e7dda82f2f2f98d408f435a05fd0609f33561fa40a988bbf1eb7a6d2d95b9e19

Analysis

user interaction
yes
max time kernel
42s
max time network
69s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wt_launcher_1.0.3.542-8hzpe95wh.exe
Size 12.9MB
Sample261101-w2gpbses7m
SHA256 e7dda82f2f2f98d408f435a05fd0609f33561fa40a988bbf1eb7a6d2d95b9e19
MD5 488d0884d54ebea20c6dfafa9545231f
SHA1 952b6aef87614f100316a65500922e789954dc2b
SHA512 7dd024b15d8fac9c0e8426a52b3fa687d8bb8f22f0403e9b462ed4d6dcd08161d3228ece0cea0fe090a90c703cea1e3d704f7cc4f1b0a82f835085f6db14407b
SSDEEP 393216:S+2V6ymNOiQUJdg4c7BIz6QQq2FINI/AJ:DQmkiQU7uB66QQq/24J
TLSH
T1E6D6333FB23C653FC9AE0A3646B3932058777A6168168C1F57F4490DEF768601E3BA91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer persistence privilege_escalation

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2416	icacls.exe

Modifies Windows Firewall 2 TTPs 12 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4136	netsh.exe
4816	netsh.exe
784	netsh.exe
4764	netsh.exe
4408	netsh.exe
2656	netsh.exe
5808	netsh.exe
2452	netsh.exe
2176	netsh.exe
2940	netsh.exe
5660	netsh.exe
2756	netsh.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 48 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wt_launcher_1.0.3.542-8hzpe95wh.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wt_launcher_1.0.3.542-8hzpe95wh.tmp

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wt_launcher_1.0.3.542-8hzpe95wh.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wt_launcher_1.0.3.542-8hzpe95wh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5036-1-0x0000000000400000-0x00000000004EF000-memory.dmp	innosetup
behavioral2/memory/5036-11-0x0000000000400000-0x00000000004EF000-memory.dmp	innosetup
behavioral2/memory/5036-83-0x0000000000400000-0x00000000004EF000-memory.dmp	innosetup

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp
3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3380	5036	wt_launcher_1.0.3.542-8hzpe95wh.exe	89
PID 3380 wrote to memory of 4136	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	91
PID 3380 wrote to memory of 5808	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	94
PID 3380 wrote to memory of 2452	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	96
PID 3380 wrote to memory of 2176	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	98
PID 3380 wrote to memory of 2940	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	100
PID 3380 wrote to memory of 4816	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	102
PID 3380 wrote to memory of 784	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	104
PID 3380 wrote to memory of 4764	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	106
PID 3380 wrote to memory of 4408	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	108
PID 3380 wrote to memory of 5660	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	110
PID 3380 wrote to memory of 2756	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	112
PID 3380 wrote to memory of 2656	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	114
PID 3380 wrote to memory of 1500	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	116
PID 3380 wrote to memory of 2332	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	118
PID 3380 wrote to memory of 6008	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	120
PID 3380 wrote to memory of 4860	3380	wt_launcher_1.0.3.542-8hzpe95wh.tmp	122

