05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf

Analysis

max time kernel
55s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher-3.2.exe
Size

1.6MB
MD5

b63468dd118dfbca5ef7967ba344e0e3
SHA1

2ba4f0df5f3bd284bf2a89aba320e4440d8b8355
SHA256

05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
SHA512

007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548
SSDEEP

49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

SKlauncher-3.2.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation SKlauncher-3.2.exe
Loads dropped DLL 1 IoCs

Processes:

SKlauncher-3.2.exe

pid process

1156 SKlauncher-3.2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3752 icacls.exe
Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	SKlauncher-3.2.exe

pid	process
1156	SKlauncher-3.2.exe

pid	process
3752	icacls.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

4092 msedge.exe
4092 msedge.exe
2844 msedge.exe
2844 msedge.exe
3520 identity_helper.exe
3520 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

2844 msedge.exe
2844 msedge.exe
2844 msedge.exe

pid	process
4092	msedge.exe
4092	msedge.exe
2844	msedge.exe
2844	msedge.exe
3520	identity_helper.exe
3520	identity_helper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

SKlauncher-3.2.exe

pid process

1156 SKlauncher-3.2.exe
1156 SKlauncher-3.2.exe
1156 SKlauncher-3.2.exe

pid	process
1156	SKlauncher-3.2.exe
1156	SKlauncher-3.2.exe
1156	SKlauncher-3.2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SKlauncher-3.2.exejava.exerundll32.exemsedge.exe

description	pid	process	target process
PID 1156 wrote to memory of 2672	1156	SKlauncher-3.2.exe	java.exe
PID 1156 wrote to memory of 2672	1156	SKlauncher-3.2.exe	java.exe
PID 2672 wrote to memory of 3752	2672	java.exe	icacls.exe
PID 2672 wrote to memory of 3752	2672	java.exe	icacls.exe
PID 1156 wrote to memory of 768	1156	SKlauncher-3.2.exe	java.exe
PID 1156 wrote to memory of 768	1156	SKlauncher-3.2.exe	java.exe
PID 1156 wrote to memory of 3896	1156	SKlauncher-3.2.exe	reg.exe
PID 1156 wrote to memory of 3896	1156	SKlauncher-3.2.exe	reg.exe
PID 1156 wrote to memory of 3800	1156	SKlauncher-3.2.exe	rundll32.exe
PID 1156 wrote to memory of 3800	1156	SKlauncher-3.2.exe	rundll32.exe
PID 3800 wrote to memory of 2844	3800	rundll32.exe	msedge.exe
PID 3800 wrote to memory of 2844	3800	rundll32.exe	msedge.exe
PID 2844 wrote to memory of 3632	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 3632	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 1528	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 4092	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 4092	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 2148	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 2148	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 2148	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 2148	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 2148	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 2148	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 2148	2844	msedge.exe	msedge.exe
PID 2844 wrote to memory of 2148	2844	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156

\??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
"c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
2⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
3⤵
- Modifies file permissions
PID:3752

\??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
"c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
2⤵
PID:768

C:\Windows\SYSTEM32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
2⤵
PID:3896

C:\Windows\SYSTEM32\rundll32.exe
rundll32.exe url.dll,FileProtocolHandler https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
2⤵
- Suspicious use of WriteProcessMemory
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2f4846f8,0x7ffa2f484708,0x7ffa2f484718
4⤵
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9290545123424248815,8421080819590083240,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
4⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9290545123424248815,8421080819590083240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9290545123424248815,8421080819590083240,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
4⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9290545123424248815,8421080819590083240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
4⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9290545123424248815,8421080819590083240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
4⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9290545123424248815,8421080819590083240,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
4⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9290545123424248815,8421080819590083240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
4⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9290545123424248815,8421080819590083240,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
f804c3e01d18b4ae4e67ea4ee9902fc2

SHA1
e09c7948c157158563850c099d17148785d2d943

SHA256
29abf05c255b73e9a0105475656175c2c4ba323f4b9bf8f04b771ef4f54d5cb4

SHA512
4684ff4c3b40db8a8ffc1aa9a093f58a30a2da6bf3f8938e70cced6598b38bc1bd47c9989cf3e5ae81c78477ef2c09f2f07b387696e5908c6aeaf867db58beb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05a73c0b-4c9d-4c05-995a-fddc70c75cc8.tmp
Filesize
6KB

MD5
37a6e37e104ff962984e2ee4a69779f1

SHA1
b1579349a52a63b3dca3884600468f522fcd5193

SHA256
168f1bac04f661b76b7d7d5136f203c5b9c536c1a83d8cac6ec36e4f67a815fb

SHA512
edcff59c74226a85a2e1648b5559b25035156c7d9d4b2822f17cef47d5fe56d4ba12d135d598e29c0b73208a47a7098d90c1d73740d0edb5cb0f354eab843fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
f666576de2e5317f912ae77fd8a2b3b2

