hxxps://win7games[.]com/download/Windows7Games_for_Windows_11_10_8[.]zip

Analysis

max time kernel
206s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://win7games.com/download/Windows7Games_for_Windows_11_10_8.zip

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3232	Solitaire.exe
848	PurblePlace.exe

Loads dropped DLL 6 IoCs

pid	Process
1152	Windows7Games_for_Windows_11_10_8.exe
1152	Windows7Games_for_Windows_11_10_8.exe
1152	Windows7Games_for_Windows_11_10_8.exe
1152	Windows7Games_for_Windows_11_10_8.exe
3232	Solitaire.exe
848	PurblePlace.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	Windows7Games_for_Windows_11_10_8.exe
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	Solitaire.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft Games\Solitaire\desktop.ini	Solitaire.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft Games\Purble Place\desktop.ini	PurblePlace.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\chess.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\Minesweeper.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\CardGames.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Chess\chess.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\CardGames.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\CardGames.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\chess.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png	Windows7Games_for_Windows_11_10_8.exe
File opened for modification	C:\Program Files\Microsoft Games	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Chess\CardGames.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Hearts\slc.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Chess\slc.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\unwin7games.exe	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\slc.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\slc.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Chess\en-US\chess.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Mahjong\CardGames.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\slc.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\Minesweeper.exe	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\slc.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\CardGames.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\chess.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\slc.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Hearts\CardGames.dll	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui	Windows7Games_for_Windows_11_10_8.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui	Windows7Games_for_Windows_11_10_8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftPurblePairsSaveFile\Shell\Open	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftChessTitansSaveFile\Shell\Open	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftChessTitansSaveFile\Shell\Open\Command\ = "\"C:\\Program Files\\Microsoft Games\\Chess\\chess.exe\" \"%L\""	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftChessTitansSaveFile\DefaultIcon\ = "C:\\Program Files\\Microsoft Games\\Chess\\chess.exe,0"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftFreeCellSaveFile\Shell\Open\Command	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftHeartsSaveFile	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftHeartsSaveFile\ = ".HeartsSave-ms"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMinesweeperSaveFile\Shell\Open\Command\ = "\"C:\\Program Files\\Microsoft Games\\Minesweeper\\Minesweeper.exe\" \"%L\""	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSpiderSolitaireSaveFile\ = ".SpiderSolitaireSave-ms"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.HeartsSave-ms	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftHeartsSaveFile\DefaultIcon\ = "C:\\Program Files\\Microsoft Games\\Hearts\\Hearts.exe,0"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftComfyCakesSaveFile\Shell\Open	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSolitaireSaveFile\ = ".SolitaireSave-ms"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSolitaireSaveFile\Shell\Open	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSolitaireSaveFile\DefaultIcon\ = "C:\\Program Files\\Microsoft Games\\Solitaire\\Solitaire.exe,0"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.SpiderSolitaireSave-ms\ = "MicrosoftSpiderSolitaireSaveFile"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMinesweeperSaveFile\Shell\Open	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftPurblePairsSaveFile	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftHeartsSaveFile\Shell\Open\Command	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMahjongTitansSaveFile\ = ".MahjongTitansSave-ms"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.FreeCellSave-ms	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftHeartsSaveFile\Shell\Open	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMinesweeperSaveFile\DefaultIcon\ = "C:\\Program Files\\Microsoft Games\\Minesweeper\\Minesweeper.exe,0"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.PurbleShopSave-ms\ = "MicrosoftPurbleShopSaveFile"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSpiderSolitaireSaveFile\Shell	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ChessTitansSave-ms\ = "MicrosoftChessTitansSaveFile"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftPurbleShopSaveFile\Shell\Open	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftComfyCakesSaveFile\ = ".ComfyCakesSave-ms"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.SolitaireSave-ms\ = "MicrosoftSolitaireSaveFile"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftHeartsSaveFile\FriendlyTypeName = "@C:\\Program Files\\Microsoft Games\\Hearts\\Hearts.exe,-127"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftHeartsSaveFile\Shell	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftPurblePairsSaveFile\ = ".PurblePairsSave-ms"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSpiderSolitaireSaveFile\Shell\Open\Command	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftChessTitansSaveFile	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftChessTitansSaveFile\FriendlyTypeName = "@C:\\Program Files\\Microsoft Games\\Chess\\chess.exe,-307"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftChessTitansSaveFile\DefaultIcon	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMahjongTitansSaveFile\DefaultIcon	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMinesweeperSaveFile\FriendlyTypeName = "@C:\\Program Files\\Microsoft Games\\Minesweeper\\Minesweeper.exe,-168"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftHeartsSaveFile\Shell\Open\Command\ = "\"C:\\Program Files\\Microsoft Games\\Hearts\\Hearts.exe\" \"%L\""	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.MahjongTitansSave-ms\ = "MicrosoftMahjongTitansSaveFile"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftPurbleShopSaveFile\ = ".PurbleShopSave-ms"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.SpiderSolitaireSave-ms	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSpiderSolitaireSaveFile	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftFreeCellSaveFile\Shell	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.MinesweeperSave-ms\ = "MicrosoftMinesweeperSaveFile"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMinesweeperSaveFile\Shell\Open\Command	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftComfyCakesSaveFile\Shell	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftComfyCakesSaveFile\DefaultIcon	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMahjongTitansSaveFile\Shell\Open\Command	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMahjongTitansSaveFile\DefaultIcon\ = "C:\\Program Files\\Microsoft Games\\Mahjong\\Mahjong.exe,0"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftPurbleShopSaveFile\Shell\Open\Command\ = "\"C:\\Program Files\\Microsoft Games\\Purble Place\\PurblePlace.exe\" \"%L\""	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.SolitaireSave-ms	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftChessTitansSaveFile\ = ".ChessTitansSave-ms"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftFreeCellSaveFile\FriendlyTypeName = "@C:\\Program Files\\Microsoft Games\\FreeCell\\FreeCell.exe,-133"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.HeartsSave-ms\ = "MicrosoftHeartsSaveFile"	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftSolitaireSaveFile\Shell	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftFreeCellSaveFile\DefaultIcon	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftChessTitansSaveFile\Shell\Open\Command	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftFreeCellSaveFile\Shell\Open	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftPurbleShopSaveFile	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftComfyCakesSaveFile	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftComfyCakesSaveFile\FriendlyTypeName = "@C:\\Program Files\\Microsoft Games\\Purble Place\\PurblePlace.exe,-252"	Windows7Games_for_Windows_11_10_8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftComfyCakesSaveFile\Shell\Open\Command\ = "\"C:\\Program Files\\Microsoft Games\\Purble Place\\PurblePlace.exe\" \"%L\""	Windows7Games_for_Windows_11_10_8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftMinesweeperSaveFile\DefaultIcon	Windows7Games_for_Windows_11_10_8.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
3696	msedge.exe
3696	msedge.exe
3556	identity_helper.exe
3556	identity_helper.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3232	Solitaire.exe
848	PurblePlace.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2364	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2364	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1152	Windows7Games_for_Windows_11_10_8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 3196	3696	msedge.exe	84
PID 3696 wrote to memory of 3196	3696	msedge.exe	84
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2284	3696	msedge.exe	86
PID 3696 wrote to memory of 2012	3696	msedge.exe	85
PID 3696 wrote to memory of 2012	3696	msedge.exe	85
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87
PID 3696 wrote to memory of 4020	3696	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://win7games.com/download/Windows7Games_for_Windows_11_10_8.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae54d46f8,0x7ffae54d4708,0x7ffae54d4718
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1692 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,12599517633967430175,15749623215091802475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2936

