Analysis

  • max time kernel
    132s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/09/2026, 23:27

General

  • Target
    SKlauncher-4.0.29-web-setup.exe
  • Size 838KB
  • Sample260909-3fl59asbjf
  • SHA256 62b2d500c04740285f9723071aa3dafc762246ba64205c98a10012748861a14b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SKlauncher-4.0.29-web-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\SKlauncher-4.0.29-web-setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5164
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1072
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4652
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\sklauncher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1368
  • C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe"
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallationType
      2⤵
        PID:5008
      • C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe
        "C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1724,i,16270496608608586572,17421005685150475489,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1728,i,8316704763523026579,2718252475654207347,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1720 /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3616
      • C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe
        "C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --standard-schemes=starship-screenshot --secure-schemes=starship-screenshot --bypasscsp-schemes=starship-screenshot --fetch-schemes=starship-screenshot --streaming-schemes=starship-screenshot --field-trial-handle=1724,i,16270496608608586572,17421005685150475489,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1728,i,8316704763523026579,2718252475654207347,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2000 /prefetch:11
        2⤵
        • Executes dropped EXE
        PID:2944
      • C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe
        "C:\Users\Admin\AppData\Local\Programs\sklauncher\sklauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --standard-schemes=starship-screenshot --secure-schemes=starship-screenshot --bypasscsp-schemes=starship-screenshot --fetch-schemes=starship-screenshot --streaming-schemes=starship-screenshot --app-user-model-id=pl.skmedix.sklauncher --app-path="C:\Users\Admin\AppData\Local\Programs\sklauncher\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1788996070267875 --launch-time-ticks=699012725 --field-trial-handle=1724,i,16270496608608586572,17421005685150475489,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1728,i,8316704763523026579,2718252475654207347,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2608 /prefetch:1
        2⤵
        • Executes dropped EXE
        PID:2672

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 fc8995884868207e15488a40901a8b939499e807f30d815d021d118f5b4ae383
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 77676bfb9bb0a59b0672e6c05c5b09ee66b8981d03af870d74a33c1e6b9f4a54
          • MD5 SHA1 SHA512 SSDEEP TLSH

