hxxps://github[.]com/SirDiabo/GithubLauncher/releases/tag/v1[.]73

Analysis

user interaction
yes
max time kernel
256s
max time network
253s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/09/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/SirDiabo/GithubLauncher/releases/tag/v1.73
Sample260913-mvb1tsxyfz

Score

7^/10

discovery execution persistence ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000\Control Panel\International\Geo\Nation	GithubLauncher.exe

Executes dropped EXE 2 IoCs

pid	Process
2368	GithubLauncher.exe
3308	SMB1R.exe

Loads dropped DLL 7 IoCs

pid	Process
2368	GithubLauncher.exe
2368	GithubLauncher.exe
2368	GithubLauncher.exe
2368	GithubLauncher.exe
3308	SMB1R.exe
3308	SMB1R.exe
3308	SMB1R.exe

Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
368	raw.githubusercontent.com
376	raw.githubusercontent.com
397	raw.githubusercontent.com
96	raw.githubusercontent.com
100	raw.githubusercontent.com
183	raw.githubusercontent.com
264	raw.githubusercontent.com
332	raw.githubusercontent.com
429	raw.githubusercontent.com
486	raw.githubusercontent.com
194	raw.githubusercontent.com
202	raw.githubusercontent.com
244	raw.githubusercontent.com
364	raw.githubusercontent.com
471	raw.githubusercontent.com
472	raw.githubusercontent.com
164	raw.githubusercontent.com
189	raw.githubusercontent.com
192	raw.githubusercontent.com
485	raw.githubusercontent.com
74	raw.githubusercontent.com
279	raw.githubusercontent.com
338	raw.githubusercontent.com
489	raw.githubusercontent.com
90	raw.githubusercontent.com
198	raw.githubusercontent.com
199	raw.githubusercontent.com
216	raw.githubusercontent.com
367	raw.githubusercontent.com
380	raw.githubusercontent.com
432	raw.githubusercontent.com
94	raw.githubusercontent.com
233	raw.githubusercontent.com
247	raw.githubusercontent.com
335	raw.githubusercontent.com
363	raw.githubusercontent.com
372	raw.githubusercontent.com
95	raw.githubusercontent.com
176	raw.githubusercontent.com
211	raw.githubusercontent.com
295	raw.githubusercontent.com
327	raw.githubusercontent.com
405	raw.githubusercontent.com
445	raw.githubusercontent.com
491	raw.githubusercontent.com
93	raw.githubusercontent.com
156	raw.githubusercontent.com
184	raw.githubusercontent.com
200	raw.githubusercontent.com
214	raw.githubusercontent.com
282	raw.githubusercontent.com
334	raw.githubusercontent.com
352	raw.githubusercontent.com
89	raw.githubusercontent.com
224	raw.githubusercontent.com
315	raw.githubusercontent.com
330	raw.githubusercontent.com
375	raw.githubusercontent.com
394	raw.githubusercontent.com
479	raw.githubusercontent.com
480	raw.githubusercontent.com
67	raw.githubusercontent.com
148	raw.githubusercontent.com
197	raw.githubusercontent.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3848	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
448	cmd.exe
3348	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GithubLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GithubLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2084	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337700235391341"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings	SMB1R.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2600	chrome.exe
2600	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe
Token: SeShutdownPrivilege	2044	chrome.exe
Token: SeCreatePagefilePrivilege	2044	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
3792	GithubLauncher.exe
2368	GithubLauncher.exe
3308	SMB1R.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe
2044	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4244	OpenWith.exe
3792	GithubLauncher.exe
2368	GithubLauncher.exe
3308	SMB1R.exe
3308	SMB1R.exe
3308	SMB1R.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4404	2044	chrome.exe	83
PID 2044 wrote to memory of 2084	2044	chrome.exe	85
PID 2044 wrote to memory of 2348	2044	chrome.exe	86
PID 2044 wrote to memory of 2348	2044	chrome.exe	86
PID 2044 wrote to memory of 1508	2044	chrome.exe	87
PID 2044 wrote to memory of 1508	2044	chrome.exe	87
PID 2044 wrote to memory of 1084	2044	chrome.exe	88
PID 2044 wrote to memory of 3688	2044	chrome.exe	89
PID 2044 wrote to memory of 1084	2044	chrome.exe	88
PID 2044 wrote to memory of 3688	2044	chrome.exe	89
PID 2044 wrote to memory of 3496	2044	chrome.exe	90
PID 2044 wrote to memory of 3496	2044	chrome.exe	90
PID 2044 wrote to memory of 3884	2044	chrome.exe	91
PID 2044 wrote to memory of 1492	2044	chrome.exe	94
PID 2044 wrote to memory of 1636	2044	chrome.exe	97
PID 2044 wrote to memory of 780	2044	chrome.exe	98
PID 2044 wrote to memory of 3348	2044	chrome.exe	109
PID 3792 wrote to memory of 448	3792	GithubLauncher.exe	105
PID 448 wrote to memory of 3848	448	cmd.exe	107
PID 448 wrote to memory of 3420	448	cmd.exe	108
PID 448 wrote to memory of 3348	448	cmd.exe	109
PID 448 wrote to memory of 3876	448	cmd.exe	110
PID 448 wrote to memory of 2368	448	cmd.exe	111
PID 2044 wrote to memory of 2600	2044	chrome.exe	112
PID 2044 wrote to memory of 1828	2044	chrome.exe	113
PID 2044 wrote to memory of 1828	2044	chrome.exe	113
PID 2368 wrote to memory of 3308	2368	GithubLauncher.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/SirDiabo/GithubLauncher/releases/tag/v1.73
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffaf0f2c728,0x7ffaf0f2c734,0x7ffaf0f2c740
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1612,i,5191102734523723741,15432562605036951072,524288 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1780,i,1193875652338878746,16959395842636924170,262144 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,12696576725576887842,6834266785877328305,524288 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,7247062072118997887,4995924570129699715,2097152 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,5478782254104696652,2383721448082865161,2097152 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,10450103826446219753,7992344234233318182,2097152 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,6931452229520784265,1681114123402488254,524288 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,12925766276759432145,16393773002609564624,524288 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,17991872787861602079,1914539177039230692,524288 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,2243069166576111804,9979081019765415952,524288 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,13637051418273348550,15530835582892240172,524288 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5752,i,13248313812103472628,16726474788186856675,262144 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1536,i,6075059070632501877,2923213968414546184,524288 --field-trial-handle=2072,i,12759902562135008307,12398243273066048372,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:1828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4244