C:\Users\Admin\AppData\Local\Temp\Temp1_Windows7Games_for_Windows_11_10_8.zip\Windows7Games_for_Windows_11_10_8.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Windows7Games_for_Windows_11_10_8.zip\Windows7Games_for_Windows_11_10_8.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1152

C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe
"C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:3232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x514
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
"C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Games\Minesweeper\CardGames.dll

Filesize
4.4MB

MD5
6c904148692dc93fbebbae538817b265

SHA1
c8a69f7f5554f0edef9596ee8a806cfdee63a2d3

SHA256
075befefac16cfd8a9f2786d629e7f1460d1af955a7caadc1b5a05c6787051cc

SHA512
b1910fdc60f3e207c073aba946f51f30055c8243b780ac9716c0d7aeedaf32d845c5d05c883218fe11e1a03592482edba0a149ea0de28e74ef1eea4ea446755e

Download Submit
C:\Program Files\Microsoft Games\Minesweeper\slc.dll

Filesize
2KB

MD5
aabd4974253599aac885e14b8b59c0e6

SHA1
675305e6d3b557cfd849182c0052222d95d8d817

SHA256
9c2ad5c652b0c183e8f9451232bad811f040d93be5557febf6ad47a694642148

SHA512
8f75cdd0d5e57b98b3a79ea317aa6b6beaafd2e1c4415caa7071741558d69d0425c1dc16812592c223e0c3e99f8b7bc9d6edf169c80b4d1306a17883ea841668

Download Submit
C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll

Filesize
20.9MB

MD5
937a49f9346983780a068a819ce81113

SHA1
bf3f375254cb51666ada98607415e45c7a26ebac

SHA256
7ebbc33d8d5710d1fcedc3c7de68d1233d3ba5fe14d85548e3fe4419b20a7e7e

SHA512
9914cd5e2857e237db07848b9c1dcc0dd1f98ccd0d99b217b02ecd8e10fd89ff8479b4291910d5f4e83e76ccead972e9bd8423e5981ecdfe0c56c6b07983ed38

Download Submit
C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe

Filesize
1.2MB

MD5
4c52d613c756427e59cb9ad57bf554ed

SHA1
4cfa9f46e806aaa3c6b5b2eb6de8e2096215c947

SHA256
44028407c9d0ded4f134dce6450bebc03058f75c88d5cb9e0c6b542738b96b0f

SHA512
e6f410f642d1b0044f8a43ff59d10becb44cb368d84f58323c9b30debc6e7be752b9d8a044089fc1cd55d808db348fb7cc0284c60d905225889c82ed20d6de65

Download Submit
C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll

Filesize
8.0MB

MD5
0ff1a20e2c57e578b00060850cbae828

SHA1
4548857453f3fe160eb9138c73380b0ee420d138

SHA256
d8f3d78ff3773cc1d57545041739a056eb12bff78cd2311ff62bc32a9e34bd61

SHA512
c341a9a43858ba1ab5c9cb66ce0763d2be6b1f19c5b5b7db60200e53bc4bc0d041d071405cce743c33c7b97949da69619ac1e8a346cbb6bafb2a137f7dfe4c5e

Download Submit
C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui

Filesize
147KB

MD5
158588e518103aa47a6dd8410e556f51

SHA1
9ce8c5cbecbf377daf03e45e57013da883a8699d

SHA256
6832e5039a96fbe2c27faed617c20f362b8f7cb0a7a955336a1b6c2b0d08018e

SHA512
b8772c6e473979a34fd25d7033db32fc5c012f6e7f5f35964357ab01190f9fedd04b90796629402243f28b745dd095000c1b51f7aabdf31d8a1b9ef37e7193a3

Download Submit
C:\Program Files\Microsoft Games\Solitaire\CardGames.dll

Filesize
5.9MB

MD5
6794d9d442e31dc5e95bdf65f37e4386

SHA1
2d89db0e066099e514f5f626ce427a0cd39b9d70

SHA256
959f28d9c016d64552321a46c8179fdb5241f24dedfacbb71c4dd2d51da0b05a

SHA512
6fbbb495d592e7eed498e4106576433ca695570e5eef0edabf311d5e039e194c3cdc2e2f6bba7909c95e263c151ccb5f29014415a719699f9c17bf3d4e4f5459

