Xn1hEAIvSumvyIAtroFulyhGct8f8XZW:0mQ2XkbiRXnjSvSMIYroF9hG68f8X
- TLSH T17CB4E631DE22C68CDCFB763A60531005EA7678641B1222CB57A79A4BB11B7F093F6F25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\lwjgl_opengl.dll
- Size 351KB
- SHA256 19882eb95b4c10d23a5e2caf61672cb367e445ae168f7f87bc69b787108b9081
- MD5 915ff1007006cbefb55b7ff8b964f9fb
- SHA1 1e002182f47d9918ea960dd6302d4e8c5c839a2c
- SHA512 c6bd21e2e4821ef8b28f20fd7f930db1ba29e549b23893d017c9095c88b07c9902e994b313ace75c4ef6136ffc2bb97c6a396205b06e0ef251e7fe0adbfb5194
- SSDEEP 3072:4Id9tCjbLj7TrDbzaEP2VL+8F9gPh7Z24oof7dUB4Ome2uG+WQxckixrIYQVSuUV:4Cwt6b7x32XpduLQdj
- TLSH T12274533BAF97C4AADF2B3539D1940975E12CA8B447042AC3210CAA86F5CF6F451F7E25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\lwjgl_stb.dll
- Size 593KB
- SHA256 4642e771ff4467baec2176632103e0fa6f0fb8817954c59606944a2e746042d0
- MD5 e3142e48a5eaa2bc6319d60833026e24
- SHA1 9fc7ace36ade66213ca556bd849e438ed13b297f
- SHA512 fdcaf30323ccff577faf6be15ff39300462834b79c96d94240c09bd4338b63b20c3e814b20c68311f5e420913325ad915cb9b62bfc027daeb0c6be32c9d51a3a
- SSDEEP 12288:XHbFZ1z7FpEoI2hTzSUX26iYahBeHzJqC51sMDQPOtoxMod:XHbFZt7FpEoI2hTzSUX26iYah4d1sMDC
- TLSH T16BD48D44FAF684E9E42790385167650BF632341903609AFB43909A6F7F67BE01F3BB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\lwjgl_tinyfd.dll
- Size 249KB
- SHA256 a68bca84a9f40b8059db58042db3271a6dfea76826162d4103be6916cc6905b7
- MD5 e74e12a8b8658237e1ce5a5c71b8b8c8
- SHA1 40cf932243fe28cfb2fb92876954758b2f7e6855
- SHA512 a3fc7c59a21e935d2ce81cd66ef4e36972543e557c985f4f8265e3cd60e2eb76504929f6a6048683b6af3729f28b6daae9afdbe773dca568242054dcc0f594e2
- SSDEEP 6144:wyNMKj0dKNrsiywhofX8iwyIrRkYNvdt5uApuoG0+4Y:wyNMKYdKNrsiXof8ie9nvv1usY
- TLSH T1D9447C5473E408F9E9A7A23C89A35906E7F37C160770DADF03A0466A6F237E1553EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy20F.tmp\NScurl.dll
- Size 6.0MB
- SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
- MD5 bf43de0fb8a2c38abcf7b1cf6be7e7ce
- SHA1 5c14855ddbf563da3bc14af40ea5650d627ab81d
- SHA512 145388afde1367253d723ea78501dfd61ebcfb17d440d324dbceb5d9b1c50dbd5a69946209722396f1d0f3699dc967bedab690dd670eedc9910b75a4e7d13830
- SSDEEP 196608:ohFz25oFKhmagHDetua42OOMoMy+Tgt/VqiWWO+ac88vdPkR:oXmSLTgtDqU
- TLSH T1DA563994FECB44F1E91384B0D8DBA37F9B349B118021D6BAFE4C5E56F933701252A25A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy20F.tmp\System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy20F.tmp\modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy20F.tmp\nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy20F.tmp\nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\assets\indexes\32.json
- Size 572KB
- SHA256 4f6a272a6eac2ff67c5d83261781c49f79eb5ede1435a88e152483b871e785ad
- MD5 f4a56f56d814c8a707c00890867024fa
- SHA1 773791767c043b4f9493b50c54257619cecb08a4
- SHA512 ad0fe18f7fd1c1ae18680ae70490d640a2f250a4d03c2f900498a9950fd35908930cd4ef0a182ae43d9823d2ba5dada8a6522c5a386c86506abdfac3d9a893cd
- SSDEEP 12288:+7VN6WAJFXH9saGwUonFqre4obp2uQX0y8mBqmCsSM/m8XIB7w+nAMMwvtAOxOz/:8jtq6C1lZpBNA
- TLSH T19EC4DF96DEDF37A7F809DD65B57F0A039320C21B9304C78DA66DB342A5899DF2012BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\b1a872\instance.cfg
- Size 51B
