hxxps://www[.]mediafire[.]com/file/fusjlp6exkaw4f8/exe2[.]5unplannedrelease[.]rar/file

Resubmissions

08-06-2024 23:33

240608-3kbv3sah26 7

08-06-2024 20:18

240608-y29q8aff8x 10

Analysis

max time kernel
1050s
max time network
1047s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/fusjlp6exkaw4f8/exe2.5unplannedrelease.rar/file

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Sonic.exe

pid process

4436 Sonic.exe

Loads dropped DLL 62 IoCs

Processes:

Sonic.exe

pid	process
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe
4436	Sonic.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 11 IoCs

Processes:

msedge.exeSonic.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096\shell\open	Sonic.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{4D0B6D67-4625-4AAC-8729-77D93C224FA2}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096\shell	Sonic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096\shell\open\command\ = "C:\\Users\\Admin\\Downloads\\exe2.5unplannedrelease\\bin\\Sonic.exe"	Sonic.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096	Sonic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096\ = "URL:Run game 871508441317933096 protocol"	Sonic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096\URL Protocol	Sonic.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096\DefaultIcon	Sonic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\exe2.5unplannedrelease\\bin\\Sonic.exe"	Sonic.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\discord-871508441317933096\shell\open\command	Sonic.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3516	msedge.exe
3516	msedge.exe
4100	msedge.exe
4100	msedge.exe
6872	identity_helper.exe
6872	identity_helper.exe
6484	msedge.exe
6484	msedge.exe
6484	msedge.exe
6484	msedge.exe
6096	msedge.exe
6096	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

6852 OpenWith.exe

pid	process
6852	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

Processes:

msedge.exe

pid	process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7zG.exeAUDIODG.EXE

description	pid	process
Token: SeRestorePrivilege	1644	7zG.exe
Token: 35	1644	7zG.exe
Token: SeSecurityPrivilege	1644	7zG.exe
Token: SeSecurityPrivilege	1644	7zG.exe
Token: 33	6908	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6908	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Sonic.exeOpenWith.exe

pid process

4436 Sonic.exe
6852 OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4100 wrote to memory of 1052	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1052	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 4596	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 3516	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 3516	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe
PID 4100 wrote to memory of 1788	4100	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/fusjlp6exkaw4f8/exe2.5unplannedrelease.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd092d46f8,0x7ffd092d4708,0x7ffd092d4718
2⤵
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
2⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
2⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
2⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
2⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
2⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
2⤵
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
2⤵
PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
2⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
2⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
2⤵
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:1
2⤵
PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1
2⤵
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1
2⤵
PID:5296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:1
2⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6632 /prefetch:8
2⤵
PID:6056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
2⤵
PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9304 /prefetch:1
2⤵
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9524 /prefetch:1
2⤵
PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9712 /prefetch:1
2⤵
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
2⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9864 /prefetch:1
2⤵
PID:6196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10444 /prefetch:1
2⤵
PID:6284

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10696 /prefetch:8
2⤵
PID:6388

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10696 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10248 /prefetch:1
2⤵
PID:6884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10280 /prefetch:1
2⤵
PID:6892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10268 /prefetch:1
2⤵
PID:6900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10296 /prefetch:1
2⤵
PID:6908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
2⤵
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10372 /prefetch:1
2⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9552 /prefetch:1
2⤵
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9748 /prefetch:1
2⤵
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9476 /prefetch:1
2⤵
PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8556 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10956 /prefetch:1
2⤵
PID:6744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,2565916563209112384,17366819657658045606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11048 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1448

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\exe2.5unplannedrelease\" -spe -an -ai#7zMap10199:106:7zEvent13990
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\Sonic.exe
"C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\Sonic.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x4bc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6908

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
19KB

MD5
e78f9f9e3c27e7c593b4355a84d7f65a

SHA1
562ce4ba516712d05ed293f34385d18f7138c904

SHA256
75488ac5677083f252c43009f026c2ec023ac4da3e65c5d7a084742e32abce3d

SHA512
05f9fbbd59c286024b3ad49961c4e0eaa1abcf36ed29a1d07ea73d2b057075d46fbfdda56f135145f942bd0c3d48246c73be1771c21861eec4ddf8bbc365a286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
62KB

