87e7f7af6333fffb4f5472258ea16fd5b69253caa439e4271da764959c26c260

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sklauncher.exe
Size 228.0MB
Sample261022-1g59eaas3r
SHA256 87e7f7af6333fffb4f5472258ea16fd5b69253caa439e4271da764959c26c260
MD5 7db1a1053ef95bbbcbbfee642e7f2f02
SHA1 747fb9cc1143feac8bca36ed6cee9a8e3c7b122e
SHA512 fbe12f2c2a65d6713c8bf50fb33a072bbada4e1a83485d6e859750b71955972b3271b9c70bf158b311708afcbea6d130e89bdec78375bdfc3d22770a569403a5
SSDEEP 1572864:fGMYZyLN1daMKeDzniI3CgWOO791WXz/vU0Gzdp6STbaMXLhkHXxj+LxrGqY7abH:jN/aMKeXnVyJfTLhZ7
TLSH
T1CCB88C03F29641D9C05DC1BA8B5A9633FE71B8094B24A7DF2B5447522F66EF82B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	sklauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	sklauncher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sklauncher.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	sklauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	sklauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	sklauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	sklauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	sklauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	sklauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	sklauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sklauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	sklauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	sklauncher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5672	sklauncher.exe
5672	sklauncher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe
Token: SeShutdownPrivilege	5532	sklauncher.exe
Token: SeCreatePagefilePrivilege	5532	sklauncher.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5532	sklauncher.exe
5532	sklauncher.exe
5532	sklauncher.exe
5532	sklauncher.exe
5532	sklauncher.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5532	sklauncher.exe
5532	sklauncher.exe
5532	sklauncher.exe
5532	sklauncher.exe
5532	sklauncher.exe
5532	sklauncher.exe
5532	sklauncher.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 4964	5532	sklauncher.exe	87
PID 5532 wrote to memory of 5788	5532	sklauncher.exe	88
PID 5532 wrote to memory of 4968	5532	sklauncher.exe	90
PID 5532 wrote to memory of 1208	5532	sklauncher.exe	91
PID 5532 wrote to memory of 5672	5532	sklauncher.exe	93

C:\Users\Admin\AppData\Local\Temp\sklauncher.exe
"C:\Users\Admin\AppData\Local\Temp\sklauncher.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Users\Admin\AppData\Local\Temp\sklauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\sklauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1816,i,17515887699087317055,2208887617398407491,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1820,i,9461031324311539522,16916337746588116755,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallationType
  2⤵
  PID:5788
- C:\Users\Admin\AppData\Local\Temp\sklauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\sklauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --standard-schemes=starship-screenshot,starship-icon --secure-schemes=starship-screenshot,starship-icon --bypasscsp-schemes=starship-screenshot,starship-icon --fetch-schemes=starship-screenshot,starship-icon --streaming-schemes=starship-screenshot,starship-icon --field-trial-handle=1816,i,17515887699087317055,2208887617398407491,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1820,i,9461031324311539522,16916337746588116755,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4968
- C:\Users\Admin\AppData\Local\Temp\sklauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\sklauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --standard-schemes=starship-screenshot,starship-icon --secure-schemes=starship-screenshot,starship-icon --bypasscsp-schemes=starship-screenshot,starship-icon --fetch-schemes=starship-screenshot,starship-icon --streaming-schemes=starship-screenshot,starship-icon --app-user-model-id=pl.skmedix.sklauncher --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1792704793591690 --launch-time-ticks=569048757 --field-trial-handle=1816,i,17515887699087317055,2208887617398407491,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1820,i,9461031324311539522,16916337746588116755,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2724 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\sklauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\sklauncher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\.sklauncher\bin" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1816,i,17515887699087317055,2208887617398407491,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1820,i,9461031324311539522,16916337746588116755,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

current.blockmap

Path C:\Users\Admin\AppData\Local\sklauncher-updater\pending\current.blockmap
Size 132KB
SHA256 94ef1a83f71eafe0311b711709c54904e3ab764edf2f7e2f2d247aadd32e957a
MD5 3fa52edba6082614bcc4cc5e4a558e65
SHA1 94ed61a07293d024753c16c97072bb5aad11a1f9
SHA512 ad010203db46dc3e2a2671d233341a622d9d17d9710c606729ae4585ed9ad1612818a40b8a998b08e6a3669b82d43191c11519516d9a43d3355da2e10e28a563
SSDEEP 3072:vS0DtcsvoUA/62s1xQbRmaNdhT96Us06qSYyesnla8cM3BCyK:vS0BRvoUexRmKHsNqSEy88Z3B5K
TLSH
T1B8D312BF1E4AB0EE2FDE9B9FA83384051B944D693063425D118EA415762CFF207AF356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d42ec62-94aa-4b1b-8d5e-8e0d8bae12ba.tmp

Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\9d42ec62-94aa-4b1b-8d5e-8e0d8bae12ba.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

bd7bca70-f3ee-423b-b822-12d625cc1970.tmp

Path C:\Users\Admin\AppData\Roaming\.sklauncher\bin\Network\bd7bca70-f3ee-423b-b822-12d625cc1970.tmp
Size 741B
SHA256 4f717c7a28ca2ccba289f803de1bc2fdda7e9a470413b13f00c0762502b97f9a
MD5 452283f4b5c663d3f8eb09d49301f024
SHA1 b8088f1828e25acc43f95d95699576da8a6e808f
SHA512 d12d10c3972458c0ebf63c3da9e981000d35d5a886516b6eff39ab1181af338c44bc4c2848736466b71a6d8f79113989122b8065001e594aaac6a95d6edbc4d0
TLSH
T1B3019C97C6E80A7E469253F42E343E63C6ED051C022C3D0399D8EB4F57E24B5960048F
MD5 SHA1 SHA512 TLSH

Submit Download

instances.json

Path C:\Users\Admin\AppData\Roaming\.sklauncher\instances.json
Size 886B
SHA256 c339e8dc9ee2e8f36cde1b2cf4f717e7cea9e6d1e8cea9736e627b52721b3777
MD5 3c06ab2dd80b6a1d030bfd8567a7f466
SHA1 c0684df6377ca41f5c1ee1764f028ac981c6f8bb
SHA512 3188a97bb7eef9abba9140826ac1e060289436c50573c645ebfb6d1bb76ee9f0cc58138732b7373f9f90989b1d857b8abecd0e9e488b7812a1ae416a0bf4dcf7
TLSH
T112118669E26B6C2A34451321F9745342A510C9079E45BA6D7B9C189C5F9D42F0C7A33E
MD5 SHA1 SHA512 TLSH

Submit Download

sklauncher_logs.txt

Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
Size 3KB
SHA256 b7ffd043ce7e3102666f44f2e47b358622cb118a7816e553cc56481bd345a99e
MD5 67c27e58a291b99fc0ac5b4675e08eac
SHA1 3934fbf0c73aed3b8a09158a0449d737888e57d2
SHA512 a4e746d4be68e230aef4a4fe508c1766fac406c097a2cc175e74e2aa29ce4ba83353b80ec45f55cbdcc74fcd65e89ae0bb7a95601258d35efcec46273804c5ea
TLSH
T153614F128CBAAEBB12610304A9966C8C587015374FD989EC334C832C773DE729F8E7D8
MD5 SHA1 SHA512 TLSH

Submit Download

sklauncher_logs.txt

Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
Size 6KB
SHA256 eef5b3687c56d548aa8837246811ff79173aff126860b52d88ca74f272ec6ec4
MD5 73b7ab5e10667f16bf7e9f4be2b75d89
SHA1 2c869e77e73c9088a7ddd0db8e0feb8cccf73ec2
SHA512 052f225f2246dfc64eb1163fc3ab91ffeb518ecf605b2eec38a0c82b7ac7c4fbad143e583b130e0048067455b3cabeddc2a562f27cbd69004b65bc1e42f073b3
SSDEEP 96:oxuIvv43IgOSc86UXDgyW1PJwk6ZgfhAak6ZgfhADAavN4:3mjYPXOxJwsfsU3vN4
TLSH
T18BD10E1148BAEE7F56220315A97A2C9C947005335FE96ABC331C861C773DD26BA8F68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sklauncher_logs.txt

Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
Size 1KB
SHA256 1ba30fea5198a41afc7814d79ee91a604b3f68bcdc15e256be71525470778ee0
MD5 c3f5a73a92a21659ff2ca3c33baa68b6
SHA1 417956b93186ba9d6baa0e2ae14b81d147733eeb
SHA512 3b98c7023126a5730e986655ecf14354adc19f2096404e6fbb2d8d258ebbce2071e9b62feb15672571fd0619ccb73a67987f689030c43bd390380309a2bb6cd2
TLSH
T1E831BB129DB9AEBB2261070458962C4C6C7012779FE989E8330C835C633CD769F8F6E8
MD5 SHA1 SHA512 TLSH