- SHA256 ea73fb793bcc1107859afc199952a3c90527bd1968410793a0567f514e10a90f
- MD5 dcc3bad556fed4baabf1b7904c455b52
- SHA1 635adddda4ab45e17163b33ff57201f271a8e1a6
- SHA512 1e33f79edfc1774c45f9fc30556a9ec963bad3455dfc8c505c520b490584a5e5173856f590ba9afbe69582d3b2dd4c868458d27886719f89d5a7f015bc13137a
- TLSH T17690020B5311207A04990745C1425C414F7202409128002821696D87A748D4665DB529
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2(1)\instance.cfg
- Size 120B
- SHA256 bf568338005c422cfeb4746154e000422575d82080c348137d68f6698a8a0f1d
- MD5 72315c3be76a8f282942e006d0ff3dd4
- SHA1 4c1143394eec9c3c4561d653cb9ea33e652dc884
- SHA512 d5a3a6ab181530fff2b189d91e107798ade49925703d2ad61a12dbdffb511d89d3d9210528694ce783686e62d74a6eeeb762d5023095512f4c1a0ce6f09a5830
- TLSH T150B0924B7B40217D2CBE16898E03F8225F356150A06E0518B5281C86F365A8A67CF26B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2(1)\instance.cfg
- Size 75B
- SHA256 d3c249779925e399b2c0bca4fd7530fb8f61cc32f6f2b53ad9d24c6ffbebaf7d
- MD5 d5539cd6ff147fda70a1149ce743b2d3
- SHA1 f42beda58d63d98ec65dcbee6d4c66c40953de3f
- SHA512 ec481ce9c5172ddf52d5310d06010f5a020de506c1e2549a924515145dc6017cd56f4363927ea0990b2822a17f2e1a678597497b463687e9ea50a116ef0af6e0
- TLSH T119A024073740103D007C0704C5035C110F310100D03C0414313C1CC77354D4331CF11D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2(1)\instance.cfg
- Size 418B
- SHA256 5d8d8df1ba69009386377d4ab1092987ca0a4f62c4f8e930cfb1f528540caf49
- MD5 4ee92e4ac82403a4ded44795eddc4591
- SHA1 0100bf5b873edf623c51153fa50e8d5a05ae4303
- SHA512 a5679337f84435df35a7dff007db48086d68e4a1fe0a4ab5c594da2c2491782f54a1e2935a49e7744305101d18741ecdf8026f58ed613abd77e23a85bd7ada1f
- TLSH T14FE0AB837B3160BC786A4B5A4F43F9271326BD08A01E0078F01C3D0971A1F05A1DA04E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2(1)\instance.cfg
- Size 1KB
- SHA256 2877df74d0dad99e344ed1e847cb0582c44d9562f6f20ea839a06a8a94db573b
- MD5 4b81c00f94eb1122bb9259ed9213f63f
- SHA1 e0a0b8f11269725a100a3258c4faec943e0468eb
- SHA512 84e9d74e07f2853ad2f5a6ac402a8e7841671d9c68c56bc018381fa29397eebe418eb662e259a4f106c72ca57c8ee51ad009ab5eb4f724ba0dbac8f30b035d91
- TLSH T13B31F1416F68607F6419240F5F57F0332B0B7D5A54AF7492F339388EB14DA6C12C9189
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 79B
- SHA256 567418e1f851aa0d2979c7f4288d1b64069f94186a2f5507f7bc435c40592ba6
- MD5 532ba733443c49510647782c6eac6d0f
- SHA1 c34dd4da6fb37e3f85bbb4fc9cc99682c08a6e96
- SHA512 d62843776b21fbccb3f9c94f5e29f13b985e47efe9972179c6821b74f1e945fc07d9d51972e929005a565fee629980e723b5c849ece3568fbda7abc97bd6ad75
- TLSH T11FA012475302102604850700800A4C418A2101044624201432942C9B5754D4114C6229
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 1KB
- SHA256 bb89203e7db46addf31eaba7d28a525412d71717d685044e4d62facd4efc4137
- MD5 dfb0c277927a65f5d3c8970d4ea521e6
- SHA1 54b97d5559c0769bc7345d54bc3f2429cf7a044f
- SHA512 6b5249ee6d6b8f545267bea40487f9e95a2096c72a2f808bb0c49da54831641ef3c1e0f1b3ff4a9899724d93c66383a6f82593a0fcba44dff7662eb45d8dc566
- TLSH T16B31D1416F68607F6459650F5F57F0332B0A7D5A14AF7892F235388EB149A6C12C9189
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 1KB
- SHA256 71115ec3b57b76ed47224cd9e6c2b76283975a3a60c812f51862cf3399b702cc