          __PSScriptPolicyTest_oo4pjut3.jbb.ps1

          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oo4pjut3.jbb.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\LICENSES.chromium.html
          • Size 18.6MB
          • SHA256 62e3b53be6bbbb2e7747b7a55c8b4f4a3cf38b95e0fff594737b3bfdac8cf373
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\chrome_100_percent.pak
          • Size 113KB
          • SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\chrome_200_percent.pak
          • Size 183KB
          • SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxcompiler.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\dxcompiler.dll
          • Size 24.5MB
          • SHA256 d0bfe18b1fe15a2eb40f8955f3d1a7d54040e8c321158207803668e892727c2d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxil.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\dxil.dll
          • Size 1.4MB
          • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\ffmpeg.dll
          • Size 3.0MB
          • SHA256 33559a766ca7b5f0768145eeefa53b6fe2eb0d651629bdefd4786b4569a9aa84
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\icudtl.dat
          • Size 10.3MB
          • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\libEGL.dll
          • Size 510KB
          • SHA256 ea6abea4b5520ee55d5bc7b2743855397f7d58906ec2d95bce0cd5cc41fd7eaf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\libGLESv2.dll
          • Size 7.6MB
          • SHA256 276f69a4b413c7f78658591a8b1abeda9d19a5ecd7df9388fb3ff1181a5d5cf5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\af.pak
          • Size 596KB
          • SHA256 7bf59977f051c1ccb19cb8c48a8efd57922d088ad26cd51a85a671000c845a4e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\am.pak
          • Size 966KB
          • SHA256 a387f4af550667980c7631532b5c8f50a20ecf2c2f45392a7e0bf23f8f6c91fc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ar.pak
          • Size 1.0MB
          • SHA256 e8f4b9b64235893bbee95c8360c739e5ba09687072dd4b7d706cee9ae4032887
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\bg.pak
          • Size 1.1MB
          • SHA256 da36ef0cde92b2021ff39b6c3341f4d2832c1129d13248aa371573812140db9a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\bn.pak
          • Size 1.4MB
          • SHA256 4f246bc78ddfc2cc249ae99990470e2d470a13a2d7599ab8787400c4fd179cdc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ca.pak
          • Size 671KB
          • SHA256 b232cebcb102bf03c81286f1ec082e80d0e399d09d9251c3e574ef24fb15b68b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\cs.pak
          • Size 697KB
          • SHA256 58b2d7c81430bec91ff72560acd604df82ff0090e2c4e3d1ce8cac2b69bc40e9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\da.pak
          • Size 626KB
          • SHA256 66de87f60ce23d82457271b34da1baed85bf0f3f63b04d90610a20c4ebe66c23
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\de.pak
          • Size 672KB
          • SHA256 dadd0439167371607d9a82222f248f268d9e27669c1d87ca09d8751c07a90d01
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\el.pak
          • Size 1.2MB
          • SHA256 9a9db32904381a6eda169f56099313a494dae63f2795678449c4ad87cd3a69fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\en-GB.pak
          • Size 543KB
          • SHA256 7bbcf19623b0a34524d75a3211d305d6b01150b3ecf2bff3b140189a13c29eb4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\en-US.pak
          • Size 549KB
          • SHA256 446a0f711467b162cced38128932f712e4a53fe344a165110196c366fd3d87ea
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\es-419.pak
          • Size 662KB
          • SHA256 337a0ef8be48fcf7d120026d8dd9970737604ad177df1709fefa5cca79c70079
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\es.pak
          • Size 659KB
          • SHA256 b32a3073e0e749b8b1f0f3e082343a8ca192cf3b7244847387526a5cd8beef7f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\et.pak
          • Size 602KB
          • SHA256 740a4632aa00dbc07251c10cdef1480739069a6456fa9a642eef387fba935e09
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\fa.pak
          • Size 996KB
          • SHA256 7d13dfa4bc6ea7ae996f0696eb328de26b35e1ec7e606fb0c4f8192d4bfcbaec
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\fi.pak
          • Size 612KB
          • SHA256 53cca3552a8bf4ccc516103cdf929b5f10ba1859ccebe644bb080082faff6878
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\fil.pak
          • Size 695KB
          • SHA256 3503fbfa400b23a3019005a2f1d7a31d623b056889a66abcaeb1558ad4316924
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\fr.pak
          • Size 716KB
          • SHA256 a8db41476a1103bc5bfb617b150c6b6e2ca1eb24f534872c9c15e353649cd0bc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\gu.pak
          • Size 1.4MB
          • SHA256 947324c6aada6255df0c702114796436215f8012634a58b065b7ff3fc92162bd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\he.pak
          • Size 871KB
          • SHA256 d06fb5dc66cc104503a861d2e4e6ef53e9172549c862aadeddcc2b5bb856f25c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\hi.pak
          • Size 1.5MB
          • SHA256 a775f5724ccbe9bdfeefc448b42e3b48402f81404d94dea4252bfb765a314b96
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\hr.pak
          • Size 671KB
          • SHA256 84c6bd6ce5bcd81a89b0908f22576725128e27688f6578d13d8b2f0e7fa6335f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\hu.pak
          • Size 717KB
          • SHA256 cd1026c6596610617d8a313b899e9d2e2514d0cd1fbf97790f2c450309ede792
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\id.pak
          • Size 592KB
          • SHA256 4de71f7c766db79412dcc1f5521c5f3e678cf343327cc31b0fc28472102e0247
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\it.pak
          • Size 648KB
          • SHA256 ac12cbbdeeea05f0cf90cc57df1f6ef299444b1f499157eef8aa089f73da25f9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ja.pak
          • Size 791KB
          • SHA256 c737584f4b525c4d17cc2a79f0318640a7a666c43ef7aa24753551d1b75d7d7f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\kn.pak
          • Size 1.6MB
          • SHA256 3eb9b3dda74b5e21abf7d7726cc2e682afd87141ee30a488e288695d48a5352e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ko.pak
          • Size 671KB
          • SHA256 bcc64be2004522a68a12dcfb6efb45f030d0badfe048220d2830b188e7f4135d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\lt.pak
          • Size 729KB
          • SHA256 a7eae3ba06229763b85b29eb64e011b992679952165bb7239a9ece1d441de4ab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\lv.pak
          • Size 727KB
          • SHA256 8a4c31840217419f608b15eca1490bb4e83c5a896556a045f95af7f1390f5f8a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ml.pak
          • Size 1.6MB
          • SHA256 434221a29e71a6dfc6c14a5843713df51b2afe8cc3114cb9fedfbfdfc590ce4d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\mr.pak
          • Size 1.3MB
          • SHA256 ae12ff8ac009a4991d71363ff442abb3beaef772d08e72f4ccd685403a02f332
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ms.pak
          • Size 624KB
          • SHA256 77912adf05407adf3dfd2b0eba269b1cb99d980dd0a16fae74dabea3a584a869
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\nb.pak
          • Size 598KB
          • SHA256 81b5a935f83a49ef4faf7132876e500a6cd49909c1d2b45d4bf1336769874b86
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\nl.pak
          • Size 623KB
          • SHA256 afc9e6696a40b0318ba96e786fe0b286c3ea9a2d548479c1fa43d96b1c137c62
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\pl.pak
          • Size 696KB
          • SHA256 f92f6bff33a975e189b78a4cf0e153e85743dda432347745ebf8f1b4ff51a99b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\pt-BR.pak
          • Size 652KB
          • SHA256 d1aba0dbde99231d3096b7ef9ec62ed017c72804257de62ffb649d45cf234f9d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\pt-PT.pak
          • Size 656KB
          • SHA256 1326efcde830a8b29541c98fb51e3b5e5428d2a59e1b21a11a677317d08b2bbd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ro.pak
          • Size 681KB
          • SHA256 7fd5b85509f67394eee48b07339c9a3a77fb1fb99b6204bae3209f9f0ffab3b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ru.pak
          • Size 1.1MB
          • SHA256 23166d431d70048e248e3ff47732642cb1ab73f9516384e33ef3c1979574f2ff
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\sk.pak
          • Size 708KB
          • SHA256 91037f2ecb636857b92a2729b7c116d8dd98082b068e4f78b0fdab06f27d2eb7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\sl.pak
          • Size 678KB
          • SHA256 321ab341e3225dddcac858448367d43677c20e739b2ccab52f8c86aa0727d868
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\sr.pak
          • Size 1.0MB
          • SHA256 7b337dcad390a9f08c3bd1d27235898e588827fa8da8808f4bc7012011578ef0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\sv.pak
          • Size 605KB
          • SHA256 f10b4db7184a14f28bfdad82597d2d43b4ec859ab6eab59a5c3891aa6070f3ed
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\sw.pak
          • Size 640KB
          • SHA256 726ba26363103920712874418cbfc23ce899c46ca8a6dc3ec9da0bf48355622b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ta.pak
          • Size 1.6MB
          • SHA256 fd8fe5c21a10e6542599e9148c8a30557c4d437b9606d6b29b685d474d89534d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\te.pak
          • Size 1.5MB
          • SHA256 28b85fa550df913e970fac8a599ec4963b1466e3b610350924518de107e41602
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\th.pak
          • Size 1.3MB
          • SHA256 cfd9e6651e9335fbc0483aed1098112234e973303bf7101d88e0518d3fb16ffe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\tr.pak
          • Size 651KB
          • SHA256 4b047663f169169f3ccd33923782ae33348c37e5107314d3324f1850f3c5fb42
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\uk.pak
          • Size 1.1MB
          • SHA256 3ebafedd5f6005f56a2d7a500e59bcb435e58a6013c7e075b241a91ab1c605ed
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\ur.pak
          • Size 981KB
          • SHA256 51c318f3df2673cb34d0df9235021dd1794073cddf59d14433620da1141ec650
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\vi.pak
          • Size 774KB
          • SHA256 45c351251b938ea6f46305f2c324e8144bdf7500e08d430f8280b7db9e2ce52d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\zh-CN.pak
          • Size 554KB
          • SHA256 78837eb8a17d34e371ed72b7c7d9262876592f409fc66b293461c5468386834c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\locales\zh-TW.pak
          • Size 547KB
          • SHA256 fb77ff841f652f0ac8be02ce625559ae516c63081a45bde96f9277f241172eca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\resources.pak
          • Size 6.5MB
          • SHA256 096373b7b5a9535b5ba60a37883d1d2010d28dafd90d4c819a902db09aef4ad1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app-update.yml