Submit Download

sklauncher_logs.txt

Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
Size 1KB
SHA256 17ceea20abe78a3c8e126be053d9a7e8c3fecfbe82f64c3afe480c369c2c3f6e
MD5 2d9f78c8037dc5bca0a5230d7a7b634f
SHA1 994129740a7074ff7c17129848108d8aad08858c
SHA512 ea4b8e0b1b68f9952a77671fddb9db2e4189077ce8e6aaf6dd9e2c206910f0cc6b2eb7b8593b8422a7fcccdea2f9d68647e697847fb89bee2c290d51bfda52fd
TLSH
T1B71156125D799EBB2222071159D55C4859701373DFE9C9AC330D835CA32CD755F8E2F8
MD5 SHA1 SHA512 TLSH

Submit Download

sklauncher_logs.txt

Path C:\Users\Admin\AppData\Roaming\.sklauncher\logs\sklauncher_logs.txt
Size 2KB
SHA256 9df8b20738f47fe0598b0eb2608e501955127e3a6e19f955be9992200516c523
MD5 4de0fec80f9070a4a94711be7d6d0582
SHA1 9cde34d0084913aa9302f07636006e21f4795aab
SHA512 8718d2caaedfac1ad7229e0f1174e23405b47b6f3b6ffcfe22b8d212c289e86666f56101fb9ffe0e22acd76dc4aa8b7e5a599f0c3098fab6c219c2d9e59f4c90
TLSH
T13151ED128DBAAEBB1622030469956D4C687015374FD589EC335D836C633CE729F8E6D8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\.sklauncher\settings.json
Size 1KB
SHA256 fda1b5be0ca4f87bb147705afaf24e2dccbf2a8fc0f61382dae21c544dd7f7ef
MD5 ff2f4243af300ce7cc1179d7096f1bf1
SHA1 f0e1fe72b8fa68a3fb2640bdbdfddc71cc47eae7
SHA512 659bcdbf65466d0198ce90c988ba3ebbd2bae79934d5854182c176f4238cedbc1ff9ff55afa4de39c7b242d27df0d40d560cbc85b77ebf8d6caa1647914bbe2f
TLSH
T13A2103B4E52952FA16E6D17ECDADD0135B328C1902083C3CA6A7140D200F73672F7EE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json.tmp

Path C:\Users\Admin\AppData\Roaming\.sklauncher\settings.json.tmp
Size 1KB
SHA256 4ead110ce48e1a8494b11cbe875aee2d72298f95a5629bf58bed99fa2534e2e3
MD5 c3c3dc389cf60399259eb8284637e400
SHA1 ba8fe00d1fcd0d07412c05613d00ec8c373cde64
SHA512 ce8388b2ea0313e47648562de4707b78773ecafe4522b570a54fbd98960f9db6e1be062dd927b7816108db220cfabe34de7d8fc7e921c2f76c8e1438102ba704
TLSH
T19D2133B5E52A52FA16E6D13ECDADD0138B328C1902083C3CA6A7150C200F73632F7EE5
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4964-115-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-100-0x000001D15F870000-0x000001D15F871000-memory.dmp

Download

memory/4964-117-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-116-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-119-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-120-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-105-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-104-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-103-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-122-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-99-0x000001D15F870000-0x000001D15F871000-memory.dmp

Download

memory/4964-98-0x000001D15F870000-0x000001D15F871000-memory.dmp

Download

memory/4964-121-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-118-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-128-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-127-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-126-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-125-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-124-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/4964-123-0x000001D1602F0000-0x000001D1602F2000-memory.dmp

Download

memory/5672-157-0x0000015324F70000-0x0000015324F71000-memory.dmp

Download

memory/5672-156-0x0000015324F70000-0x0000015324F71000-memory.dmp

Download

memory/5672-158-0x0000015324F70000-0x0000015324F71000-memory.dmp

Download

memory/5672-159-0x0000015324F70000-0x0000015324F71000-memory.dmp

Download

memory/5672-160-0x0000015324F70000-0x0000015324F71000-memory.dmp

Download

memory/5672-161-0x0000015324F70000-0x0000015324F71000-memory.dmp

Download

memory/5672-162-0x0000015324F70000-0x0000015324F71000-memory.dmp

Download