- MD5 9a155525b6f8b80fea5683218b9924a4
- SHA1 afe5049b3effa754b713c4f10c7cee56375c812a
- SHA512 fccfdad8ae3135d5d43abf3e39ff6fe5a6e16cd48e0bee0d8db0f174f1c37b09c1de4c5b20e71ecead8658a8f91c7403363721f90a3ce835250fc18efc72985e
- TLSH T185310481AF68607F6418650F9F67F0332B0BAD5914AF74D2F335388E719DA6C12C9149
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 2KB
- SHA256 cb9284845c2ff0772feee0a94721c3e60fedf4d91847cb5061bd8087cc0c58cb
- MD5 a91cb3d83e1f006b936f01696dd494de
- SHA1 e2217cbd92a91d01132e1dc07efe22c19c046925
- SHA512 21db111974501fdffb867156df3cab5ef1790639460e2930bea0d27965b54ff3058c2855d8227de8370f6c4c6e1ffe237385de9ddc31992116f5e93ce2265b1f
- TLSH T16C4120729F54E47F2C34140AEF57B0332E0ABD6B189EB681F639388DB0C8A5C59841A9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 103B
- SHA256 2847585761bcbf0cae6dcb405e6b7447d467048f188e34d1bd0a2d382375178d
- MD5 7fa37a535cd45e61fab9a92cd298e624
- SHA1 11a040a9142db48fb0bcbcea95e5eea7d29d1773
- SHA512 f2d8418502ddc0289d141c6420e8ad99424a27a54203faef081f891ee918e16a22176090fc437ec5e7d1bc030e65c97e0dcac4df4b43cb6c6ae0b967ecf4305a
- TLSH T1B8B012477B82103E04A90B04854BAC628A250504563C351473A82CAF67A4E8225CF32E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 148B
- SHA256 9d27fee972a9805dba22b260187a164000cbc4148fa05600311bcafb946b6b11
- MD5 36211d47cb6cbe1caccf2b055bba1065
- SHA1 109857aa67d463fb73d33f025cd0e813fe1a747c
- SHA512 6fad23c216ddd8a5764cfa5291ae8c3d77b5cb98129b8bb65b616bb2a6694c708fc89850e0fe24276259d4083144af169888a9efc5139caee53df11a790dd459
- TLSH T140C02B877F41103D1CBE06484E0BF8238F346004153E2104B2641C5BF361A8627CF32B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 446B
- SHA256 634719e02c7c89d4459d3b2f595019974697475dffb73ff71e6b9dd3b9d052b7
- MD5 06831aaa6addb1c5caf9645a78afab56
- SHA1 efa9aed171f54c505d30fe5c9d24cdfa083772f6
- SHA512 93c846149ad2cef96d5f75e147e3d8f6fb267b2a4639be7222cf97b14573d9eeb784202cb85e0aca8c6e497a2118db6c5abcd416be204a24d79d323531a21ba2
- TLSH T12FF05583BB3260BC78AA4B5A4F4BF927132ABD08A41E0078F1183D0971A1F05A5DA15E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 1KB
- SHA256 8ae3eb290cda2e30e8b7b48ed871247a17edbb2f15cebbbd7b6e8dc645e2ee2d
- MD5 2825febd7fce614e41677be5fb64511f
- SHA1 a583eaf6bb1483594357e9978cf671157e0bcdb5
- SHA512 464026a5b191e9a70c5ea690e77724ab924dae0df28e22e1bff4660b548bef9c1db87b8ed679660c4f9b2c75e263f58bd68159bf9a8228fa08e46e0ae61f0184
- TLSH T19121BE426F2890BF7419650F5F17F0332B0B7D8E18EF28D2F2352889705DAAC12D9199
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\instance.cfg
- Size 3KB
- SHA256 a29bca98d5cf8737484e60b2c4aba9ea6e7b60428c6175dad5294a4accc653aa
- MD5 630898518375ea1fa85e1bd88fbd968a
- SHA1 c8898f55b49113d479780297fa136f203030201d
- SHA512 d8f5fcda2ec932069c6ebcfab3ba8839d6fa33ee0e28fc5c6de64b24d52ecd231fed8d79504f2e27fc4d9fce08565e6e4c79a4afc601697b9bc0f2c051be5953
- TLSH T1465121734A66F87F1C342D09EF0664371E09BC67399EB5C0FE6934D9B0DA9188B851B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\26.2\mmc-pack.json
- Size 643B
- SHA256 7d2d10cb55c86a5305a69dd32f502f6d689f411800ea03765096c51e2d143db9
- MD5 e091acd181d1d61070e14ca671f651c5
- SHA1 a930a3d430dcf5d842b525d8f58a549f57e61a24