C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\GithubLauncher.exe
"C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\GithubLauncher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\GithubLauncher_Updater.cmd""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "PID eq 3792"
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    PID:3848
- - C:\Windows\SysWOW64\find.exe
    find /I "3792"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /B "C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3348
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\*" "C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\" /S /E /Y /I
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:3876
- - C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\GithubLauncher.exe
    "C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\GithubLauncher.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\Apps\SuperMarioBrosRemastered\SMB1R.exe
      "C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\Apps\SuperMarioBrosRemastered\SMB1R.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c5abad46e6937fc6f3d00a75dd07581c5ddef447f27b2afe3ca5e49632433c39
MD5 2eb476cc84aae8bc693ff04bbfcf745a
SHA1 a328c2ab8973a5452f98b0abd1e60098557d3112
SHA512 88f1922a909da038481f1a4c6fded1e671479a0c28020eb309173f6c27166db690832a3014b54de870c6a1fcfb32d1986f7c53fdd989ca1c445d4092b2eb24d1
TLSH
T163E022A9CC21ED3B0CFC172A90548B46EB64134F2A40990B7E3CD60E8FB1A3A5186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 dcf9d39c452847357967c9f82553410a279e0a669d51d6b0e605ee410d5504db
MD5 28d7f1afb492d9ca242f9ea11de87c53
SHA1 57ea0fd41cee0961877163b627f1c8fed73d64cb
SHA512 f9231a8821f34953cc9b1ab988beb834643399f84dde4809546f5e82e75bed9fa9834598c17d42bb2b6e401488af41be31ed7ed0818544a4ade20fe3f4c2272a
TLSH
T16F31CBD52B9D2786EBA815B8F8EC2FC3BBB51940C5037D7372B8C23C52927816A46092
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f3a0a3c57829221bdac1d3d6b484cefdffd325f5dd864f78999866499489c9c5
MD5 401abf123127125eb8cebaaca1863357
SHA1 14d44509d27cae93a95c5c56008a57faa23fd609
SHA512 48f7e5b6f203557bf1213cb1c8544bf39f81ad05e695f73e207fbc825427623433d16ae4e45973a14406475220133228b6fa96ade313cf835163651ab56df8e2
SSDEEP 48:YALlmsDJPhmgy8stRsMXLs5/foKsWfsCosJKsYSgmzsYFNm3Ks5mkJzsNmVgmtYY:DmwMT3ItD5/RNmPmPmmmt0mgmOE/66
TLSH
T1D891A1F7C3E4866DCA1155F4EB186E1BCE2D0A14532D3C56C8E4BE5B93E28B1D24065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b4c7b7b36e40cc088252db70b09175b38aae094629eb3ad32422f6aa433d9a2a
MD5 437834cc44a0cfdc333a85797551da9d
SHA1 11faeedb9504303e6d099b1519021983a9532eae
SHA512 ecc87d6e40d0e6332c908580b5eb5bfbe79d9e837dcb1a007ca1ed9a07fea69709bd15ab7fe8a6b3ccbf6d26483587ef2f06772de9340dd7248f2bcfce02cc94
SSDEEP 48:YALlmsDJPhtstRsMXLs5/foKsWfsCosJKsYSgmzsYFNm3Ks5mkJzsNmVgmtYXfXD:Dmw83ItD5/RNmPmPmmmt0mgmOw16
TLSH
T1B191C1F7C3E4867DCA1155F4AB146E1BCE2D0A24531D3C66C8E4BE5BA3E28B1D24065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 eb42734593e622163d95fa3e503ca30f6473adb2c5fc90025ff162cf27a43b6d
MD5 566c971157043f9a22ad737609e0dc8f
SHA1 314ce1ce5b8afe7889f7f58bd8d0102539bf47f1
SHA512 9209fc43489205b67fdc3703ea99fab523ebd5a241378bdfd5adccae2f57a2d2c426268c29bc5dfcb3af7879c5b50fa38c2c7e6c2d7e2368fa5fbb75beef4a40
TLSH
T13E81DEF7C3E4867DCA1155F4AB146E1BCE2D0A24931D3C66C8E4BE5BA3E28B1D24065F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b9a846ebd7a6a50aea597827b26da72dacd824e37fd7677c0f8c0298c6a769af
MD5 10f47c4c8f87f66ed915cb44f87b678e
SHA1 a306ad697e888a5439ccde2125b1dd02d46f4279
SHA512 7557e3a7c24be77a3d5c6146e6638ea17c543013e42c8470bccf017540ebcb7efd1c471d14c597ba9d34a518a15f4c58d42be44ecdaec4d73a71f1493865f23e
SSDEEP 192:VR8oVrmk/v7TpAPRp2vyE9AHsb+WNn+/2uU2RkevVyIsnAUge:VR8o9XfUXaWwyo2te
TLSH
T11842842AAD10797B5CDBD229F9257B97D3F5102131942E84EAFC893C21E76CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3d5af56688fa5da993fdcd7b73a92387a4a2d25b5a9431ffb2b163419ed67179
MD5 79013a1ee382a5cf552dd3f2e78d5d44
SHA1 528e74af8914871b8594eb04da98eed209181736
SHA512 c0046b71bd04deef53e08533db0c9f68214671cbe6ce99caa7b2c9a9804d8b03a17f9ab622176846493d917b7d3a5c5b4fab81735ffdf6e48e9a64b9675f49be