C:\Users\Admin\AppData\Local\Temp\wt_launcher_1.0.3.542-8hzpe95wh.exe
"C:\Users\Admin\AppData\Local\Temp\wt_launcher_1.0.3.542-8hzpe95wh.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\is-PFO74.tmp\wt_launcher_1.0.3.542-8hzpe95wh.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PFO74.tmp\wt_launcher_1.0.3.542-8hzpe95wh.tmp" /SL5="$400A0,12385646,925184,C:\Users\Admin\AppData\Local\Temp\wt_launcher_1.0.3.542-8hzpe95wh.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder self updater" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\gaijin_downloader.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4136
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder launcher" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\launcher.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5808
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder Game Client" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\win32\aces.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2452
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder Crash Reporter" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\win32\bpreport.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2176
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder Crash Reporter" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\bpreport.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2940
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Gaijin.Net Updater" dir=in action=allow program="C:\Users\Admin\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4816
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder Game Client" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:784
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder Game Min Client" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces-min-cpu.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4764
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder Game BattlEye Client" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\aces_BE.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4408
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder Battle Eye Client" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\BattlEye\BEService_x64.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5660
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder Crash Reporter" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\win64\bpreport.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="War Thunder CrashPad Reporter" dir=in action=allow program="C:\Users\Admin\AppData\Local\WarThunder\win64\crashpad_handler.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2656
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder Crash reporter" program="C:\Users\Admin\AppData\Local\WarThunder\bpreport.exe" dir=in action=allow protocol=TCP localport=443
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1500
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder Crash reporter" program="C:\Users\Admin\AppData\Local\WarThunder\win32\bpreport.exe" dir=in action=allow protocol=TCP localport=443
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2332
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder Crash reporter" program="C:\Users\Admin\AppData\Local\WarThunder\win64\crashpad_handler.exe" dir=in action=allow protocol=TCP localport=443
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:6008
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces.exe" dir=in action=allow protocol=TCP localport=80
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4860
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces.exe" dir=in action=allow protocol=TCP localport=443
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces.exe" protocol=UDP localport=20010-20500
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces.exe" protocol=UDP localport=3478-3480
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces-min-cpu.exe" dir=in action=allow protocol=TCP localport=80
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces-min-cpu.exe" dir=in action=allow protocol=TCP localport=443
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces-min-cpu.exe" protocol=UDP localport=20010-20500
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces-min-cpu.exe" protocol=UDP localport=3478-3480
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces.exe" dir=in action=allow protocol=TCP localport=7852
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces.exe" dir=in action=allow protocol=TCP localport=7853
    3⤵
    PID:3084
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces-min-cpu.exe" dir=in action=allow protocol=TCP localport=7852
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder" program="C:\Users\Admin\AppData\Local\WarThunder\win64\aces-min-cpu.exe" dir=in action=allow protocol=TCP localport=7853
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder Launcher" program="C:\Users\Admin\AppData\Local\WarThunder\launcher.exe" dir=in action=allow protocol=TCP localport=27022-27042
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\system32\netsh" netsh advfirewall firewall add rule name="War Thunder Launcher" program="C:\Users\Admin\AppData\Local\WarThunder\launcher.exe" dir=in action=allow protocol=TCP localport=6881
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" "C:\Users\Admin\AppData\Local\WarThunder" /grant *S-1-5-11:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:2416
- - C:\Users\Admin\AppData\Local\WarThunder\launcher.exe
    "C:\Users\Admin\AppData\Local\WarThunder\launcher.exe"
    3⤵
    PID:4136
  - - C:\Users\Admin\AppData\Local\WarThunder\gaijin_downloader.exe
      "C:\Users\Admin\AppData\Local\WarThunder\gaijin_downloader.exe" -appid WarThunderLauncherZip -localversion 1.0.3.542 -execpath launcher.exe -notify_user_about_failure -conditional_gui_app_restart
      4⤵
      PID:2956
  - - C:\Users\Admin\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe
      "C:\Users\Admin\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe"
      4⤵
      PID:2824

C:\Users\Admin\AppData\Local\WarThunder\launcher.exe
"C:\Users\Admin\AppData\Local\WarThunder\launcher.exe"
1⤵
PID:944
- C:\Users\Admin\AppData\Local\WarThunder\gaijin_downloader.exe
  "C:\Users\Admin\AppData\Local\WarThunder\gaijin_downloader.exe" -appid WarThunderLauncherZip -localversion 1.0.3.542 -execpath launcher.exe -notify_user_about_failure -conditional_gui_app_restart
  2⤵
  PID:2940

C:\Users\Admin\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe
"C:\Users\Admin\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe"
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gjagent.blk

Path C:\Users\Admin\AppData\Local\Gaijin\NetAgent\gjagent.blk
Size 20B
SHA256 0f30bf3e1b270d3b2922cec302ea3c176888d209f76a907bf604ef6126546e56
MD5 0e218d59e328a4587e9f744bbe58d2e0
SHA1 79dfa4fb36f99847ecb5e04e4445b3875471bfe1
SHA512 125b134a825a38bee52782e6c3c5e2eba98f7f7aed8ab9370c70ef9dab5e96e970c98a0ad2bdb68fefa3f0ec7843e1043b6e61f8ae5bb9635e335c3dac6267e3
MD5 SHA1 SHA512