MD5
42d9fcc7172456834d9e05605cfb999f

SHA1
d1df0982a953011482b7cc5e97803a5fae290ba7

SHA256
5029f1471e648ecdf5518199b5d7a6fdcf2dab7b9ba8367331b0836de3064575

SHA512
5fc471dfd6cf0516739b40db211b4f1e0d3e27e7b53eb1e0c8d34f7ddf5d09ff520bd4c3b7baca993857fd462f184621391fed363a548bc7b50eee3b7ef6ade8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
31KB

MD5
60140bc834da90837a9a4d1530484677

SHA1
d99868b0693b332681b4db7927f3f11b3ed37607

SHA256
29c0ba2fb11f5bbedff938e0d0a97da59f725cd153bc0c04f052419e779f134e

SHA512
448ddc49ab5128dfc0dc91ebe388d447e748848cd2f7dc15fe1fd0380a5436cc9872c32606d9d161d3648b20bff5eda0e48e8fb77c9293f3c0924ae89589eb37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
512KB

MD5
ddcffefac58f205ea194e1612e7c22a7

SHA1
4db6276eccafc0030490f970824b55dc327bfebd

SHA256
5f12968474e2995c485a2c256a9819dde04e78b6a13aacadfba935ed7970234a

SHA512
4b8561f2bbc596382e9c22515354b94df9613844a2c6b6736dd7c1f6c51305e235c58160d8e5b3d6f5fa289dc55f6fd675332e4a13d07fd35282d61e227adc13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
64KB

MD5
8b37bb42b1577b08892393df19f534c8

SHA1
e12eaa944bff9ccd0687ac54811a3ada4a5d21e9

SHA256
6cc9e87df3ba27d6dd288a0593a4f70a17ecb0bf5cac0a591ff72f355a9f454b

SHA512
9dba0d070832cecab4c2aa922bd07395b7493845926a5bed5c5f86d61c3b2fff1f6fa12069b7b7abe4f15cd58775ffa238aa36c47e100d7ca544abb3bc1a29b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1818766855c52d2b_0

Filesize
278B

MD5
91a530cd3033000d5b251a49bbc4b98a

SHA1
aeb24abb19c94174965eec3c2b14df288dd9e1c8

SHA256
8ec87f93afa0b66808bb394d199648ef03e1c384c08a076474ccd005948b7e8c

SHA512
3c14426483a105ec3e2c0e1f3c7d4ba4f67f6929d1a38120aadcca6c942ed77ec48527a860c8d080c9180be103b02ce94d02000c110c8ead60b15a46c0ec8402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\80c12aa6387d1e99_0

Filesize
268B

MD5
603940dbcab40161175bdd30dbf65ddc

SHA1
4c11ba48c45f95777f4de5751a3f2a92917aaaeb

SHA256
c69d40b7674621186ae05dd2797fd7d8e6ad8c6e7d73eca692585f2edf6ee432

SHA512
35ba5023333dbded73f9cd4c039285f3b6734376a72ae9083a1394f1a691bc32425a78dc9e5aa7877f7330e7f4583f15712c173f2eaf288e80312a95a2f39f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\84248572a7faa147_0

Filesize
10KB

MD5
90ccfacbbf9a18fb0eaf03003ed9f23c

SHA1
b6cd24559e1b81a516a4c6e9af272a0d1012330e

SHA256
a5af501c5ab72a93f26aec1374b848c772a5554828a1e799a04ad023a0d3ebcd

SHA512
71cafaff333bc88a1bbf84e0986ad7d935bc3433f645770e305afff5d519d472fd8211f66a27b5c0a028c12f189cbe8ef7f2c6224baf9734c57de6de13b9266c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa26c3b35cdffbc1_0

Filesize
99KB

MD5
19b341b4ad05d15c61fa5375fea03386

SHA1
406de2e4a73f88c84a3639f4462c86e52e352843

SHA256
285148e952d9332e2705fcf7b51787ab29883efb52780514a630dcda459499d0

SHA512
7b6358ded83d097f356cdd334507477ed2310ae1a151d8399a68241858c11323171df4d8c55305351a0c2e507c118896deac3b95e2dbdde635049f7461c95c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b4e38e997e01b65f_0

