Overview

overview

6

Static

static

3

PrismLaunc....0.exe

windows10-2004-x64

1

PrismLaunc....0.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 16:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
  • Size 22.9MB
  • Sample260922-txchpsyeke
  • SHA256 fa3e726aacdb530e8305c65a081338e470773e5c163d1e424e2f8741a75c696e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 23 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
    "C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.1.0.exe"
    1⤵
    • Loads dropped DLL
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM prismlauncher.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3240
    • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe
      C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe /install /passive /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\Temp\{D7512303-706C-4BA4-858F-64009090E485}\.cr\vc_redist.x64.exe
        "C:\Windows\Temp\{D7512303-706C-4BA4-858F-64009090E485}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe" -burn.filehandle.attached=776 -burn.filehandle.self=780 /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1600
        • C:\Windows\Temp\{6C5BFA51-E382-4B9A-BC6F-79AD85262442}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{6C5BFA51-E382-4B9A-BC6F-79AD85262442}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{18CCE367-3481-446C-8788-4A1E4686312B} {57B150AA-2F6B-4EDB-8FE8-ABA8B1EE56AB} 1600
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:932
    • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
      "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:252
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2828
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4208
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4524
    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260922172814.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=592 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260922172814.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3796
          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{94822943-B2D0-4E00-A4B7-C363AD20075E} {8908161E-FCD9-49AD-AA80-88598E29F4B9} 3796
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4796
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1000 -burn.embedded BurnPipe.{8F9EDA3E-38BD-48FB-9144-0F19AF29A8DA} {407C6E9C-969C-426D-A325-8809F70A5358} 4796
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4892
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1000 -burn.embedded BurnPipe.{8F9EDA3E-38BD-48FB-9144-0F19AF29A8DA} {407C6E9C-969C-426D-A325-8809F70A5358} 4796
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3544
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{89129BF5-901A-4003-8A9E-2D1502B9D687} {9215CEE0-922B-4242-B231-E3312BED0BC9} 3544
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4332
    • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
      "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      PID:2072
    • C:\Windows\system32\werfault.exe
      werfault.exe /h /shared Global\f8cb8dc810634836baa3a30cb3143b04 /t 5536 /p 252
      1⤵
        PID:3164
      • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
        "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe
          C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe --check-only --dir C:/Users/Admin/AppData/Roaming/PrismLauncher --debug
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of WriteProcessMemory
          PID:3548
          • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
            C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe --version
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: AddClipboardFormatListener
            PID:4712