SSDEEP 192:VR8UVrmk/v7TpAPRp2vyE9AHsb+WNn+/2uU2RkevVyIsnAUge:VR8U9XfUXaWwyo2te
TLSH
T17B42852AAD10797B5CDBD229F9257B97D3F5102131D42E84EAFC892C21E76CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 825e6b89b8469681ab3913d31f35e2ef225e4dc5513297f72a50a392fcb57654
MD5 381c0b6ed66f344b880d905ce8ed5536
SHA1 4bf16119542a559354423ca283da00c408af0cbc
SHA512 1942b61c7e8514242bd139c01e1f9d56d625532940645354120c75465ef401add71389162894b545533493ca83a1253affaca918791848f7e83a4dc824d8bd90
SSDEEP 384:wqjcv7KxkXqKf/pUZNCgVLH2HfgslDj7pLuLceSa7XODcz+ErU3JaHGuC4JVLkLW:w6cv7KxkXqKf/pUZNCgVLH2Hfgsxj7ps
TLSH
T1CD7208676C489A370F94DACCDC17BE4FACB9015B61ED886443FA982603D5BDF110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 10b8c0cda393f6ed7d44d9e619bb1d083bf8e62df8b00a5f31d66d6dd084da5c
MD5 a7edb29e05adde9b68f2ad709d9428b0
SHA1 7c1ccd6e1e59865b63da1f4bb46d65ce847364e8
SHA512 c771be0cfcee105ae7f44fdab059fec8ed636a9d057097c47d422261ae1e45e4c3014e62b7db4ec5d8c9f6c28c5643b705e508ec118e55b3e9a986d07606ef71
TLSH
T154B0124980419302D09202B0196014D875589F10A609234541F05D85C835161805B066
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae2d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ae2d.TMP
Size 96B
SHA256 ca30a042e1c1056a657749e06b85759741afed8b0709bc3f7eaf8d02b0cb62b7
MD5 98128490698dcae9fe4d14086e28ba93
SHA1 3a385121bb95bf53888234ccc61a2512968c4367
SHA512 5f77e2de395908c0276e7df66fb8a66a00ca1e0b169be78faf7323bd84ac81309328dea5b9bff66bd00ea916b4cad18fa6132a2fe52adac6baf63a4b72478c35
TLSH
T181B00255C5036312C4821BB0B99A95D97160EF39C713121296E07A67DC356714529660
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 d322f9d8018d1222c6bceba7c5b5d0788c0115e4e9d41c2047dac55368019f19
MD5 5110b47ba4fd597c6c13044ee952a289
SHA1 ca4251822bc11b23f88321e726944e65295e1b79
SHA512 9c62e404bbbc399022c039a88e1a44372b189d5433ba15c1ef45fb47b644979bbaafbadbaebf6256fcf5b45fe3aeda279f3ba866bb279fb9842da86182264b51
SSDEEP 3072:cIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:4Ptbmf1K49XLWbEPi4NTKlLz8
TLSH
T154D312217D41BCB4A9EFDB21A1901A169AB8D84B957D7BE61CDE3F4C06E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 7962cc09b59282afb673ed81cab68f0cc3abd30827b3e95beff7f7e54c6a77e7
MD5 acb0070ed71543bdfa4f98c105757a91
SHA1 43fdc4f4db6688d1e84085fee257ad0e9bb4757d
SHA512 2d45b4158a560b9399e02a67530eff9469ab98a812fa1cd0cb2235dc85077fec51a97e128e419cdbf145b5f6e0fa5857093f623c5d15153390bf1e87fb5616eb
SSDEEP 3072:2IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:2Ptbmf1K49XLWbEPi4NTKlLz8
TLSH
T1D8D312217D41BCB8A9EFDB21A1901E15AAB8D84B95397BE61CDE3F4C05E3AD9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 837da96d74e6358a1c0021c4f6cb8174147b06bf170acc115aceb411c86f7ec9
MD5 bd1bacdcbaee3a025f058d65ecd9ae6b
SHA1 363e9ea1a46a15e6cdf58108b331bed8acaf2ad3
SHA512 583e8a8e524ea7c02bd1ebeb9fa2dc82dc1b1f7f4b9cf21e9e554d4f29355d2d7b876a1e49fee01b2bc9f122fd85d37cbcde1bfdaea54eb33d2d46bbbb0f7be3
SSDEEP 3072:HIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:PPtbmf1K49XLWbEPi4NTKlLz8
TLSH
T179D312217D41BCB4A9EFDB21A1902A169AB8D84B957D7BE61CDE3F4C06E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 1087dce1033ee6be4ba7b87dfcced679246ca7c1b78fbef9733341fe200f81ae
MD5 18b89f8195b032ac6c730f24121f8467
SHA1 0284f75ddab750c369a498dab093b54071123c2e
SHA512 9247380a5ced2584a2c68ce8e044b72a6f7fa663be4b373e93ad823b62d91cf2ab4acab3da4b59006d54ef98908138436f4a63c3529ac278a73232f191ed7b29
SSDEEP 3072:FFIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:FhPtbmf1K49XLWbEPi4NTKlLz8
TLSH
T172D302217D45BCB8A9EEDB21A1502E169AB8D84B953D3BE55CDE3F8C05A3ADDC304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 40d8cdcb401616f9c752b8d56190b77525ce624454f4410d527c41bf7a7b7a07
MD5 0f718704ed61ccd85ddda38eacadd1b9
SHA1 55ab4944212bcba82974127b99a7cfa9006c8199
SHA512 9c6b67dd82198883d301c5f73d519e4fe8cdf90c107716138035afb982a17fbc7efa6d1bbe5100d4ed73770cedb9b06e8abe69990535baf92f4722c26b3eeb0f
SSDEEP 3072:1FIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:1hPtbmf1K49XLWbEPi4NTKlLz8
TLSH
T159D312217D45BCB8A9EEDB21A1801E169AB8C84B953D3BE55CDE3F8C05A3ADDC304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GitHubLauncher-v1.73-Windows.zip