Submit Download

4a7c3a60a2e40c0149186cd3314fa92894712bc1.blk

Path C:\Users\Admin\AppData\Local\Gaijin\NetAgent\targets\4a7c3a60a2e40c0149186cd3314fa92894712bc1.blk
Size 199B
SHA256 7a7d98080a42e166bb404d108dec1f35b987ff888c37349b8c30ef3a6b904779
MD5 d29b447ec6be6f7201b97c8e3ebbf8c1
SHA1 00f514390be58c569f3d5412985259070166610d
SHA512 06f63224bef855af0b97b77c1a6d5ed549c7c77710d6557613597ae53799d214e81c478c217d178a107d15c1830c14b1c82669d939428e07259bec02d1a50b90
TLSH
T10DD013F581DDD73D1844417B0574DDE9C06A10717FED2711E15CA654115D63CF85A301
MD5 SHA1 SHA512 TLSH

Submit Download

wt_launcher_1.0.3.542-8hzpe95wh.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PFO74.tmp\wt_launcher_1.0.3.542-8hzpe95wh.tmp
Size 3.1MB
SHA256 a0d1bebca6a833b476df61b26df6ba3c709f28e11249f58df0e673326531fd70
MD5 872b7adf2dd404558a77bdbcdcc89fc7
SHA1 cc285b41eeebb3b26175bc9a2f31013febb9a1ad
SHA512 293d5b06d637b94ed647425fff7b4405c1b39d9c682ebf344dfbf3071785550634115d6ca95a4f8c009b9c3017690a54919e836296853f75d6bcf892a28237c4
SSDEEP 49152:xWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbw333ml:TtLutqgwh4NYxtJpkxhGP333Q
TLSH
T1A1E53B27F28C713ED06B3A364A3386909837F66169128C6797FC794C8F365942A3E747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026_11_01_18_25_49_4136.txt

Path C:\Users\Admin\AppData\Local\WarThunder\.launcher_log\2026_11_01_18_25_49_4136.txt
Size 56KB
SHA256 f2dade412b6a16bbf96100bc9100ec4751844e258d3e12916a5aa1b38f507975
MD5 76f8a2f6c01e11135e0df7acce01dac7
SHA1 d696bb518b4f2385e68148bde88190e17f73dd64
SHA512 2eb0c4db60d469780b0c528fe51cc78141c2a8a02248b0f3875c33662da884eb2e800738125af824cbff9b757434e27df288fff2d150d5eb2e48aafa6bafdbf7
SSDEEP 768:R14aTF2FL03eCxb7eh8oZVRFPFR9f94rybw4NcPgH00zpGKW2ZzpEX92sC92Rn:wJ9f940Nco/z4KWIzc92/92Z
TLSH
T1AC43C8355127007F01D2E29EBF5E2F676B2A978481908A1CD39D0C6C26ADD3ED9C2DF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026_11_01_18_25_51_944.txt

Path C:\Users\Admin\AppData\Local\WarThunder\.launcher_log\2026_11_01_18_25_51_944.txt
Size 61KB
SHA256 331c41965436c623e8e0788b9ecb4f80a7386cadd7b2c0b1ad21cf887b1c6f39
MD5 581abe10ac9a1d7833d5bf3976b57bd0
SHA1 97ffa30fbfaf0bc63dea58681c984032d2a02ebb
SHA512 0ab98fadcd121ce59cf0cac8e9e54cd3f4c83a8646488d514cb7563058b0c8ec58154af4cbde54aa312be73d69967e885209ecae0e353b280376aab52c4a1ce6
SSDEEP 768:yUry77EBPqGesgPbGe8FbLFE02n9a9YuyFc88zcPXu0J0tY402x0tiM29Kc29H3M:LW9a9YXyc/30240+0B29J29ud
TLSH
T1F353B8254227107B01E2D1DEBF5E2F67675B5684C190981CD2AC4C6C26BEE2EEDC2CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026_11_01_18_25_50_2956.txt