Download Submit
C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

Filesize
843KB

MD5
93314c3908f8c8747c98ae4ca680cc4a

SHA1
91befa663d614a315905c92dc63a8bb0d146e939

SHA256
531e8794492b041f81c9e23951349dc2f69a202de64feb1199b3a2d8bdf1b669

SHA512
5748e2f4d9fd5efb510be6bdf0cc6300cfb1430c7e13a44d73f392d9286167ceb854af2a0aa7f27ee2403922bc37ed847e367ee3392913b0db6640687afd9f9a

Download Submit
C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui

Filesize
53KB

MD5
3e86ec78aff88eaae676447e7ab83499

SHA1
bfd86807af5ce71a65d39fb225e8ce6e7732ac85

SHA256
2f8a3082e7e37a5cb1c9cf22ed0b6b3c62e9cd6588fac8d379d4db25bc05bb72

SHA512
4fa9e6a645e8eb64d8bc040ce4d58a3c99ae2863b50174835b005ab9c675b3586a3819d0ad29b4eb6afe43d4408616b9798d169aca0120b29419be109d01a827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
0a6bd6bcb6c998b2a4703ce2e06c78f6

SHA1
0413f04539a4785a01b5737ccff5d1c163cd7c84

SHA256
ca1ca2c81d5181b52b19543da80a57408484bde742cd996d06ee0554f7f41395

SHA512
0956881ff2763b0488a763150bd5d63cedfec3bc3a6434f4cbb09b1a69fefbe7939d47c14a22215b615abf2cb95738e5b7f378d4adc0e5db1750e2f2a6498c47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
246B

MD5
32c6f7ba18d74e6b2f3e34f1b230ed1b

SHA1
b3def13f7a67fc8065496b14e32013309a8c3c8b

SHA256
58d69fd7e3d9ccd5394e49af5bf817f9fc0e2612d3dd7ca30bbd87900a54f240

SHA512
6009d32f07969d13f61d46f03bde4709d61f2e1ced70316541076c41391e53713a5b792668dccb3028a59c04d5cddea006d43e7996d031143da5440d2b841541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20a2c1b3a567b3e3c78e96ca27de9d04

SHA1
263423ab3d9d2428d6da6e27a2a5fbe06ca14891

SHA256
72a7ee95f02d919f753c49418acf096b0846ad79fd7a00f603113a3a3a71daf7

SHA512
c852af41ae2b10e3c937da8b818bee41e1f14c27e6b67c3d19d67278e066d939bae7a4dcb3f512806c4390eaad14f044414bc4c56d3777dbec3abe31082568a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3582c408c39d2ca68be98a847502514

SHA1
b10c0d6c0c6f7b8ce0ea254cb68bfe84ae5df5f3

SHA256
d3a88c8f97a750d7ef8fcfd7b840abee74c568e3ff14cc3879a58ad9dfbb4ff9

SHA512
42f12677f990b9ce044eb192b13163770a644d0f08cca9c9d1232ec7e0e06b8f0c44cc9d7db9e25548f3b796dd1aa55ffba4586aa44910797ea99568c08a8b0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e0a6b1a57add621d3464083989a791d

SHA1
cdf7db2b207274d49dd03b4c6fc31b7c9c3ca186

SHA256
3632413c7abe44576a5aa8c7a50740c04f2df80ee18df2eec628433f6d5b585c

SHA512
2144180a6301aff65ab786da867a5b7201220a84c3f403b36f329978fda80cc7b9dd08a97893f28e7dbe18f731cf7c5adc31b849f22f037ce990a6c18bc6f9e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5b49f55d41e64fee0df8bd1fe04d90b