Path C:\Users\Admin\AppData\Local\Temp\GitHubLauncher-v1.73-Windows.zip
Size 38.3MB
SHA256 46b95c1c7022103e3e91acf1f0a30181db9c5f05a3138fe487a1604d429eb1ca
MD5 583ea49f57b99dcc8626050a85d86a26
SHA1 8c45778aec9381ad819d6f31b29273ba7d12a4d0
SHA512 218d2486863f4afcad59af83c43856f8848b7b331c40942df1178e37d40bf12a8fd3fb595fceeb979b2feead6f38f904bf9082d43166e491fc050a0a827c8531
SSDEEP 786432:HgfiY2F5RlgzSWoxgv8h6ylKAMPWc6echLL7GnhikN7MAjSybmMPRAdX:pHCwEyWCechP7GUkN7RjSybwdX
TLSH
T1499733D0907BE1DE95740D656EE7EC93A71AC1F19A07CE12A02C13D672FEAC0E7A148D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GithubLauncher_Updater.cmd

Path C:\Users\Admin\AppData\Local\Temp\GithubLauncher_Updater.cmd
Size 2KB
SHA256 b8a4a75514e76816964f8e29e37ad125c56cff0fcef6d63f8e5402ef61af4ee4
MD5 1c6f666a413aa7535ea6f120029ecf6b
SHA1 a3d8e1f01482f199fde3fddcf0a72b02c3d4fbb5
SHA512 85da3fd698786032ca9625c6c9831feb257853642cf7c682f3342c30bf08a7bb7ab90d9cc98f6a15bfa2b5148a1ac6adf313cd1ed1a81275f5da9842f3a7fc43
TLSH
T1DE41F39A51128F6E45F05B995BB80138FF59010F0F303A78783ED64D3B28A9D5B9D6EC
MD5 SHA1 SHA512 TLSH