Filesize
21KB

MD5
a74e37c77be799518bb0d044f65858ee

SHA1
8c921b8daf3c6e98abd4968a5f9e52126d6f8dbd

SHA256
e1cab637fdb2d91ae8bdb2e19a13d094e2b9140357fe8893df29828e2124e0b2

SHA512
1699908dfb4a4584ffc4d5a2e4715e1dac732d7211ed675c3976052b0b825cd08b150ce8c37c5f1de10d5899006e8fbd08cf60390fd964686e92e3d1f739b988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c937f2a67726d62f_0

Filesize
328KB

MD5
bb0af8f78d82c4ddfdc4d8fcb48a10b4

SHA1
bb11999f8ff5609470b29f721e9966c4cd543337

SHA256
8782411014bf0ecd9fbfaf3791f975c380a5a8b1826951cb76679edfbbb6236d

SHA512
9cfea1e580388afeaa3df8773db5c7da7f80a24538f99cb5513705ee83b35521b2b5d35682e24a23643d691ff84ef31c962c4edc19964c5fe7facfd34d974182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cc848422696cad46_0

Filesize
54KB

MD5
a8a69594628ad19b29c4206aa2b48f7f

SHA1
e96ffe62f67204121565765ed3021544f2973267

SHA256
065db9e7cbca24032a5f6c3578c8e51acab3a5b49e44d6f9e46dd524321b6d8c

SHA512
7b1087394a73155f50b6b5d7eddce656e9f0e0f88919fdf3bcd27547a7fd5256a6948a3e7a43a92c6b71c5f370436f5d985215101609648176ec67024928b7b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
39394cbbebf295dce937c6aed2e210d6

SHA1
6b44a5a4e711e5d43e84dc9c3ba00067369ae052

SHA256
47468a257d6b81e48805fcb475600e967b49650ef820f80776445882cecef1ed

SHA512
8ef71b69f007b6817e49baf22354270642211b04e87f694933a3c0c56aef74317973631e614e516a450c3be564c924141deac64fe7d45bb170308e5ff45f1401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a54344129e22107c1442fb74002f9785

SHA1
bdbdcb3fd942beb63a597967f2e4408d35ccfd86

SHA256
a7b252e7936bfb1c2cf0fa2f460223a3b3417d379ab2f894aadf3e268f67f257

SHA512
2961ab5b6b4888a8b493f4ebb94d9f3d8346bb32fb70b2b1fb83295c340601c8fb4857f8cc88f2ff93fd9b1bc79c88966bf3f9cee437de73491a5c4be3a8ed2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d6c6f13f16ec9f180e5c75a3ac6e830c

SHA1
833f2694d4ff2d1eada320134be7e08f77bc4a85

SHA256
cd3932897a862632b0bcfc6db7c5bcaa42cdfabdb42557f0aa73f978ca698ecf

SHA512
96cef6273e16d78e30e1432207810975725f32dbc7ccbc9b8b565b49fd307e3aa93ad327ff57818f6bfc318845b9b1cb77c891c0825968442d0929a5112c6af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3fbaad8efb03bc254b358d6c3f78ebbf

SHA1
cd08e565df4f0b787d07946839bd52a25abda234

SHA256
3d914dff6d18b2aa1bc3e9115a77602559eb0adbead6f29717e1a3457797f091

SHA512
d0a234e91ec453402f1c8af498932b95cbecdd1d36cdb68d23ea12efce9af27f1326676b9d9c33f1e53ee0c40f36355a2701c219814f755302a6ac7e0e901d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0931d07f9cd540208a553b9ed498488c

SHA1
0ae7d9859a3410c2b36ef3adab75387e79dc83aa

SHA256
5f4c02392373c710e1b04310dd186c1975bce5275efd92e9677ff7527f1b1394

SHA512
ee7dc7a6ad5ce7a616a376b44d4409ae3ef89f1c87c9904202b8d9445b5e90c7680edc937185b80c040e95ceddbe405df17927f5b5bdf8143b1390ed8cbbc14c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
42257302fa62d9198443e51bf01db417

SHA1
c823ee1587e94f0c8c649b8b66c5afa2df070530

SHA256
ed8d28668d93b3e63da4ada55b7c3c9435856ec5b5dfb6d1e9184c71abc0ff46

SHA512
988116c2d71ffbdd9d24f63912f68d5c85d3f88241eab79450c2bf6da36f0747d3a0e151cf28408c4f0550a51c3af6f8be6965aea284da2ac2cdc46b951f51b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3727244eee611989756c3de919f4e752