Path C:\Users\Admin\AppData\Local\WarThunder\.start_app_logs\2026_11_01_18_25_50_2956.txt
Size 3KB
SHA256 fefc9b25b829226a8204e34e6ba7df6ec7a2e15539355ee0ac2c77704437ba98
MD5 67c2f972546be4480c42cf6a3848f863
SHA1 ee8da62a51ac6c60e2d19466402274c929857dae
SHA512 c9ac08355b653c884bb526a80c3361f019ab8fcaf6604e4cff49117a1b7a2037a92e9939d887f3e2db9ea7e27e1e6b90996cb17f88ea5aefd9226d1a16db9ca3
TLSH
T1B671CBD013C882623D11996F6A386FF7A5370308EB46997E725441CC61A7F3CFE99281
MD5 SHA1 SHA512 TLSH

Submit Download

bpreport.exe

Path C:\Users\Admin\AppData\Local\WarThunder\bpreport.exe
Size 2.1MB
SHA256 44c1db6b7bf4103b2c4d3a1f014a1ea8fafbbeba19cd028525d494e3e390a896
MD5 31911c6ea459f516d1da0a12ec677bea
SHA1 da71e1766a1a7ebe643aaa8fa0715f1af21f1829
SHA512 f97d2f835d35fbc08daf6da032a54aca1cecb0c109074a626d7bbb4369cb43bd7b6e4d442b13a2cfc05bf74d9417da65e93d79a085f56f7b423e115ea6c3ba6c
SSDEEP 49152:4TbdUV71YXOsWr0TXrkfR3kze8TlfNYNPxuaEhl96MFJ:F7AQWrkRk/Y7uV
TLSH
T13FA5AE12B980D032F8E2107AD3FE4BBAAD3DAB20133C91E35BD554E55E615D2773A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca-bundle.crt

Path C:\Users\Admin\AppData\Local\WarThunder\ca-bundle.crt
Size 217KB
SHA256 5b47aee36f594b7737e00990c9922a87252729b74cc2f1a83c0fceed9816bdb9
MD5 1e32496378e8fee43cb01b0689963a67
SHA1 1d4ce2b3dd7f71f4725e6a030d6e25b8a4731508
SHA512 80339d47b383ee0bce769e3723fb2aa1925e6963325733fc12435138f98c996912851792c8ea451ed3eff66e1b74dee984662f759e894f5a663115fcb4005253
SSDEEP 3072:QflGUhzIjom0UMwo6J7gZ7IvqT3x9BYv0yvAvVT/mRR283rz9KKbWqI+CyrGj4J4:16m0Yo+kZbqcBdbgF8+yaU5R5iSYxM
TLSH
T1EB24BF9B8F426C9D28D3E090C96B125ED81E8362DEDB74731D1A3801DB85B3E66FD48D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.blk

Path C:\Users\Admin\AppData\Local\WarThunder\config.blk
Size 159B
SHA256 a54dd4c27fa818f138ee2bdeaabd15d253fac1abba5ea5a3b1b1dd9c7619ebae
MD5 e1b3b45c52f5bc437fe23a6a71e084f1
SHA1 e22a54ae08254c76f38d3b0258733b4f5e3ef0f8
SHA512 f1f8ec970ae395331dc3e27e069a75c829703b1274eda0da2a74fa99a5adf6a04cbe2bee5209410fb4ac489464f5ea0fdc6bb1fe17d6fa48bd35359e62838e37
TLSH
T174C04C167BD26F555E45B1A33CC85446C74240EDC3C33817653C071345E6135C755923
MD5 SHA1 SHA512 TLSH

Submit Download

config.blk

Path C:\Users\Admin\AppData\Local\WarThunder\config.blk
Size 158B
SHA256 70a7b00b0d65fad6617a44654407640b460d3bdd88c59e4eda2559f1eb686134
MD5 bf3af0e2ea0c6d6b0240367fe57ea6ee
SHA1 3cd42c6ea79b5494f03f18a8ce9c617413d7938d
SHA512 92553cc00c347e58ac40c857f5a79bbcd68e5242da9ec9bb7584a12033e71c3595057fa4b8bd602709be46036357dcc8370ec9b4dc19f40e9f5351f95397e40d
TLSH
T1ECC04C167BD26F555E45E5A33DDC544AC74240EDC3D33827653C071345E6135C755923
MD5 SHA1 SHA512 TLSH