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5aaf03.rbs
            • Path C:\Config.Msi\e5aaf03.rbs
            • Size 19KB
            • SHA256 7773895ffeabe7bcfdc5727f5e3ba3403fc97c287bcbc72e91f314c26ed5f624
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5aaf0f.rbs
            • Path C:\Config.Msi\e5aaf0f.rbs
            • Size 19KB
            • SHA256 a83f04a0ae367e05c37cd2070fc1267e924ad0784ae4a85ceec88bec3014f08f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5aaf16.rbs
            • Path C:\Config.Msi\e5aaf16.rbs
            • Size 21KB
            • SHA256 7a9452c65452fb1a914e907cc1777537e66bfd3ca20506fee7ef3727fd375eec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5aaf25.rbs
            • Path C:\Config.Msi\e5aaf25.rbs
            • Size 21KB
            • SHA256 a1ce15845450c99ff21a3f8472d43a704715e05ae1b2d2488a07ceedf42ee601
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
            • Size 1KB
            • SHA256 be1aff074126f5bd6b7656055b047fab90828fda7cb89d9f0957e7e7a119b04a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Qt6Core.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Core.dll
            • Size 9.8MB
            • SHA256 b8298e5e0a3fcc09433e471745cda8a388c648dc6139ebf754477e7b411428ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Gui.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
            • Size 9.1MB
            • SHA256 3700a165e87b0e536802b7418c8396352f0528349e17b75aa0cdaffcf9122f56
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Network.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Network.dll
            • Size 1.7MB
            • SHA256 cc69f5a95adf5f80aa5272df14aaad175ac0fbb7ae1aca30f201c914e6197a3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6NetworkAuth.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6NetworkAuth.dll
            • Size 289KB
            • SHA256 23bce25d09d6053f0a88b40d4a86e8fb7ecf11edb9b2cb09855ef73d13a94174
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6OpenGL.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6OpenGL.dll
            • Size 1.9MB
            • SHA256 e9b916e36461b6547b16ae55566c9725e94cdb870ccb9cf7f108ed37354201bf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Widgets.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
            • Size 6.3MB
            • SHA256 4636175bef61fc24d66f662c476395315d5cad6264351bb95d391553c500f494
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Xml.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Xml.dll
            • Size 159KB
            • SHA256 393bda1a058dafcd8360065998bde828905dac625c2c03669c95154b107742e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            archive.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\archive.dll
            • Size 731KB
            • SHA256 bfaf23792960116d230af280c91b02915452cfe015a76feaaad505e56aaca1a9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bz2.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\bz2.dll
            • Size 90KB
            • SHA256 5c83f4b202954327adb15f77451e714ccce9bfa3113502791fdf9d223d5dbace
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cmark.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\cmark.dll
            • Size 155KB
            • SHA256 fd6eccaedbdbcc337aa558c3908f7654bdfb5ea02b5a4ad93a08c9eacf33ec5a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            liblzma.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\liblzma.dll
            • Size 199KB
            • SHA256 2ca7908f6349fe53df3dc8d5fa4f47b78c5c5aa822893c0993434c99a95245fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lzo2.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\lzo2.dll
            • Size 127KB
            • SHA256 3e99a1df8ea9ef02f607da1f0c55298c99a55a19b17680d4e143a9aa454b4b3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prismlauncher.exe
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
            • Size 9.2MB
            • SHA256 db0dc06563ddb716c22cbeccb89052a990c3698c50ce9aae25352cbb97f36d2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qrencode.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\qrencode.dll
            • Size 62KB
            • SHA256 dc5c6497946e1a1b6dafc5457f3cbc40aa6a59b9a9a3aceb6cbe99fe4de2012e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tomlplusplus-3.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\tomlplusplus-3.dll
            • Size 391KB
            • SHA256 99d50c97d61b5b022f6cff0411158bbd9106892a7f97e284f7d872e904f8f9e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe
            • Size 24.4MB
            • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zlib1.dll
            • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\zlib1.dll
            • Size 103KB
            • SHA256 b696f1f0ddf182ffb1245e5ff41883d4d8c454a8fc720fa99e6c2a20db64baf1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd_vcredist_amd64_20260922172814_000_vcRuntimeMinimum_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260922172814_000_vcRuntimeMinimum_x64.log
            • Size 2KB
            • SHA256 a92bc1e59af0f0578d962549a40c11b8457d98d93f24edf4103e68ff2b27828b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dd_vcredist_amd64_20260922172814_001_vcRuntimeAdditional_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260922172814_001_vcRuntimeAdditional_x64.log
            • Size 3KB
            • SHA256 74bdc1feca5c5193ec983da60c4f81887a841fa0085e96fa14baa6756fcb7a02
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NScurl.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nswD113.tmp\NScurl.dll
            • Size 6.0MB
            • SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nswD113.tmp\System.dll
            • Size 12KB
            • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nswD113.tmp\modern-wizard.bmp
            • Size 25KB
            • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nswD113.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nswD113.tmp\nsExec.dll
            • Size 7KB
            • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prismlauncher.cfg
            • Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
            • Size 52B
            • SHA256 a85a9d50bb071347303a46f4136a1c7cce8bd90981cc0827ff197039297f27ee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prismlauncher.cfg.lock
            • Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg.lock
            • Size 66B
            • SHA256 b6b717ce631c0d7aadb8a2f8b27ff34011d311b468238a420b93faafaf08df6e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            index_v2.json
            • Path C:\Users\Admin\AppData\Roaming\PrismLauncher\translations\index_v2.json
            • Size 27KB
            • SHA256 8a6de62b793e4a91e4f9cc97fa18bcbc29923c5e8cc5c0f86d83b9d1fe1e2b87
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Windows\SYSTEM32\VCRUNTIME140.dll
            • Size 121KB
            • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140.dll
            • Path C:\Windows\System32\msvcp140.dll
            • Size 544KB
            • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140_1.dll
            • Path C:\Windows\System32\msvcp140_1.dll
            • Size 35KB
            • SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140_1.dll
            • Path C:\Windows\System32\vcruntime140_1.dll
            • Size 48KB
            • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{6C5BFA51-E382-4B9A-BC6F-79AD85262442}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{6C5BFA51-E382-4B9A-BC6F-79AD85262442}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Path C:\Windows\Temp\{6C5BFA51-E382-4B9A-BC6F-79AD85262442}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Size 5.4MB
            • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab5046A8AB272BF37297BB7928664C9503
            • Path C:\Windows\Temp\{6C5BFA51-E382-4B9A-BC6F-79AD85262442}\cab5046A8AB272BF37297BB7928664C9503
            • Size 964KB
            • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeAdditional_x64
            • Path C:\Windows\Temp\{6C5BFA51-E382-4B9A-BC6F-79AD85262442}\vcRuntimeAdditional_x64
            • Size 208KB
            • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeMinimum_x64
            • Path C:\Windows\Temp\{6C5BFA51-E382-4B9A-BC6F-79AD85262442}\vcRuntimeMinimum_x64
            • Size 208KB
            • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vc_redist.x64.exe
            • Path C:\Windows\Temp\{D7512303-706C-4BA4-858F-64009090E485}\.cr\vc_redist.x64.exe
            • Size 670KB
            • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            license.rtf
            • Path C:\Windows\Temp\{F1C9CA92-3F8B-487E-9667-0BCD943627A8}\.ba\license.rtf
            • Size 9KB
            • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{F1C9CA92-3F8B-487E-9667-0BCD943627A8}\.ba\thm.wxl
            • Size 2KB
            • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            thm.xml
            • Path C:\Windows\Temp\{F1C9CA92-3F8B-487E-9667-0BCD943627A8}\.ba\thm.xml
            • Size 8KB
            • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{F1C9CA92-3F8B-487E-9667-0BCD943627A8}\.ba\wixstdba.dll
            • Size 191KB
            • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/252-408-0x00007FF601B80000-0x00007FF6024B8000-memory.dmp
            Download