Submit Download

GitHubLauncher.Core.pdb

Path C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\GitHubLauncher.Core.pdb
Size 18KB
SHA256 0bfc302e6913a9ba79bbe679900a57c6a487d8c7300ef3a00675c872d81684a6
MD5 0a0ffd6f6ff47297e9bbefb835caa93f
SHA1 7f0e0a4a1e4d42f02084281b05fe59ff2fcf0602
SHA512 fd7ea149bb025d703005f1100fc19d4d06b3dbefe4cea4ede70aecd33a28e1ee12ee6157f97b007f329ad30ed938b7715f1630b4aa46e93f0397992d4a705fd8
SSDEEP 384:bHe6aF+AnrvPnRYF76cCCadF/LKoesqOX+jfYs0X6+HvfDFDuyth5ucDhcz9r8BJ:bzAnrOe+gsgRh4qJDt
TLSH
T18492A1739789C625C54425775523C2A87370C3102B1ADF36F2E87A18DDEFB890BB26B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GithubLauncher.dll.config

Path C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\GithubLauncher.dll.config
Size 238B
SHA256 80613194c2801269ef1fc7880e46f40c8dacc2220adeb20d936fbf58a930fc36
MD5 4e32e890760e165314a1b5a28f365789
SHA1 949ae7a1ba4d06cc3522482203d05caa23678f91
SHA512 45fb270719b95e911278ccbdd8a59a35dd5bf5f70510888f00e879ba1f71ec75b69c27470a30a2b021ad0eb8b0b6861a22e6da9bb8a5fbd173f72348db412188
TLSH
T15ED0A783F30C88E5F110696109FADE1F05FB2092C89D511CE411EE310E67B1B85037C9
MD5 SHA1 SHA512 TLSH

Submit Download

GithubLauncher.pdb

Path C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\GithubLauncher.pdb
Size 119KB
SHA256 2a7f1efbd24e4fe673f8f40de84d86b82cc0e35d8e09f6f35fca8b6fc3c374d6
MD5 86139bb067222d4d38276169a8b24ea8
SHA1 8acc0449cdd5dcd58b01b66e0b6f0c99e6e9a45d
SHA512 f589f26ece7e02a680787a6aa4ee89a5042021e3e3756089e68a907070216539911f9c3556b17d8855911788847ae7c4946b6b2828c3da58965ee00f39429abf
SSDEEP 1536:MoVs97uEbi5R3Gtoi2Z4+uza4O8psDTAsW89wmL9qGjZMEwiOBj1F9n6NcAnch0j:2aEbi5R3Gtoi2JdDTR98ChwB8fcCwRS
TLSH
T19AC3E75BA2C4EB47C915627FC0A3815173B5C168830ACF17B294F6B1AC97B14BF673A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\SDL2.dll
Size 1.2MB
SHA256 f70051e79801f33793090ee0e99d8d57cb392121064dbe0a6b66b375e3f9b6ea
MD5 3f25925f454362a61705694be43b62c9
SHA1 5794b736c9342b9b4c2e91fd2fc580e87d168664
SHA512 0e7bdb14078125146a00b487db2778ab30901ed121b9b7a9bce3f9e077acb9860c206be44c2319567eb04091744516e8d7b240c4d02f27da517e642c48ffabdb
SSDEEP 24576:IYNlQTkQrDqBSzscm0fP12fOmkBBeb7LVNpWAJqiuv0h6Llefgwn0TSfMY3TCos7:z+WOsc7RsdE9RLa/r/fHc/d/xHq/z/Xs
TLSH
T130554A94FB9701F5ED1718F2924BF7BF0A31B10594A8CDF4F9C91A8AF822B711219729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av_libglesv2.dll