Submit Download

config.blk

Path C:\Users\Admin\AppData\Local\WarThunder\config.blk
Size 416B
SHA256 d314a23eeddc464fc7ec2be5c7c8d1fd053cfdd3376293a7c204ddaff4332773
MD5 651ba2e0061fbe5bfbbaf6092438209e
SHA1 007664eceab0c75e7a11bd190317fc723e05df8b
SHA512 026a9c9ce1829c6fb758b2ada2193be353244452683706f202cd27e11db36cac63bdd93f889af4742b881ee6a2ec8e562c1712d797fa63d776594362ec81784e
TLSH
T18EE09215A791DF19DE88679BBC884045DB5914FDFAC73836653CEB038A93035A365C03
MD5 SHA1 SHA512 TLSH

Submit Download

pkg_English.rq2

Path C:\Users\Admin\AppData\Local\WarThunder\content\pkg_English.rq2
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

gaijin_downloader.exe

Path C:\Users\Admin\AppData\Local\WarThunder\gaijin_downloader.exe
Size 3.7MB
SHA256 a365cc4d24d18dd790caef01fa5d98e5c60d89f816723f453ef0d294d44021e2
MD5 40d9496262eab5b7c6be7a3e73439d61
SHA1 fe52d18c35da64402ec33dc51c2ac0f89f9eefb1
SHA512 0ca5be9fd148cbd9b445041097966161da2518581e390b31a0ffa09f3eb07387fdb1873ba96b6746439c1842acdd229bd05459725a86e38f1a89c3c9c7333acc
SSDEEP 49152:ALDNiZtJWJnabd0kMEhLEkT8XO06gk9BmRudiGesxAYTrzAWzJBPIg859yQ7z/wk:AOMZkM6EC8XXk/mRuWsxjAK/859y0
TLSH
T100068C62B940C422E8D20076E6BD5FF65C3D5E74973980D3AB913CA869305E3773E78A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gjagent.exe

Path C:\Users\Admin\AppData\Local\WarThunder\gjagent.exe
Size 3.0MB
SHA256 490a0a8538a457ed7081330942b6086a40713bfa17ee30f91c1c3f471ac1c5c5
MD5 00a2e2a04b82f9777cd332111cbb1e0d
SHA1 6608fa9d3cc3ec162eec0737ae911b5f33710b97
SHA512 c5b14f961a4d69d15cbe55c49a938fac74c4f2ae576a990eea9f5f5acf683fcae8f93dab8e2d9f22c3eaa07621ca82ded5b87ef158936d910fbdde83d2dd110b
SSDEEP 49152:AgyS7ZILTTD5FVN5O60ktt6bb93yDkxSQ1TiEPReGma53OtSSyk:AgyI2hxTDkx3HeGxq
TLSH
T155E57C23B540C076E8D200B3D2BA5BB659299D3053B8D4D36F843CED6DF0AD26739B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\WarThunder\icon.ico
Size 145KB
SHA256 fac97a96962be6b9347fe414aacd99b02a0de63d79ba6e49d8690506a3c96ee4
MD5 945b144169d97344b11e182f773dbb67
SHA1 c1634ef6720f9ba196f788eaae751496076efed1
SHA512 c7773eb65884fb0ef5414b7d02023a247ac0a741bce447e15a0e906f6e3b1dd3af792d4bfd091060b50a2a6fa9c36a2383c56d0cf7547f8700044173c018b5f5
SSDEEP 1536:/YB3m8aCiNo/XNvtYeU2eQBIYLcQ941lpv6aJGoXr+Ctsoxhi1I74N:/YB3m8aCiNMrjBIw16GIsUhi1IsN
TLSH
T1B7E37D7D777AA05AF84159B28FD2F6B821297C3416C116B33EA9BF1E7870F10CAD0660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Users\Admin\AppData\Local\WarThunder\launcher.exe
Size 9.7MB
SHA256 b749f5c97c1eb980f40af6746dcf42d69f0d0bcb64c00231b75538a99b4b1d97
MD5 80e2118c452c5abfe9db15420c6cad2d
SHA1 f311f2d9a5bb8dba81fb5872f44ca84ce4ff2da4
SHA512 69b911ce890493739d41d87ba23a2b85f33a74b838544ea96ea3126a98a39cd206659116e7a60e127f12bfd7439d38887b54a6da0ed770b1b51c14c22c6f55ac
SSDEEP 196608:zfVKgNsQkwL5dKnEXhYjAxyA8UR0SeZ5AeMQ6Lwu5LywZu:5sFwnKnEXW88e0RZ5AeMLLw0yuu
TLSH
T1A6A69D317601C136D89201B2A67CDFEF592D9A390B29A0C3A3D82DBD69B44D33739B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PromoWarThunderMain.zip