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\resources\app-update.yml
          • Size 172B
          • SHA256 ff275def080229bfc8a75a08b67c072cacdc7a538fb01104c3c2e6a89e741e5d
          • MD5 SHA1 SHA512 TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\resources\app.asar
          • Size 44.8MB
          • SHA256 8c6febbdf83461bd8b0a2ea5209423857d52b807c778f850e4a7960989cb2968
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icon.png

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\resources\app.asar.unpacked\resources\icon.png
          • Size 132KB
          • SHA256 ceb2210260fc5846582030fac047cf70fa012beb080d1b4c8c1ad0e9d2fa9783
          • MD5 SHA1 SHA512 SSDEEP TLSH

          trayTemplate.png

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\resources\app.asar.unpacked\resources\tray\trayTemplate.png
          • Size 535B
          • SHA256 4618ef51f1bade1b1f3662a0a28ff63a9534944a567ee9f815285cf9866a48af
          • MD5 SHA1 SHA512 TLSH
          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\resources\app.asar.unpacked\resources\tray\[email protected]
          • Size 787B
          • SHA256 5b509bb2dc0ae257405e2c35dd62138f123decf424174b37e99c9bcece79af69
          • MD5 SHA1 SHA512 TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\snapshot_blob.bin
          • Size 333KB
          • SHA256 a578866594759d3c20b8fc40ca8f312c283a09113920ac14aea9c88ce0e8d9ba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\v8_context_snapshot.bin
          • Size 698KB
          • SHA256 ed5e979db2aef4a152758f2b9b7b06349a1d3d5dd687fdb96e2b3fb730a465e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\vk_swiftshader.dll
          • Size 5.4MB
          • SHA256 3738844133e89dc951e2167aac92e1491f34a385e54f36ad751ce604e5ee7964
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\7z-out\vulkan-1.dll
          • Size 932KB
          • SHA256 d8bd2d92c82fa28141fb911a7cacadd8dd7082b98258975727930ee571a43cb5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          INetC.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\INetC.dll
          • Size 238KB
          • SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UAC.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\UAC.dll
          • Size 14KB
          • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinShell.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH

          nsDialogs.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsExec.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsj3484.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Preferences

          • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\Preferences
          • Size 57B
          • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
          • MD5 SHA1 SHA512 TLSH

          Preferences~RFe5b5cd2.TMP

          • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\Preferences~RFe5b5cd2.TMP
          • Size 93B
          • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
          • MD5 SHA1 SHA512 TLSH

          electron-log-preload.js

          • Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\electron-log-preload.js
          • Size 959B
          • SHA256 06e0feb5d0a1232d31d93b9f3fd356951abd92beda7e99acd5dbbcb5a11a873b
          • MD5 SHA1 SHA512 TLSH

          sklauncher_logs.txt

          • Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
          • Size 1KB
          • SHA256 30bf39a7ef746072f744969f75a691889a286e227657a409e6b24d7537799711
          • MD5 SHA1 SHA512 TLSH

          sklauncher_logs.txt

          • Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
          • Size 3KB
          • SHA256 e4609a024322d5aa899a9a7fd2f52f32f04261c17f9dc92338dc3190181cd933
          • MD5 SHA1 SHA512 TLSH

          sklauncher_logs.txt

          • Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
          • Size 4KB
          • SHA256 4fab1b54d8c79f522535f944cb56d6150d9cfa6610d26f147a60004db644e7a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          settings.json

          • Path C:\Users\Admin\AppData\Roaming\.sklauncher\settings.json
          • Size 556B
          • SHA256 f7c7f85909114b23fc9e2707d10787576a2f52dcdcd63a8ef17c371c13172eac
          • MD5 SHA1 SHA512 TLSH

          default.exc

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          memory/1072-49-0x00000000081D0000-0x000000000884C000-memory.dmp

          memory/1072-46-0x0000000007AA0000-0x0000000007B43000-memory.dmp

          memory/1072-32-0x0000000006150000-0x0000000006172000-memory.dmp

          memory/1072-50-0x0000000007B50000-0x0000000007B6A000-memory.dmp

          memory/1072-34-0x0000000006260000-0x00000000062C6000-memory.dmp

          memory/1072-56-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/1072-52-0x0000000007D60000-0x0000000007D8A000-memory.dmp

          memory/1072-37-0x0000000006410000-0x000000000676B000-memory.dmp

          memory/1072-38-0x00000000067E0000-0x00000000067FE000-memory.dmp

          memory/1072-39-0x0000000006820000-0x000000000686C000-memory.dmp

          memory/1072-41-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/1072-40-0x0000000006DE0000-0x0000000006E16000-memory.dmp

          memory/1072-53-0x0000000007D90000-0x0000000007DB4000-memory.dmp

          memory/1072-54-0x00000000702A0000-0x00000000705FB000-memory.dmp

          memory/1072-45-0x00000000077E0000-0x0000000007800000-memory.dmp

          memory/1072-42-0x0000000070140000-0x000000007018C000-memory.dmp

          memory/1072-51-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

          memory/1072-33-0x00000000061F0000-0x0000000006256000-memory.dmp

          memory/1072-31-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/1072-30-0x0000000005A80000-0x00000000060CA000-memory.dmp

          memory/1072-29-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/1072-28-0x00000000032E0000-0x0000000003316000-memory.dmp

          memory/1072-27-0x0000000073792000-0x0000000073793000-memory.dmp

          memory/1072-48-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/1072-47-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/1368-78-0x0000000005750000-0x0000000005AAB000-memory.dmp

          memory/1368-82-0x0000000070140000-0x000000007018C000-memory.dmp

          memory/1368-85-0x0000000070350000-0x00000000706AB000-memory.dmp

          memory/4652-61-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/4652-62-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/4652-63-0x0000000073780000-0x0000000073F3C000-memory.dmp

          memory/4652-67-0x0000000070140000-0x000000007018C000-memory.dmp

          memory/4652-70-0x0000000007DD0000-0x0000000007E66000-memory.dmp

          memory/4652-71-0x0000000007D30000-0x0000000007D41000-memory.dmp

          memory/4652-73-0x0000000073780000-0x0000000073F3C000-memory.dmp