Is CitrineLauncherSetup_0.4.1.exe safe?
This unsigned installer exhibits credential-dumping and process-injection behaviors, and its imphash is strongly associated with known unwanted software, contradicting its claim to be a legitimate game launcher.
Our analysis identifies this file as malicious. It is an unsigned installer that performs unauthorized memory access to the Windows credential store and injects code into system processes. These behaviors are typical of credential-stealing malware, and the file's imphash is linked to a history of unwanted software distributions.
43e7af5c70ad00df06…eb31c84a54624aRecommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
Our analysis identifies this file as malicious. It is an unsigned installer that performs unauthorized memory access to the Windows credential store and injects code into system processes. These behaviors are typical of credential-stealing malware, and the file's imphash is linked to a history of unwanted software distributions.
The file is unsigned and lacks a legitimate publisher, which is a significant risk factor for an installer. During sandbox execution, it demonstrated high-risk behaviors, including process injection and attempts to access the LSASS process, which is used for storing Windows credentials. Furthermore, the file's imphash matches multiple samples previously identified as 'offercore' PUA. Given that the official project for the claimed software does not provide an installer, this file is likely a malicious wrapper designed to distribute unwanted software under the guise of a game launcher.
What We Detected
The file is an unsigned installer that attempts to perform unauthorized operations on the host system. Our analysis observed the file attempting to access the LSASS process, which is a critical Windows component used for credential storage. Additionally, the file was observed performing process injection, a technique commonly used by malware to hide its activities or escalate privileges.
Threat Behavior
The file's behavior is inconsistent with a legitimate game launcher. It attempts to interact with sensitive system processes and memory areas that are not required for launching a game. The imphash of this file is associated with a history of 'offercore' PUA, which often bundles unwanted software with legitimate-looking installers. The lack of a valid digital signature further confirms that this file is not an official release.
What To Do Now
Do not execute this file. If you have already run it, we recommend performing a full system scan with your security software and changing any credentials that may have been stored on the machine. Remove the file and any associated directories, such as the 'CitrineLauncher' folder in your AppData directory.
Where this verdict could be wrong1 caveat
- The file creates legitimate-looking configuration and log files in %AppData% (behaviour.filesWritten), which is consistent with a launcher's expected behavior.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Unsigned executable
- Credential dumping behavior (LSASS access)
- Process injection (T1055)
- Imphash linked to known PUA/malware
- Claimed software does not provide an installer
Delete the file immediately and do not run it. If already executed, perform a full system scan and reset your saved credentials.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete3 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial2 of 5 contacted hosts were cross-checked; coverage is incomplete.
YARA
Complete3 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 9MITRE ATT&CK techniques
- 12spawned processes
- 6network contacts
- 26filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Removed execution artefacts or logs, which can conceal activity.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Reads your Windows user-account details.
Note: Collects details about your system.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How bundlers & adware work
This is a bundler — a real-looking installer that hides extra software inside. When you run it, it quietly installs things you never asked for: ad injectors, browser toolbars, fake 'PC cleaner' apps, or even more bundlers. The people behind it get paid for every unwanted app they sneak on.
Bottom line:It's not usually built to destroy files, but it slows your PC, floods it with ads, and can be a real pain to fully remove.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
CitrineLauncherSetup_0.4.1.exe
43e7af5c70ad00df0673c5e7cb12b30e0ef4bdc6950d0076eceb31c84a54624a
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\CitrineLauncherSetup_0.4.1.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\is-7OIAIGIKH2.tmp\CitrineLauncherSetup_0.4.1.tmp" /SL5="$6014A,14529348,950272,C:\Users\<USER>\Desktop\CitrineLauncherSetup_0.4.1.exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
CitrineLauncherSetup_0.4.1.tmp
C:\Users\<USER>\AppData\Local\Temp\is-7OIAIGIKH2.tmp\CitrineLauncherSetup_0.4.1.tmp
04Isolated runtime analysis - Written fileObserved
Settings.json
C:\Users\<USER>\AppData\Local\CitrineLauncher\Settings.json
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostDerived
raw.githubusercontent.com
Saved reputation verdict: suspicious.
