05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf

Analysis

max time kernel
40s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240611-es
resource tags

arch:x64arch:x86image:win10v2004-20240611-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28-06-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher-3.2.exe
Size

1.6MB
MD5

b63468dd118dfbca5ef7967ba344e0e3
SHA1

2ba4f0df5f3bd284bf2a89aba320e4440d8b8355
SHA256

05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
SHA512

007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548
SSDEEP

49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

SKlauncher-3.2.exe

pid process

2372 SKlauncher-3.2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

468 icacls.exe
Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2372	SKlauncher-3.2.exe

pid	process
468	icacls.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

2688 msedge.exe
2688 msedge.exe
2888 msedge.exe
2888 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

2888 msedge.exe
2888 msedge.exe
2888 msedge.exe

pid	process
2688	msedge.exe
2688	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

SKlauncher-3.2.exe

pid process

2372 SKlauncher-3.2.exe
2372 SKlauncher-3.2.exe
2372 SKlauncher-3.2.exe

pid	process
2372	SKlauncher-3.2.exe
2372	SKlauncher-3.2.exe
2372	SKlauncher-3.2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SKlauncher-3.2.exejava.exerundll32.exemsedge.exe

description	pid	process	target process
PID 2372 wrote to memory of 724	2372	SKlauncher-3.2.exe	java.exe
PID 2372 wrote to memory of 724	2372	SKlauncher-3.2.exe	java.exe
PID 724 wrote to memory of 468	724	java.exe	icacls.exe
PID 724 wrote to memory of 468	724	java.exe	icacls.exe
PID 2372 wrote to memory of 408	2372	SKlauncher-3.2.exe	java.exe
PID 2372 wrote to memory of 408	2372	SKlauncher-3.2.exe	java.exe
PID 2372 wrote to memory of 1052	2372	SKlauncher-3.2.exe	reg.exe
PID 2372 wrote to memory of 1052	2372	SKlauncher-3.2.exe	reg.exe
PID 2372 wrote to memory of 2008	2372	SKlauncher-3.2.exe	rundll32.exe
PID 2372 wrote to memory of 2008	2372	SKlauncher-3.2.exe	rundll32.exe
PID 2008 wrote to memory of 2888	2008	rundll32.exe	msedge.exe
PID 2008 wrote to memory of 2888	2008	rundll32.exe	msedge.exe
PID 2888 wrote to memory of 2044	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2044	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2204	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2688	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 2688	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 436	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 436	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 436	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 436	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 436	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 436	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 436	2888	msedge.exe	msedge.exe
PID 2888 wrote to memory of 436	2888	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372

\??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
"c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
2⤵
- Suspicious use of WriteProcessMemory
PID:724

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
3⤵
- Modifies file permissions
PID:468

\??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
"c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
2⤵
PID:408

C:\Windows\SYSTEM32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
2⤵
PID:1052

C:\Windows\SYSTEM32\rundll32.exe
rundll32.exe url.dll,FileProtocolHandler https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff157146f8,0x7fff15714708,0x7fff15714718
4⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,258889191414942964,6464570211493748891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
4⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,258889191414942964,6464570211493748891,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,258889191414942964,6464570211493748891,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
4⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,258889191414942964,6464570211493748891,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
4⤵
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,258889191414942964,6464570211493748891,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
4⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,258889191414942964,6464570211493748891,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
4⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
18884b1756ccd42c1d014eb24a275c3d

SHA1
4338a2d1c96faaafed1ac0db681c51dcae432ed8

SHA256
c75dd2bbc7029b1d2bbbdea808a245ba4458beec0438c0e957088b19727ebb46

SHA512
b5a27ccfb4b8bdf283a0be5b7d80d368f28628a0fb60c49831ec9eda08513e4b33e8523bb3dd1231becb06ee1bc95ba79e04ac32991165613af689e83aed5acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
d6d8fb41628c11437157f0c8999714bf

SHA1
5fde980f9c7b1b3a60de1e9afab333f6791b293b

SHA256
1344730137bf2db0f9a645864312fa4a21fd63eefb8c06d61071c0562ecad180

SHA512
74254ecc0785047d17fb8cf9ce17ab3b51c62fe094a4c8b28b78297f35e0c75cdf0a3b48fcea51c9293fa3f6794d8fc9f1c480735870ec5614d86daac83088c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
189B

MD5
5e1f9068447613da1cf1cef1ac1ecd24

SHA1
96a471227975a7987934c420f6c0cf3a8457302f

SHA256
e018c545680b0da8a04b069210dffb60f4a21c19dfbaa8ad1dda4e64acedc35d

SHA512
764d9814b388d8cbaa1892843e951b3717bdfcfbd88be4e881f0694eb96fc6a9a4c77fab9204f42e70142b58dc9cbc55c2d208e704ae0473a7f65175fc611ee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f7272debfe7b17d47205d17e26c27e69