Path C:\Users\Admin\AppData\Local\WarThunder\launcher_plug\PromoWarThunderMain.zip
Size 1.4MB
SHA256 84042c603d377bae9e31574911d69627b2a633a295aaa2de0b7aff00eaaadc0f
MD5 9e50ab753449677a94968fc0122fd272
SHA1 3732216b96c3e3e34b0bb21207d52ea7cb8f2cac
SHA512 b44f688687716ec2d5d45a290d31cd7fcb6596026774d38681f36f56c290ea9e239ba27391576a287dec1ea619f5164c7c673433722d60a58cd4c6b7f1a6b42f
SSDEEP 24576:XGuK7Rv+3GdtUCyi7o7IFMN0NZZdz9xWGFAG0yTTmHzlMSBxKEbGzJlbF:Xy9GZCyi7AIFMONZZdzHWAAG0yvmHzDy
TLSH
T1DF6533EC718BC85C92707634D2C5D39A58B9316989BC0DB70899439CF6CEC72D9B3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcherr.dat

Path C:\Users\Admin\AppData\Local\WarThunder\launcherr.dat
Size 4.1MB
SHA256 875fa29b03818c599cc07ea82abb364b43a9a11e167ab7da2d7e43778d5acdb3
MD5 efdc3e03e585b6550262acf86fcd4cc6
SHA1 bf3c7f047bdf6cf7dc513193092457cda189a5fd
SHA512 f12693262406c62d771d1bfb4103e5190e74cb5f843736224dff181798fe3b6dbe4d5a55e125066bfcfc4841b8c2865c67b3addcc15c6a7b40269ab52767c3cb
SSDEEP 98304:IFQ7aKeXyGtoroVC0DJwcOI4dmpqdQZaZMYHJTp+d8:KQ7aK+1torGJWcpqdQYvHq8
TLSH
T124163371F2631046C498E97818A4DE17B9DBF94A27125727CB134791BEC3ECE8423B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sciter.dll

Path C:\Users\Admin\AppData\Local\WarThunder\sciter.dll
Size 5.3MB
SHA256 41cf304562a6240af02157b17800c0ec01154626258a809d665aadd59e7276ca
MD5 58115b095c523466950e2f745b70b867
SHA1 bb37a99f54d253860195de2444f6219809b3c1e2
SHA512 c838c79b5a967632257544b1e1160b21e84d2cfd658818d534d373f56bcfb4db21ee11bb3f970bb36591cb7c518403c2016f0da828df56b812b52b624747c355
SSDEEP 98304:0oDjzWBT+BnzpJvimgivQDAbAnVjLKoTSxTFuI7Ojybp/xGrqNWVhc9tp:0oDjzWeJhsnVj3TOTF5ArqNbd
TLSH
T1E646B032B985907DC26EC3F1A98DF36D81BEAE7014F0426BABE43D5E3E704905296D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path C:\Users\Admin\AppData\Local\WarThunder\unins000.dat
Size 27KB
SHA256 5661ed6853486b5304fd315dda2ed624cc4a5850213780ce8bfa34049c8189a5
MD5 9f7e4ed31d7410186339c24a40eebcd0
SHA1 aae472b4793da0df226daa112c4ef006d5c981af
SHA512 c040d2d904d346943c7738895d685573ea2f353db3c657a28060cabcc80aaac34640e28b3164f84d42875578bec0f9cd596f213453e56c967d149ba22b0d0b0d
SSDEEP 384:XgTFmaV+9ux9MU6OFfOfxLHLK44WXEizbH5qa:Xg/V+9uxyU6of0HLK44uqa
TLSH
T190C2E554A7F85A05F7BB6B39EAFB55203A7A7C66FE21D50D0348824E0C36E14CE21336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.msg