SHA1
9b9c6fdf123c909b0c4cd37873ad800a41443961

SHA256
f4a6c70f7f138b03eae8bae0952395f7595fb297f8a9fa2523686893fffb7b19

SHA512
68e22be0f6853dbecd9783f34e57071757d3fb7b9265c5557a82a9461a618dcf2653fb1a1d7d921cd00568f5df2c1eed2cd91ebeb5bf7682d7e75c010a97e79b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
a147f568308a00f874c7ac7c5d0f88f7

SHA1
00228ff64068acc0ce7643adaf59df650139ec50

SHA256
272f346f95a67e82933062dc0d9ee97eb5c57d44b08182c5b82545937aff5efd

SHA512
94537bde27ac2387143a43d3c14dedaee52eacd4ffe5b9851bc3734bd9a70c1832e3cb87f7315616e5f43d23eaeefa916949a6290fd89c15c0bb91dad6b49355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
a6b4219921812a2cd9f9e6ad7dbdbb6d

SHA1
8ec83b723a672e6589954f7c7c6a606034cee96f

SHA256
94df202eb2cb60062137e0c8517b3a78ed0719ff76c6400b0a5152c6216c1dab

SHA512
dcb21ec01e8ef6517023d00cc2193c2124f38417ef0f84db61dd5e0e81e9e43ffbb70fb6cd6a9029089e1bae6ecae141184cb7a28d87eb3722ec1915a3c33f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
4497c4e7f8a5077b940564a3d2877875

SHA1
1bdde87c95627b38bd072a8bbc4ec010711a3c00

SHA256
8f3965b642a0ff4f8ca96b816f80576de2ff591eeed60c65404f791d10a1c777

SHA512
1cee5c88c1f2938280af6c5207dea4b57968b491a9d0467bed5cebe0d40bb5fd98b61bcdd81aeec2152c428564694385e7f7bd5dc073616abe0f297a3e199e95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5f172dabc414baebd08e75810af7938d

SHA1
573f72361e94f21831fb1e909c89738b9c7f0c68

SHA256
83cc0657753c183a1641ff53c3574df48028ea3ec28f5e25302e4478709342e9

SHA512
6152b8ec3e0d3607cff22809313d2da8dc0bfbda78e8c97d22439f4941ccdda6ed33372b0950a1821e4ba56daa4a294a459f46fc3ec6032c738fe4bb25ce7833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
078f592557ed1765ffce646b6a5c9b41

SHA1
76e463cf1323b0b696a8c08d94a650e5c332f3f6

SHA256
772c85ace87d1668cbd0b6a7b35759720de0f80cb01110da5c9a358ee743ba2b

SHA512
cff0ccfcf6c690b9a01cfeec0112c1284c1bb144ebfb3046f4c32922010f99a4ddff8db33c578f95919f881c589dba996e83cce60d64650feabb9da0ca0a2eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
6b346cdbeb4c1d7f1a1387736472494d

SHA1
0c0c2e29e6d84a70b2e856e714a722d393ddf49f

SHA256
1bff46600213b5e561a91e2c704544c4e875d60f9323c50091a8a586b99d93ba

SHA512
183807f3deb3a44ac180d72f7f00cec7b5fb1c829fbc1fe0e8da1fec4a5ca8486c1744a3dc9627220b3e3498a8d4ea25cd4cbd2d17d6df304640d35534113751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f6ed467ecb692c6c0222ba5f2539d451

SHA1
7bc4fe1e7652aed3241610e6edfc0584b31bbfef

SHA256
ed386b576ce0df27e1d9aec8700e423708c4b888e6b8dd02a807256e1323416b

SHA512
8a570ea1709de3fbab4f3bcfb350addc77a4b6e6beac55556f671bf793a68d57b595474a0465f832a656a735130b929c9028342695bca490d0afdfbcf8a09e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
458f7b4396a77e447a2a62a8dad0626d