SHA1
a850fd9b345f009eb9b9b638d5c16ed663d89244

SHA256
2990b395b979b43105b09a89d6c25faa25db29806075c171a1a6f3f49ceeb3c2

SHA512
5d125c5b7cfc3a1174a05842b9816eaf8968ce726d8de0ef83695bafd306f7be70ebd0a32115f1e4b0307a30fc88a1fb9f275dd850d6310cf1965c192e2b314b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ba4dd9d5815ffef7fbda79d98a1be29c

SHA1
8742128d61dd05b905c240ddf2f842b5c3272576

SHA256
3e53a6de5f88d404d1bd8a51e31d708be84c0a901c00a95c2f514db18c2b01e3

SHA512
87b3075d5f7f69c6dad49dbf53a914881483927d63a386274b3b65c838432ffdaba2cabbf51f6124147b8705f04dd1af35b49d9b122c489261e3cafc7692f581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8c66f5f38f5d01721078ae0a167ccaa6

SHA1
535de1ec8c5c9640df8739746684e7184f0768c1

SHA256
4c57a5cb403c7aa5ba3705e803f4276fa08c7d0c46cd45b63bc29428993e16b6

SHA512
46455c8e6e5129b0d2d19ddfaca8c2ebb4b856185a684e79c2719a75b7e9a0d1d56aec6d05d699bcc50c9901a2a2c831812aa5156db5c8410c9dc40f5070dfa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF4014103513343887068.tmp
Filesize
398KB

MD5
ff5fdc6f42c720a3ebd7b60f6d605888

SHA1
460c18ddf24846e3d8792d440fd9a750503aef1b

SHA256
1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1

SHA512
d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF4159366162925442594.tmp
Filesize
405KB

MD5
8f2869a84ad71f156a17bb66611ebe22

SHA1
0325b9b3992fa2fdc9c715730a33135696c68a39

SHA256
0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1

SHA512
3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF6085318933263867269.tmp
Filesize
397KB

MD5
fdb50e0d48cdcf775fa1ac0dc3c33bd4

SHA1
5c95e5d66572aeca303512ba41a8dde0cea92c80

SHA256
64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123

SHA512
20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53

Download Submit
C:\Users\Admin\AppData\Local\Temp\e4j3047.tmp_dir1719538850\SKlauncher-3.2.jar
Filesize
1.1MB

MD5
4d653e61ba01a521c56b9a70a9c9814e

SHA1
de855dc3dbc914b497b58da92e0c21fff660796d

SHA256
f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350

SHA512
e6a7db6e2893b5b01dd0c84a230d88abf50da63ceb1af5754a2c4c1fbd307a799a74f3f368430d3beb33590cda2e0a3cf509fef11c4477b76e8d3c4a582b5def

Download Submit
C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4514617443100.dll
Filesize
22KB

MD5
dcd68a87b7e6edbcfde48150403b22eb

SHA1
28e4839a29725075772fccc39b44e194eb91e477

SHA256
ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c

SHA512
ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar
Filesize
14.1MB

MD5
6010422686c1a1fd08bd2a3099de8680

SHA1
67203beb715a7f47ea9fa5ac023a0a7aef793bab

SHA256
a163ebc83ed564ed60fcf502b852857249dfa55ea1a3f77cec257080001d1200

SHA512
b2e277dc0753684c8e69070022dad91c24f957c83203175a3e555b19ced10a94a6d1fadc2272c803640ec7e0cff9f9c304061920a34297e1b63be0276db371b9

Download Submit
\??\pipe\LOCAL\crashpad_2888_QAAODBYWTWKMRGSY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/408-20-0x000001C71F9C0000-0x000001C71FC30000-memory.dmp

Filesize
2.4MB

Download
memory/408-30-0x000001C71E100000-0x000001C71E101000-memory.dmp

Filesize
4KB

Download
memory/408-31-0x000001C71F9C0000-0x000001C71FC30000-memory.dmp

Filesize
2.4MB

Download
memory/724-5-0x0000011E894E0000-0x0000011E89750000-memory.dmp

Filesize
2.4MB

Download
memory/724-15-0x0000011E87C80000-0x0000011E87C81000-memory.dmp

Filesize
4KB

Download
memory/724-16-0x0000011E894E0000-0x0000011E89750000-memory.dmp

Filesize
2.4MB

Download
memory/2372-281-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-268-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-270-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-272-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-271-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-279-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-140-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-328-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-82-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-269-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-49-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-45-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-266-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-34-0x0000000003070000-0x00000000032E0000-memory.dmp

Filesize
2.4MB

Download
memory/2372-265-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-125-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-224-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-220-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-211-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2372-912-0x0000000003070000-0x00000000032E0000-memory.dmp

Filesize
2.4MB

Download