Path C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\av_libglesv2.dll
Size 4.6MB
SHA256 0707d1f54e86cda8cb69b00460bf18aabb6e9319b12ec42502dad977b63a33c0
MD5 a01b4b461eaf00cad759534900a965a4
SHA1 ba1950b108de157adc1b74f790e5f0bd43db39af
SHA512 e07cecccfd2f209f5d3db5cc04042922a7e1bca445161ab9e1b5c60c391f64487bbc328c4496b813cc622eb8f435aab733538007548520df384d283a00dd1db4
SSDEEP 98304:cl/JJyPDd4giyaHTGyh/GcU7ZZRFF2KR8CJrs/K4MsCTgnC0ZXT1MF:ciDZryhuTNZTT8CJrs/KxsCTUe
TLSH
T1D5269E00B152A578CC0B3071291D7F1DAA359A6247249AD3A9D87EB42FB21D32F3677F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\libHarfBuzzSharp.dll
Size 1.4MB
SHA256 f2010ec6bffadf2238e7718bc48a3f5a8cdfa446806fe749ad5bf4f526e8ea95
MD5 448c0d91253ac9d9043135dec50d4805
SHA1 f6b43a16be64691d26f4db456c1af39fdee9fbad
SHA512 cd9fb09241ce13fd28fe2304f7f5f6e84c5e7c5da7b005c8106db66f2230811851bb1897b2e3591af9022a49e299b663c7b073f733e1883c9ae14d88ad3b2c66
SSDEEP 24576:TD1JSXc6rHmbh8tdnub1ePcUHXE55ayyR5bIAbyR9xvso0qpyOtJMPFbp:TD1yrH4h8tQgPc2g52WRPEo0qpttqPr
TLSH
T125659D20E81780A1FD8501B1D9BDFE9E542C8B39071D8CE3A2D4AC6DEE115F36E79A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\GithubLauncher_temp_update\libSkiaSharp.dll
Size 7.6MB
SHA256 57500c7bb65f8db8d2ee40cc8f9736d950789912f7b1ec33944dad6c472c0d99
MD5 3b930c5cef2981688a82b10c7a416ab6
SHA1 0b6ebf9d41ca1d8413ec4fced3bb011386c28e19
SHA512 13bed41f7eca5553063e0c738e4dedee66e44018d6a25cb1e893120dbb7567525e3c87b3067dbd38dbb1264ae04849f467f467c5585223f9443bcd8704e033ca
SSDEEP 98304:/6CJGad0Jyix8W+fbaRG6LnZG63VmmcJv3V598l2:hGaO7X+TaRG8E6FzcJv318g
TLSH
T1E4868D02B293F0FAC44B11F4211EB23F9A350A4857158DEBD7CCADB85EF26D118B756A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modloader.log

Path C:\Users\Admin\AppData\Roaming\SMB1R\logs\modloader.log
Size 1KB
SHA256 f06903c29809665b5c57bf6120c838fd0f0cd870944fb8f80cda2775c2528ba6
MD5 609e045ad226eeaabc693a903813c4ea
SHA1 94e34e80ff66b2b689ac3683deb08e7e92794b20
SHA512 222789aab3b9db915338118db0a3be6d7fc9677690b72ba748650484f43b68b45ba7e8594dee55a076aa7e4389bf96f482ebab57ef4810dda5abd6e598ceb80f
TLSH
T19D21C92357BB8D1318E9B647362E8D6A9049BC8B0601702E633E117C11EE29AD3F5EB5
MD5 SHA1 SHA512 TLSH

Submit Download

discord_game_sdk.dll

Path C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\Apps\SuperMarioBrosRemastered\discord_game_sdk.dll
Size 3.3MB
SHA256 a6b6d7df00a58dc50248d91048578d0fe52182286b487ef89a961fd10467dbd1
MD5 4402cd4891c256ee40046c6092afdcbf
SHA1 914e01743c7591beb79a61417b262caeb23e2c20
SHA512 78da4181132a02d7d17ba4b2839018dc43d7d691c8bb01d34e5f7439df9c92951ce687e9487df158c44e764275b45d6800f6629ec2a175cc4ecdf868292291e5
SSDEEP 24576:Q/NGmO/w02OFM7zWIyjQYS2tBMPfL+8T14rbXojA4F8eEcu2sqhA+cGRlZVIH06R:3oOiaQAtBMPfCn/WDcGRxIU6iIdAk
TLSH
T1E8F539217A5A646CC0AAC474838B4A722A3138CB1F35BDFF04D595793F69AF46F3D218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_game_sdk_binding.dll

Path C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\Apps\SuperMarioBrosRemastered\discord_game_sdk_binding.dll
Size 432KB
SHA256 eed53fd3d396c0330b24571daf4d8c5a86ce615cd0b498ce4802c76628bf1cdb
MD5 1379406ce8e993421f0ba2a2f9bf88ee
SHA1 e7f4c53dec8447294ef2e4ccc2b60acb1ea88f82
SHA512 067de1e0ae790b8d3e1661f17d8719f6a520918c5b548d8f9dafe1a78ebc0b874cf62a618dfafbbfc93dd3ce88ae8c5b96427f2cdfffd1eb78f16dac7d4413d4
SSDEEP 6144:1DYJPAmnZf7VyC9yzBBN6N6VPVdBETYnJ5ucm8JM6sK2zc4wCcvJBD:1c/Zf7VR4NBjBk42cjM6kzc4rcvJ
TLSH
T189944B2DE24416B9E473D13CCE570902E1B53894877186DF13AA466E4F33BE89B3EB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

godotgif.windows.template_release.x86_64.dll

Path C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\Apps\SuperMarioBrosRemastered\godotgif.windows.template_release.x86_64.dll
Size 448KB
SHA256 1439bb8ce609e2889af9d2539b693e2e7ae0cc670a1d139a9c86f21bbb378128
MD5 64c8fa25c9fdecc596d464ff58d080bc
SHA1 189fcd3b28f6b02420fe6a45882a5a01353e177c
SHA512 f0405bd7db9e1406189bec2c73703fe5a19d9d5cf4df21574a819962715b9a7cf42deba8f2adc7926d25acb6ac6dead64f69bbfca7cc2efae39297946e4dcdda
SSDEEP 6144:dX5qCdc+UWnC22u44AQycpGG0+RbT5J1/59vymZ:dXJZCnuJ9ycA7+RpJ1XV
TLSH
T11AA45B1DA24046B9E8329178CA834D00E6F6B8A403718ADF17B991BD7F33BD9573DB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuperMarioBrosRemastered_c727139dfe57b44b.png