Path C:\Users\Admin\AppData\Local\WarThunder\unins000.msg
Size 23KB
SHA256 ef4bc61593ad4ee1b587f9608e9ed1e642fc3e37a4be73f895818bc00f04f63b
MD5 b12e262407f0c08347d19f703f8bb647
SHA1 258b2afff1050f1c5879511cfc6a54c61448f67e
SHA512 3207fe489efac99bf9b5451722eef1e58402937da288b8a6db40222af8c2a3e207d5b971c8d230b330676478ad51f51ea950128cfd2e2c4de05dbb1815f0ffd6
SSDEEP 192:+f1EjNSCkf3SCqsTr6CCPanAG1GznL7VF+Iqfc51USQDzyXfbKJG/Bfvo:e1EK6CHr6f5X+7Q1USQDzyB/B3o
TLSH
T128B2438167F94258F6F77FA0BE7912644E3ABCA6EC38E65C1240445E19B2E14DDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warthunder.yup

Path C:\Users\Admin\AppData\Local\WarThunder\warthunder.yup
Size 9.5MB
SHA256 9c100a150d735dad8f411fccb48cec7c5a78b410c4ff09e1af9b03d7f0e575aa
MD5 93748f84760ad9c56bcef6c2ffdae109
SHA1 454b14cb28649486a7dc53fc59132e505aad30be
SHA512 6733ec5088361b195415b16c39f00bdfefa80ca99c86df05527b9b2a47dddfd2d02759fe35b132b3e8f537a11feff9cd66faad0059a823440169ebe253d687ea
SSDEEP 196608:VTwgslXXvN0gCEz4q542hScl9Hj3aKze1RzuIaT31a1kxq7Xb3XFFOUdf:VTwgslXXvN9C64q54oLler9aD1aqxqPx
TLSH
T1C5A69D248B615648F232D363645A2BE15731E2EF5C30FB388A339B490DF6F9291E1B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yupartner.blk

Path C:\Users\Admin\AppData\Local\WarThunder\yupartner.blk
Size 20B
SHA256 91d70578096069997158e41f89a6ff9a0e03fadb7b4bfbb9a84a851529a7efe4
MD5 2e7a010aac0f34181e1d18e0a94f12f8
SHA1 bbe6d61ae9ab02069ca6f01e8768465bced6118b
SHA512 6c90e5146fa5815c8f1e4c27fb620b8feba06765bc7eab797dfe56b82d9c8125eda0d674e4af4d154e30ef463ed3a36555dd60b0ad1ccce852861a94e1406313
MD5 SHA1 SHA512

Submit Download

yupmaster.blk

Path C:\Users\Admin\AppData\Local\WarThunder\yupmaster.blk
Size 98B
SHA256 82fc769313a07ae550c7d44284e1247ce07746be86d83430b716cc78da03e296
MD5 76d19e303fa394264489e401bae56f4a
SHA1 0860c53b8cca470034daf3bcd7d86fce2635b19b
SHA512 07a0df26227bab3348f1876975d105afcf76d66e7a3393c8cdab1e4c10551af24230af58be0d2141b11ce26a577c57975ee51338ca65732a5fd5ef26a033e87a
TLSH
T1CFB00232DA017D185D35B6ED2641161A8D25C5051A970D4A51C486045C9350E2541D64
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3380-10-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/3380-17-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/3380-15-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/3380-12-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/3380-9-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/3380-8-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/3380-82-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/3380-64-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/5036-11-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5036-83-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5036-0-0x00000000004C2000-0x00000000004C3000-memory.dmp

Download

memory/5036-1-0x0000000000400000-0x00000000004EF000-memory.dmp

Download