SHA1
f8975ae4e368260eba6f803a26f1fd22734e03fb

SHA256
d708d5e0f58d11a3e116377fb6417b403832c70574457c1e6e867cf82b5e6c88

SHA512
0f1202c6be763795f1ed337d081505d7565516e0e9ff93202e31f730b2be6843f6128c281c52dff06f8ef6f3e6f3d93709c000137676f949cb56f93484363b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1d1ed2a49e76de54ceaca88ee433b8a4

SHA1
540c805e7bb04bde67d2bbb35b32418c4fe5c36f

SHA256
317a2870d9a3676c04a9adf5767903a262c43a6f15c7c27e42624ee248d3bdff

SHA512
f7b3d7893296a605a18dc690fa2a30c01772f84008f4f7fb1c717cb6a49c12ec8f668d9ea0c8c450de335147bdb99da99f6df98224c34bd94d0260f5435bd43c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ffaaec0215386478b465723b8f08f5ed

SHA1
a7a20e3ebacee0fe973d7ded748183aa889f2cc2

SHA256
ff09543ab62642900975f16888d3f62e8a8578081929babd83a04ec1dce84942

SHA512
df5d4f0f86af9d89240602f0a1b6fca8c0e58c9c4f8c7beaa78918f6254f9be9d935a6bed2b6ff184f765c9bade7d7b902f0ebc0ecff938cd7c34c600bdd1d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
487df9cec97226184a2ef722ac2451ef

SHA1
798f1e9de4f2674246f64c112fdb9dc39a7121dc

SHA256
53596f6426ba8d92ef11ed802420ba0234137e603de4c1f1baefa251f930a0a7

SHA512
fe6b61f4b09c439edfa3ddad9ee74a619410a1c0e239225294b459e5f41c562324b649d89e66705dcce5324d4ff8f7f28c7fb2bb1a04989e338396652882b8c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5506a83ed62c86892e07e348b83db675

SHA1
1965f57f9ab9ddadfc8acb98128990cea7a89138

SHA256
ec742b43b81650c7e7ef1c4bf6b05e2c743cf164196b40e23c19e995a223fea8

SHA512
601ae3dc2eb84013d0c3143e88db947c937018a275fd187204774c3e91ec258348e092738b5fe6c5f8d0cddd8d97383cab42036612afced2ea62a27d962e2062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
259d2df59f75b097ab61b318ff825ba6

SHA1
85be8c45907119b2bb9fd7c3bfe81fc4d2f0bd0b

SHA256
d89b3f7f8401eab3cc49b848950a78e95794a4d34e3854ea9f93588fc0a862f9

SHA512
786cd4a7855df8c84a5dd87a2749d5c2d81c554068099b7555c1c094d80f322a5494b5661ceb7b2b294665249ed3aa2cdc46d2eea045d6cdd6f6a67fd887680a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ca975592e277f2bddaab9a53cd9a612b

SHA1
8802640466184b45301166cfa64cf77436240982

SHA256
229d93cfb140d890367f8bce4980823bb736f126de405d451298f7064b698ef0

SHA512
03f5a464927a7c2eff8de29d53aaa7f95380bf4cff90df24b27ddc6364913f270f95c781901994f9b25145db3efe0052130003212478f1a07a4b6b8a21cc43a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c09baa41ab64d97b68cb56ecba9c92b8

SHA1
3c782bb293a6ecf0007a61a84fc8bf87a6f820c2

SHA256
720dcec741daa1378eeeea6e92d310c46fb8b37a476fe631970e0e2150090909

SHA512
41baad099881a5f60e7fa7638e56271a324ad2c3f57e2b92e3e2647e84b0cd74221060d6c06d684fb4eec911f3d818105711fe6131bd7bf688d55d619872149b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b15e.TMP

Filesize
3KB

MD5
9a4586f1aa52f9d717006ba14c4d1165

SHA1
db3b3b8b46ff17fa11940606f1c57fe69b8f15a2

SHA256
af92890123d2cc0a05c38ca2805c08a814bc9427642f23503060ff5d67647f3c

SHA512
6fbce06c38795cafb78f8b143057f737e47c257450b33632d524b579cf999f5e3097b4cdbbb1148134f095ac75ded23da601c5a6737fc306a9219e73a2769181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7e98f2e4b9d8c65fcb32bf29a513a891