Path C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\Cache\Icons\SuperMarioBrosRemastered_c727139dfe57b44b.png
Size 1KB
SHA256 fcf668897fddf0dab19c1ed376a1b6a94083fb429f9e87900202e6375693178f
MD5 46e471b97d07a18a89106114e7033f24
SHA1 f5da5f3c363dee9456937e4f77b1241d4994c058
SHA512 a50b7e7a6bbf649205595bf22e6c3ca9735d9026a84fba783e86c670fdf74f84dc78372ffda02196ee8659704987d7965c32ece1606feed9901f59ac1b539e88
TLSH
T19A2190D69DBC11F046F60D828F19D0F1CF361F4BC232BA1A078508F6914FF9A454B482
MD5 SHA1 SHA512 TLSH

Submit Download

apps.json

Path C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\apps.json
Size 18B
SHA256 619508f4f6baca77f932ff2da9264c8bbccd209c47d33bc9c0b1f971c3b5a182
MD5 add8552fe36a62f909b835503a415e56
SHA1 4a92d7195b5530aa402335f5fecfcd337ac41683
SHA512 e613b8f1d3c2aae19f70f66a58b8cf0267a57f738e31d75fb2a1dbba19a406aacb56fc59e6d33ce4068fd21251f7d22e85761894e55e9ad004b01e554f3d20cd
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\settings.json
Size 755B
SHA256 14df2d72dabd1ac0e905fe5176da679dbcdc73c5882f68dfb3805d5be256ca83
MD5 8bec98072010a316a3198b1a31728d6a
SHA1 35d56c1faad3fc6fb3a2dbd0026c6588ebaf409c
SHA512 42814e1205c7c2105c244665108eac4faa02e3f3279901c889ae43c780a6efa446db7c13ee3fd9a20f580f2ad8cc132bc92c89d45ded6f9fa630d90c5fb16655
TLSH
T1B8019E226E3600FBB5FF83681A998601BB112F9E20344D0BB9FF2C4D815B76F25497B1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\settings.json
Size 758B
SHA256 1290b10d54eeedc384c4b09c9295b67b64e354d846fa11ebe57a20c9954d2749
MD5 a82af324e5516127a7d7f45c41941148
SHA1 87516985a11467f78303716b940358a76b770425
SHA512 6c80b6ae71a0c272d37b627704da162e2fdc38dd93840d62df4d1052749c078f83580d67a2eaf1d7d2e2a2dbd6c04989f508dc372dc3a4687880bfae2e505d7d
TLSH
T199017B625E2700FAB5BF83681A998601BB112F9A20344D0BB9FF2C4D815B76F25497A1
MD5 SHA1 SHA512 TLSH

Submit Download

update_check.json

Path C:\Users\Admin\Downloads\GitHubLauncher-v1.73-Windows\update_check.json
Size 137B
SHA256 807f96dbbc9363620920cb8567c54931dfb022e160e1b8eccb637326f253f337
MD5 5d9a2b9ca5ac41bc624e1ad17177013f
SHA1 cab65331202b6c54e8d37a1dc1e1219d5f59ff11
SHA512 fbe72adc4bcc28dfb480045ebb1d84e9f07afa1182bec8ec704e6d5bed0af4d1d150aff31e0c3a8b9aad6021738412d27dfd9cb5b0cf9339191d698818c0540f
TLSH
T154C09B8455005BFD6754331411546D2D77F2774950C4C225B34F5D056155B351212338
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2368-315-0x0000000013561000-0x000000001358C000-memory.dmp