- SHA512 c8c3cd4417149ba98b4ea9e6cd9d3c2666b449d0cf50ffd22bb1b93a86dbdf28b268d946db9c418c8518ad654b42c55ec601618a4c35a335eb7029a02fbaf33d
- TLSH T1F7F0E534C2F11C723564A374087A41AB957040676FA43EAD730DC10C0F1CABF61652BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\legal\java.logging\ADDITIONAL_LICENSE_INFO
- Size 48B
- SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
- MD5 512f151af02b6bd258428b784b457531
- SHA1 84d2102ad171863db04e7ee22a259d1f6c5de4a5
- SHA512 1a305bc333c7c2055a334dc67734db587fd6fda457b46c8df8f17ded0a8982e3830970bee75cc17274aa0a4082f32792b5dbff88410fa43cc61b55c1dce4c129
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\legal\java.logging\ASSEMBLY_EXCEPTION
- Size 43B
- SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
- MD5 bd468da51b15a9f09778545b00265f34
- SHA1 c80e4bab46e34d02826eab226a4441d0970f2aba
- SHA512 2c1d43c3e17bb2fca24a77bea3d2b3954a47da92e0cdd0738509bffcdbe2935c11764cd5af50439061638bba8b8d59da29e97ea7404ea605f7575fc13395ca93
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\legal\java.logging\LICENSE
- Size 32B
- SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
- MD5 663f71c746cc2002aa53b066b06c88ab
- SHA1 12976a6c2b227cbac58969c1455444596c894656
- SHA512 507b7d09d3bcd9a24f0b4eeda67167595ac6ad37cd19fb31cd8f5ce8466826840c582cb5dc012a4bd51b55e01bb551e207e9da9e0d51948e89f962ba09606aab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 30B
- SHA256 e7bb8d933ad3397d35cf1706f0364ebab6b7c73b6b6846cdb0383db420c2cb25
- MD5 412c51abbdcc110394940f8bfdee3d3f
- SHA1 17df4e8360e0b635622dd12a6a36088cbb47b2ad
- SHA512 77b3d41680d77ed7a29b3d0e1d07583bd1a29d0c3939f0eebb17639cf2e92447fc5eb784635d0b44ae0b58a5212b4d9ca6505a02d0d2c9a521089a8b33437440
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 526B
- SHA256 c958889613f65fd7bd006e994e5139bd853d7b69b26df704cf7bccc91b2760f7
- MD5 9439705baeb9f334a61818c47032fa48
- SHA1 8605279450a439c1143e546baa2891e23ccb7850
- SHA512 ccbe5ec46e32936df8a37d4d8d84956ce0c13dfd0fb536bcac6713d6a61f1f6ef089c40fa9f05b3a4fddade2c9c8a1b1c86bd049beec849f07f5d56ef3132202
- TLSH T182F00E3392A0E0B6FAF71BA45082AE86AD863B5344810189B449376FF3E5A48C241AD3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 1KB
- SHA256 29c95786a743eb453fda72d92969c1589f655cdd0d807ab5be8b14ec09be5f6d
- MD5 52662c49e69e0cb6703e1928bcf8a4d0
- SHA1 05bc1709c6e481dcb4880505dfba140121c6cceb
- SHA512 a7c7115485b69b2622a39f31523c41a009f593c424e809bc842bb17dfa08b3bfc83c18e52c5b01b1db54155614e57997ee8487b047155548dea8567490ef611f
- TLSH T16021AC7380A4687FD850492CA78A7F360E2D263320863C8DF0DE532EA6F39137422696
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 398B
- SHA256 17ecfe70e3e98fd32219e470f322a1618d0c9dff4afab2f8eae1c35266d6ba3b
- MD5 b15da31ef80f48810d11266b2cd8fa62
- SHA1 9f7cfb6e21c0ac1d9c50d0f8dd0d4673c4a0ef86
- SHA512 2fdeaa9e55bd38a5c127f183795869ce4f84f3f9e9b04a48c02bd2e8007bc9e58c5596cb94243c7980fe417c5fb3d579980351f1539d2d6d2f015ca899e5299c
- TLSH T1E7E0F1732620E076F9691BA450835C069D433A0359C50081B0453A9FF3A1544D681C83
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 802B
- SHA256 7a3707c05e03f6898292f7b07bfb301277012a57e0d03d0fe6393f0eba16663a
- MD5 a3fd6abb04aa479d3461ce42b4a72c76
- SHA1 0bf534a28b7ebb564d7144ed22103f5022387189