SHA1
1a4088796139bf23ebf6fd053bf285d62670c275

SHA256
e1f50565230aeabeac781760e324568fb97759f7ea20829fd04e6a34ddd2263d

SHA512
d14333beb0fa6cf1953085023f8e571b75013d4e8d7dcfd0931c479c18168800baac70dfd00dd8f40c102864717892e65db52a6234dc68901daf72668c20a94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
279264e49382415214d3803a79f0a3a1

SHA1
16673403d18857d1056dfd17427613586ee55517

SHA256
c45a19f3fdf62916935ccfb49e8ced9eeca3c2d71b6c634c450d46efec142bd3

SHA512
09be3ea067a261c0a95e04f7e39400eb1f0e8083cb0bae5cf988b8bc1fbca356e2b8971d9782d5c6410aed95bf905488407a00a85a1c4c80f1a8dbe558151291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
14849a2a55e7a6e8e61d0b9bfaec8c8d

SHA1
13579de09e995c70bf40b04c5d567bde99b0ae97

SHA256
0ef4924d352298405e48c36ad009feaa8369648b58d479553b709aac841235cf

SHA512
f387932446beeafaa5e11b5f1c5c6732b49591c6c4a637a430d3d1e1257369beae9e7cd586e8ac528545960df747ab88a13a3a66fc0a77733944c9894b301149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
cf0f90b67f5d194814ca1fd14cb0de97

SHA1
f9b67606906b2cdb78fad3d8682cc04c4e7ff88b

SHA256
dad136b73b59a81cf193aa1146bd50c1b3ebaf49db9f9e6e22949a85656cab0e

SHA512
6109a62257bac1cce2d421d389c223b0203bc89dc5bb2004b3ee6f30f9026b9478aace78cef1ac84936d6efdcd6f451b809f7046ea1de82eb769ac856fa5e8ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
c02cb139c316e117b589bfb45f508a34

SHA1
b4b131be96eb66a2d3e9b8615618141c2baca487

SHA256
c813883755d187bf25f4acdb9a3b1d66e7afb38d6e48cd90e7c8bde367958737

SHA512
e626473179e736807c9006c2a9c1f5d7a19e0f6b129c63d31f59b3bb0f4120bf91033ba538490a2a5362ac7e2b35933847308cf0c00809818e21727195cb4868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
f34ccbdc55740c7d1a3ac02233bfac33

SHA1
61da58cf2ac6cbe3e8f385e35bde6f354274a42e

SHA256
57a81f7344f597b3218fd2399f9e2069a7de76bc44b6b3c00eb7b0726666bb33

SHA512
47f8bc5e98e85f9d6493e82d0cf60f483b6854441361d3bd4b9529d7f49dbf4335e9a816b9b95082e52958066b094e8a6912e85d394b84344d18243bd36fc6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5850da.TMP

Filesize
204B

MD5
1fe85c5ddb09a3f304a9fbd12bf3e92c

SHA1
4bd5cb0ec1a3d42120874448ac203994dabde67d

SHA256
17e4022e31c832ce186709c0886f20b9f68b31063a955581655ad37b7460de40

SHA512
806ef18b9ddddb035858c6b721c96980f6684febef37cb8b93f76bcd5d7009a28bb6c5c8408ed938a41fe543a34df901700a61faa9d44d562d9f9b9809acc506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\35178f6b-95f4-4387-ad4d-576c77c183ec\0

Filesize
12.2MB

MD5
a68c59f278c9bdd1cae18e744da3c797

SHA1
203651e6754afb03950794929b85f08195c37b51

SHA256
b365976f72c10cd74f9d0af32859fee700b558d75e3e836e560da4d7e6d65cfb

SHA512
6d224ddab9dab1cbf22cf5c8a66718219612d06b48a076e1e1017941b42b39be804a5e3e201f0e5d0d48f831f477fbe0675b3c84426eb5d313768a52170d1e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d04c23e4702d1d267c0009c54c29b5a