06Contacted-host cross-check - Contacted hostObserved
185.199.109.133
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 185.199.109.133
- 104.18.20.213
- 162.159.36.2
- http://r12.c.lencr.org/91.crl
- https://raw.githubusercontent.com/CitrineLauncher/VersionIndex/main/Bedrock/ServerPackages.json
- https://raw.githubusercontent.com/CitrineLauncher/VersionIndex/main/Bedrock/GamePackages.json
- C:\Users\<USER>\AppData\Local\Temp\is-7OIAIGIKH2.tmp\CitrineLauncherSetup_0.4.1.tmp
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Settings.json
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Logs\CitrineLauncher.16.log
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Logs\CitrineLauncher.14.log
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Logs\CitrineLauncher.13.log
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Logs\CitrineLauncher.15.log
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Logs\CitrineLauncher.13.log
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Logs\CitrineLauncher.12.log
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Logs\CitrineLauncher.11.log
- C:\Users\<USER>\AppData\Local\CitrineLauncher\Logs\CitrineLauncher.10.log
- CitrineLauncher_69df74b0-437b-4c96-9845-7ece0b35588a
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache.
- eda0ada61fcd7778204b…53dc7bNever scannednever seen before
- 7df4d64ffbe93ba125e9…b0a34bNever scannednever seen before
- 05e499006b173de8b417…627ac3Never scannednever seen before
- 8a806a7245b6a3ea5592…944669Never scannednever seen before
- c0800ace49ac3ef3b8a9…2754a8Never scannednever seen before
- ffa4a46f8c2494aa9bcf…9c12bbNever scannednever seen before
Servers this file contacts
This file contacts 1 host we've flagged suspicious in our own URL scanner.
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 3rule hits recorded
- 3 / 75engines flagged
- 117sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
3 of 75 antivirus engines flagged the file, including APEX and DeepInstinct.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has been submitted 131 times from 117 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 04
Scanned file: CitrineLauncherSetup_0.4.1.exe — 43e7af5c70ad00df0673c5e7cb12b30e0ef4bdc6950d0076eceb31c84a54624a
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\CitrineLauncherSetup_0.4.1.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Users\<USER>\AppData\Local\Temp\is-7OIAIGIKH2.tmp\CitrineLauncherSetup_0.4.1.tmp" /SL5="$6014A,14529348,950272,C:\Users\<USER>\Desktop\CitrineLauncherSetup_0.4.1.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: CitrineLauncherSetup_0.4.1.tmp — C:\Users\<USER>\AppData\Local\Temp\is-7OIAIGIKH2.tmp\CitrineLauncherSetup_0.4.1.tmp
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: Settings.json — C:\Users\<USER>\AppData\Local\CitrineLauncher\Settings.json
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: raw.githubusercontent.com — Saved reputation verdict: suspicious.
ProvenanceDerivedSourceContacted-host cross-checkObserved at - 10
Contacted host: 185.199.109.133 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: pua
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeThe sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence185.199.109.133 · 104.18.20.213 · 162.159.36.2
3 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- CitrineLauncherSetup_0.4.1.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 15.4 MB
- Last analyzed
- Aug 14, 2026, 8:00 AM UTC
43e7af5c70ad00df0673c5e7cb12b30e0ef4bdc6950d0076eceb31c84a54624aSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Get a fresh copy from the developer's official site or an official app store.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is CitrineLauncherSetup_0.4.1.exe a virus?
What is CitrineLauncherSetup_0.4.1.exe?
How many antivirus engines detected CitrineLauncherSetup_0.4.1.exe?
What should I do if I already ran CitrineLauncherSetup_0.4.1.exe?
How do I remove CitrineLauncherSetup_0.4.1.exe?
What kind of malware is CitrineLauncherSetup_0.4.1.exe?
What is the SHA-256 hash of CitrineLauncherSetup_0.4.1.exe?
How up to date is this analysis of CitrineLauncherSetup_0.4.1.exe?
Community
Member reviews and reports for this exact file hash.