Download

memory/2368-293-0x0000000007781000-0x000000000849D000-memory.dmp

Download

memory/2368-443-0x0000000014841000-0x0000000014880000-memory.dmp

Download

memory/2368-424-0x0000000014711000-0x0000000014718000-memory.dmp

Download

memory/2368-425-0x0000000014771000-0x00000000147A4000-memory.dmp

Download

memory/2368-422-0x0000000032731000-0x0000000032802000-memory.dmp

Download

memory/2368-378-0x000000002EB61000-0x000000002EBA7000-memory.dmp

Download

memory/2368-361-0x0000000006711000-0x000000000672D000-memory.dmp

Download

memory/2368-355-0x00000000191E1000-0x0000000019202000-memory.dmp

Download

memory/2368-356-0x0000000019241000-0x0000000019252000-memory.dmp

Download

memory/2368-354-0x0000000019171000-0x0000000019182000-memory.dmp

Download

memory/2368-352-0x0000000019001000-0x0000000019069000-memory.dmp

Download

memory/2368-353-0x00000000190C1000-0x00000000190D6000-memory.dmp

Download

memory/2368-351-0x0000000018C11000-0x0000000018C24000-memory.dmp

Download

memory/2368-347-0x00000000146A1000-0x00000000146C6000-memory.dmp

Download

memory/2368-317-0x00000000138C1000-0x0000000013A61000-memory.dmp

Download

memory/2368-312-0x0000000011831000-0x0000000011991000-memory.dmp

Download

memory/2368-295-0x0000000008F21000-0x0000000008F40000-memory.dmp

Download

memory/2368-316-0x0000000013651000-0x00000000136D4000-memory.dmp

Download

memory/2368-294-0x0000000008D71000-0x0000000008D7D000-memory.dmp

Download

memory/2368-298-0x0000000009761000-0x0000000009775000-memory.dmp

Download

memory/2368-297-0x00000000096E1000-0x0000000009720000-memory.dmp

Download

memory/2368-296-0x0000000009511000-0x0000000009547000-memory.dmp

Download

memory/2368-300-0x0000000009861000-0x000000000986F000-memory.dmp

Download

memory/2368-299-0x00000000013B1000-0x00000000013BE000-memory.dmp

Download

memory/2368-302-0x0000000009981000-0x00000000099A0000-memory.dmp

Download

memory/2368-301-0x0000000009901000-0x0000000009937000-memory.dmp

Download

memory/2368-303-0x000000000B4D1000-0x000000000B54A000-memory.dmp

Download

memory/2368-306-0x000000000B7C1000-0x000000000B7C3000-memory.dmp

Download

memory/2368-308-0x00000000102E1000-0x0000000010378000-memory.dmp

Download

memory/2368-310-0x00000000111E1000-0x00000000111FA000-memory.dmp

Download

memory/2368-311-0x00000000115B1000-0x0000000011607000-memory.dmp

Download

memory/3308-524-0x00007FF6528D0000-0x00007FF6538D0000-memory.dmp

Download

memory/3792-206-0x0000000011051000-0x000000001106A000-memory.dmp

Download

memory/3792-205-0x0000000010151000-0x00000000101E8000-memory.dmp

Download

memory/3792-246-0x00000000146B1000-0x00000000146C6000-memory.dmp

Download

memory/3792-204-0x000000000B471000-0x000000000B473000-memory.dmp

Download

memory/3792-203-0x000000000B191000-0x000000000B20A000-memory.dmp

Download

memory/3792-223-0x0000000011421000-0x0000000011477000-memory.dmp

Download

memory/3792-224-0x00000000116A1000-0x0000000011801000-memory.dmp

Download

memory/3792-227-0x00000000135A1000-0x0000000013741000-memory.dmp

Download

memory/3792-226-0x0000000013321000-0x00000000133A4000-memory.dmp

Download

memory/3792-225-0x0000000013231000-0x000000001325C000-memory.dmp

Download

memory/3792-244-0x00000000140F1000-0x0000000014104000-memory.dmp

Download

memory/3792-279-0x00000000150B1000-0x00000000150F0000-memory.dmp

Download

memory/3792-261-0x0000000016551000-0x0000000016584000-memory.dmp

Download

memory/3792-202-0x0000000009641000-0x0000000009660000-memory.dmp

Download

memory/3792-245-0x00000000145F1000-0x0000000014659000-memory.dmp

Download

memory/3792-201-0x00000000095C1000-0x00000000095F7000-memory.dmp

Download

memory/3792-199-0x0000000001371000-0x000000000137E000-memory.dmp

Download

memory/3792-200-0x0000000009521000-0x000000000952F000-memory.dmp

Download

memory/3792-196-0x00000000091D1000-0x0000000009207000-memory.dmp

Download

memory/3792-197-0x00000000093A1000-0x00000000093E0000-memory.dmp

Download

memory/3792-258-0x0000000015291000-0x0000000015298000-memory.dmp

Download

memory/3792-259-0x00000000152C1000-0x00000000152C8000-memory.dmp

Download

memory/3792-255-0x0000000014E01000-0x0000000014E26000-memory.dmp

Download

memory/3792-247-0x0000000014961000-0x0000000014972000-memory.dmp

Download

memory/3792-198-0x0000000009421000-0x0000000009435000-memory.dmp

Download

memory/3792-194-0x0000000008A31000-0x0000000008A3D000-memory.dmp

Download

memory/3792-195-0x0000000008BD1000-0x0000000008BF0000-memory.dmp

Download

memory/3792-193-0x0000000007411000-0x000000000812D000-memory.dmp

Download

memory/3792-248-0x00000000149C1000-0x00000000149E2000-memory.dmp

Download

memory/3792-249-0x0000000014A21000-0x0000000014A32000-memory.dmp

Download