- SHA512 7b0bd35d7d2d2554105e1c5db141613d626cc3534eed376e82798a1c7768f82d3444c353e591e083d1f6be78ed8311669fe87d02cfe473c7cb52ae125546e2b3
- TLSH T1F50125134290507FF9915A6CD6456F561F5E662310802C4DF0C9633FF3F35099102697
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 464B
- SHA256 39c41e32aa7306b9cc8cb9425f1b8a43e3e84b6ec9222045eab7e8c47c89b7ea
- MD5 d12b0e47c076070e51de42f6f196d5d0
- SHA1 01d7484e7d0ba991adb41f667a9abc3b90156598
- SHA512 73577a2f337637ecf2f74c6cfb968b810897f52868e4f087262b54e805d6743e669926dc2b1d153ea7f0defa1ac736b7fcf0818373bed2d98a2bbffe1a50143a
- TLSH T1A2F0233313A0E071F9AE1BA850835D8BBD433E0349C000C5B045365FF3D19489281FD3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 1KB
- SHA256 5a422ae82a49ba86984025d1c2499635d4ded86898ac27a7af2e94627ab2ca3d
- MD5 34333557bc71103b2b9002f3168a3d5d
- SHA1 aed75d2dafcdb8c12e6a1c3bc4c3162df4ccca3d
- SHA512 80a64eade29160f92462cef7d3aa2e3dca60a5944afc956646677b770640ae6ad9a8ac789500e5c67dd24b51e9e2f485c00d388051b70ceff1955e386bed5dda
- TLSH T18231AC7380A4687FD850492CA78A7F360F2D263320863C8DF0CE532EA6F39137422692
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 1KB
- SHA256 0e64e6b7abc73cff1e1bc90098b9367e38d1503480d233b4d6d8ba272c607022
- MD5 0b5f4d378e052f5ff6ae24602f21e991
- SHA1 7b8c3d81e1b5a8576d36f9d141d8bd618228ee49
- SHA512 c2d2bc4ce1e9410722f263c9fdfa287e0ceee42761156f67e988c698bbc48fb28d6e1f4e1b0f956aba6587291afddae91d5d3bd09842028022497b1d53cfc802
- TLSH T104216A6281A4147FE840493DA78A7F761F6D667320813C8DF0DF932EA2F39077022697
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg.lock
- Size 66B
- SHA256 a30917b814be8f7ed7f0e45a46fced4cfac5977d44ee3622c6ceeb09671d3e34
- MD5 866a62bdd33fc98794a7addd010c3b2e
- SHA1 c22eebf2eb214a7847a93272f99d9ab017b972e2
- SHA512 087d59b363a9a3b153f3965e12e5cf1d0392c1bddc4340d75ff79fb0b7425fb094bbb7ab8dab75e16cf69990a4576649d48320ea0aa8583df658d4f0d5293f89
- TLSH T15CA022803F0B032382B8C02A3800220A0802000C00B020F03E3E0020830E00CBC20300
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\msvcp140.dll
- Size 544KB
- SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
- MD5 bc88b387cafa556068b5c5d6ff3ccc8f
- SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
- SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
- SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
- TLSH T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcp140_1.dll
- Size 35KB
- SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
- MD5 2a214cb2f0f9473e7765ee3b8db8651e
- SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
- SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
- SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
- TLSH T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vcruntime140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vcruntime140_1.dll
- Size 48KB
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- TLSH T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{307F278E-B166-4B4C-85DF-BDDDF54AD92C}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{307F278E-B166-4B4C-85DF-BDDDF54AD92C}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{307F278E-B166-4B4C-85DF-BDDDF54AD92C}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 5.4MB
- SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
- MD5 ea81447ef1038bd5726b36063896b39a
- SHA1 8f484a24bfe42276580d120c200a99bf604eea70
- SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
- SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
- TLSH T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{307F278E-B166-4B4C-85DF-BDDDF54AD92C}\cab5046A8AB272BF37297BB7928664C9503
- Size 964KB
- SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
- MD5 efc41c00aadf8b2050ecf9e38e9036f1
- SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
- SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
- SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
- TLSH T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{307F278E-B166-4B4C-85DF-BDDDF54AD92C}\vcRuntimeAdditional_x64
- Size 208KB
- SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
- MD5 f375f3d81a661e188146d701d8ed3ba9
- SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
- SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
- SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
- TLSH T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{307F278E-B166-4B4C-85DF-BDDDF54AD92C}\vcRuntimeMinimum_x64
- Size 208KB
- SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
- MD5 23626831f9a05572c6ebd133e5ffc4b0
- SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
- SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
- SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
- TLSH T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{35805A04-16BC-4457-B488-587930E8F11E}\.cr\vc_redist.x64.exe
- Size 670KB
- SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
- MD5 bc9c8a6a42e8d3ea18f8da78d5031820
- SHA1 07812a4b945364d04627363e46ab38de188281b3
- SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
- SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
- TLSH T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B05C4BEB-E523-41F2-821D-A961D1F0F55F}\.ba\license.rtf
- Size 9KB
- SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
- MD5 04b33f0a9081c10e85d0e495a1294f83
- SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
- SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
- SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
- TLSH T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B05C4BEB-E523-41F2-821D-A961D1F0F55F}\.ba\thm.wxl
- Size 2KB
- SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
- MD5 fbfcbc4dacc566a3c426f43ce10907b6
- SHA1 63c45f9a771161740e100faf710f30eed017d723
- SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
- TLSH T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{B05C4BEB-E523-41F2-821D-A961D1F0F55F}\.ba\thm.xml
- Size 8KB
- SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
- MD5 f62729c6d2540015e072514226c121c7
- SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
- SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
- SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
- TLSH T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B05C4BEB-E523-41F2-821D-A961D1F0F55F}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- TLSH T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
- MD5 SHA1 SHA512 SSDEEP TLSH