SHA1
cf3c2f66015a16ba952c7b6258e6f75c1fef3edb

SHA256
78f0c653fdea9cbf1ef9c0b77c644e73402a26f74edd4e875a7ea92bad6b61df

SHA512
335b0cfca1a80c59e5c4b624d2c944dcfc117c5c896f03104c2fbadba63d1e744b642bcb5f93f0e1236f288d8c69863175b690b7fc07d90ec5e766a64b75a73a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a19aac141228c8e042981769d6e0b12c

SHA1
db84853829ebb596fe9e79d98c28b0ddddd2e023

SHA256
07c3c2a2228b1fe2ebdf198c489a4c8ae69db6901c8bb7fe01c8372f89ee4f00

SHA512
37fc439df095e4f13620c0b8bf21e878925f16045ad1d083d1cb560fcb67419d7192b5571d9083fd51f1ea95d7fcc6c4d2966e1fa149ac89b78aed5024b25956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e86d9f51-5529-48be-bcdd-419c71fe41d5.tmp

Filesize
11KB

MD5
2d66494b60daed59870fda7576fb9b43

SHA1
5141738c13657e569f8b70402ca3eaeac6d531a8

SHA256
1f359a39b4b1ffe2cd0b95e603f6a87a665b94d7c80656f00b4bc81c2734e66f

SHA512
28748ff294b0210aaad642b2d5fcdbdf4eca9cebdd2dc6d638616728bd380434be0c467fc45915f71c5d8f2601f9e59af790ea4f16c2336b7e96c45f7c96df22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy8A66.tmp\BrandingURL.dll

Filesize
4KB

MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy8A66.tmp\LangDLL.dll

Filesize
5KB

MD5
b21a3377e66b941df6d5b7cf8ba7a43a

SHA1
e7ed27fce2db9cdc11ca3c640806731dcef3864a

SHA256
ba46a03088f690ce966043f49761ff3a3a0dca236160794de841dfecc3588d1e

SHA512
f011a824c0ff7f87c6da112898f4afc87e12c5b39fb40ffcc0955012e79a4302597d892224b3b47e8143480605c73275d3799d6d2000cdf179c2912241f86916

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy8A66.tmp\System.dll

Filesize
12KB

MD5
792b6f86e296d3904285b2bf67ccd7e0

SHA1
966b16f84697552747e0ddd19a4ba8ab5083af31

SHA256
c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

SHA512
97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy8A66.tmp\modern-wizard.bmp

Filesize
201KB

MD5
4912001f1bf2f53fb748c1455438c935

SHA1
e11c36c9f013c1b47be9e8d217e1ab33a12b2768

SHA256
0e6ef99ae0596ce282cb46138b8fb48c55620164f2b74b588cb66936d3ba3aa1

SHA512
42396d1a061e2af67af219e3b648e9633d5f245f72585acde0da8ca7b3733bf6cc774546b8a1af041dc6a8705caa3a31732b683b140491a433d241dbdf8ff4bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy8A66.tmp\nsDialogs.dll

Filesize
9KB

MD5
f5b0c649b0cfc103fb113d013d48cacb

SHA1
f89286966000cb053b7e94100c76ec6d1129af07

SHA256
a87bd092fa5bc00661525455b9f866b68c14c29224520c4e38f56f47234cfc1e

SHA512
e184101a03ee1c8896efb0029a02a23e46d422bc0f250ef15349c8214d44156afe2b5f739d8a2339bc2d1c05984fc55651c36c71897cd4b14f41dd37a25cfb01

Download Submit
memory/848-570-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-564-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-571-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-567-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-566-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-562-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-563-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-559-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-565-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-561-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-560-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-569-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-568-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-572-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-573-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/848-558-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/3232-528-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-532-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-533-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-534-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-538-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-543-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-542-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-539-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-540-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-535-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-536-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-531-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-530-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-529-0x0000000007AA0000-0x0000000007AB0000-memory.dmp

Filesize
64KB

Download
memory/3232-524-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download