SHA1
e947604a0fd7774a1f98ef77af9eb8df2af648ed

SHA256
d43cfe7d5dad46f72e2dc7e0cc376d7d87027dfc43125ff854bc5f8cb7d25a94

SHA512
d7d4c19f54131cfe95af95c9b35d8eb7acb4ed1ec6b33690e796b333858f99d1d8a35ad9c7eda574e47be3329df71e48b6ebfa5183752d06a0a8a93639e19723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
280B

MD5
119b9326a3d87cf92a8e890d5bb2fa90

SHA1
c7456c480c5473a233b8e8e818ab98f4e30e1fa2

SHA256
75e2b144900db60104e0384f21393c1d99e211d8cbaedaba1a4e87c7b8540084

SHA512
4ca6654aa998491ef90420581291b8121c3c8b84653cd5806464dbddaba6ebe04ff970dc85be7428fb9879f03a02c8bc43488b278edf0b089862a0b9628b0a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3022cecb25469176507dfadeb2d8ce65

SHA1
e708c8cd90351d5a646ea99ba209fb3abdf7714b

SHA256
ea9ac431a3931974744f2373c8989633030144d912a13b50e75a8568a4392b73

SHA512
1faa5dfca40637c86e05415c5103403a02546cb935a897df82b9e323b7900b40efb414f00e3efaeaf8f801045c092ad7d979538cbc4d2ed3552dc1dd412adb96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bdd18bd4fee70790bc1f00c67850d789

SHA1
29d518186db21ac0dbb22abfeff401644ad9751d

SHA256
d758ed85cf21f55a76a632d8b3d5bc49605853b68781bd1fd8112d4a4ca8afcf

SHA512
9b4c0343f483446eec94e2e67bf66aea5fa31599790829c4bb8c666d97b35bd4dbc6e6bac1bdbd93a9850d4d3cc807ac494d3bc4aaa1b8fd7a4867f6f0232b20

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF1806214064438520898.tmp
Filesize
405KB

MD5
8f2869a84ad71f156a17bb66611ebe22

SHA1
0325b9b3992fa2fdc9c715730a33135696c68a39

SHA256
0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1

SHA512
3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF4671154358017849457.tmp
Filesize
398KB

MD5
ff5fdc6f42c720a3ebd7b60f6d605888

SHA1
460c18ddf24846e3d8792d440fd9a750503aef1b

SHA256
1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1

SHA512
d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF8998131389086020865.tmp
Filesize
397KB

MD5
fdb50e0d48cdcf775fa1ac0dc3c33bd4

SHA1
5c95e5d66572aeca303512ba41a8dde0cea92c80

SHA256
64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123

SHA512
20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53

Download Submit
C:\Users\Admin\AppData\Local\Temp\e4j37C9.tmp_dir1719862188\SKlauncher-3.2.jar
Filesize
1.1MB

MD5
4d653e61ba01a521c56b9a70a9c9814e

SHA1
de855dc3dbc914b497b58da92e0c21fff660796d

SHA256
f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350

SHA512
e6a7db6e2893b5b01dd0c84a230d88abf50da63ceb1af5754a2c4c1fbd307a799a74f3f368430d3beb33590cda2e0a3cf509fef11c4477b76e8d3c4a582b5def

Download Submit
C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4534706865300.dll
Filesize
22KB

MD5
dcd68a87b7e6edbcfde48150403b22eb

SHA1
28e4839a29725075772fccc39b44e194eb91e477

SHA256
ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c

SHA512
ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar
Filesize
14.1MB

MD5
7e3ed7694833d8cfb47a47cfc9d4205c

SHA1
7d3699db91e0569903bd902b54acc8d2f373e02a

SHA256
99dd19398f87d030fa39c56ca0a5a0284db37128d1623bd1edb0de66f9861290

SHA512
ceeef6d0194438af9ff4256305204ab43bb3d50db372716bca8754dc91fdcfe15109d900fb41da20b53853b16a088c5f2a26d54331b8744d3886ab1939883460

Download Submit
\??\pipe\LOCAL\crashpad_2844_SOKJEPQHAKIPVXDC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/768-30-0x000001E0E1C20000-0x000001E0E1C21000-memory.dmp

Filesize
4KB

Download
memory/768-20-0x000001E0E34F0000-0x000001E0E3760000-memory.dmp

Filesize
2.4MB

Download
memory/768-31-0x000001E0E34F0000-0x000001E0E3760000-memory.dmp

Filesize
2.4MB

Download
memory/1156-221-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-781-0x0000000002AD0000-0x0000000002D40000-memory.dmp

Filesize
2.4MB

Download
memory/1156-238-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-244-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-222-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-287-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-288-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-292-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-211-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-189-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-177-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-36-0x0000000002AD0000-0x0000000002D40000-memory.dmp

Filesize
2.4MB

Download
memory/1156-137-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-125-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-123-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-81-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-49-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/1156-45-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/2672-5-0x0000021B0BF40000-0x0000021B0C1B0000-memory.dmp

Filesize
2.4MB

Download
memory/2672-16-0x0000021B0BF40000-0x0000021B0C1B0000-memory.dmp

Filesize
2.4MB

Download
memory/2672-15-0x0000021B0BF20000-0x0000021B0BF21000-memory.dmp

Filesize
4KB

Download