            memory/252-407-0x00007FFF30B80000-0x00007FFF311C7000-memory.dmp
            Download

            memory/2072-432-0x00007FFF30B80000-0x00007FFF311C7000-memory.dmp
            Download

            memory/2072-433-0x00007FF601B80000-0x00007FF6024B8000-memory.dmp
            Download

            memory/3544-345-0x0000000000290000-0x0000000000307000-memory.dmp
            Download

            memory/3548-454-0x00007FFF30F30000-0x00007FFF31577000-memory.dmp
            Download

            memory/4332-343-0x0000000000290000-0x0000000000307000-memory.dmp
            Download

            memory/4712-473-0x00007FFF30F30000-0x00007FFF31577000-memory.dmp
            Download

            memory/4712-474-0x00007FF601B80000-0x00007FF6024B8000-memory.dmp
            Download

            memory/4724-437-0x00007FFF30F30000-0x00007FFF31577000-memory.dmp
            Download

            memory/4724-438-0x00007FF601B80000-0x00007FF6024B8000-memory.dmp
            Download

            memory/4892-346-0x0000000000290000-0x0000000000307000-memory.dmp
            Download

            memory/5020-151-0x0000000073200000-0x0000000073810000-memory.dmp
            Download

            memory/5020-108-0x0000000073200000-0x0000000073810000-memory.dmp
            Download