SHA1
1330202421a01cf280f36f948e7e07d2bb491a32

SHA256
ea5206629cfd5b7b21e27f8e665d8533adf30f44b276840822a61a9f362615bb

SHA512
8b7095a5b3483f4a5951e9912c13079117f11d0dcc2b8bb2df1204e9a4f72ba9cfa5bef895d17db355ec7189e9a0a527163789565a3e2fa2aa258985a6d1ca42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f93b6be1ef45132e7b49d0f6a9db900a

SHA1
2aeaf9f3a93e3719d9d60e62f7d8859c48d5f23f

SHA256
d2ef30b53c0918fdeb842d275da42bdf000d1f221dde9507ac31cdfa36bab60e

SHA512
9af6d58ac27cea84f8cdb1ec4e8f36d0a2bb063b9696568c5894acb4b0353386d65bff806c1e13bb9056c0f94aad0a527eb922e88a1a708ea3ee90ef8921a0d1

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\Sonic.exe

Filesize
17.0MB

MD5
f51a1ff7f49a576881e2558315c49621

SHA1
44fc9678a62f9a802b9ec48a8c224d7d547aedaa

SHA256
8074efd9c9ebc8d9eb9142c7ee5d755f46ad1a5725229747251e4f1df872aa2b

SHA512
71c23c368764d369519e49e1c8418af902cf20763c7587a07c8c09a41bf41da56474ca5dd78ec55b203b8bb1df4b1a86c4c113c82a56acb1fd56c94d60cd10ad

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\characters\tailsdoll_alt.json

Filesize
5KB

MD5
3247c2d0667e776a0c388ff8ae4720fd

SHA1
9ffa208491845908ec60aa0b92d168630fbbd517

SHA256
57ee49305815fa00b3eb757561193a21592114f695e9addba7d38f43610b16df

SHA512
a7c9ce9488598ba274b0a638e3e1703e82c18bb65d92f37c735ad518660ed3eeed35533dd11151ae817de651839b4a8f5dd6cfd7aacb4c807c2a8a0338045e4d

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\exe\images\LordXStage\hills2.png

Filesize
769KB

MD5
e93e5e6958f0d2341d69afcf70308a0d

SHA1
90ce65436bc944196fc65cc958541f302202fdba

SHA256
4adb23c68f189fe688e8f1dc83ef00d32dc2dc18255f690e82f709317adf31c9

SHA512
a07b0ce212a0ddd2d1a4cc02a4825939ed0927a1597d8d71620aa4aea61557faaed6008aa49c62f257a32335dcaa2d9d8eef2fae89a10cd23cc30afc13632a25

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\exe\images\LordXStage\smallflower.png

Filesize
260KB

MD5
896270cb8ce7e2f3c6e5cbe22efd809f

SHA1
ae2bca1916083d07c23770ec02858dbbb5731157

SHA256
87cac195877e01a5c1e8947575b8028afc3906bc1822f80e3ea663ca3f47c67f

SHA512
ab5a573fefb65c3da15c0f8558b730d8e889e8c271429bf1e5ebc3b67a9174178b558b56366cfc9741d4876c53c90adbf543fe2bc058c8d59494a85a5cabade4

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\exe\images\PolishedP1\DeadTailz1.png

Filesize
52KB

MD5
1699e454acf35267f505462d006d0460

SHA1
2c6ab9b645757e5d50f97da88930635e672aab18

SHA256
4fb704626736fe533ee268c853741e0538d402daf9de437125c419bd2e3db29c

SHA512
ebdbf41cd3f0fe886fb438e665aff60edeeb4439b9390c914368630dba2a9fc834b80a8abe2e56cd383286fc8c1792ce3ccc3f91177ae1c1a5684f4bdb3fb54e

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\exe\images\needlemouse\ruins.png

Filesize
38KB

MD5
89c14943ea1a564fb47b7b10b2b758cc

SHA1
ef13faf69f3507919bb6ca1753e42f236f0f2c08

SHA256
694bb94f60b739946f39843692da8d1454b99783bcbcfba93a1c0b19f8a9d024

SHA512
76ce4b7656e6225082ad2d4ae07bb1cae56f7d565c7f2bb43791cb5062ee5fd2f04d5107a64c575927e026870efc416875924f54a6c8f6d4613ff945f8a718f3

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\exe\images\run\Grass.png

Filesize
175KB

MD5
0377d94b57ef628bc66ea0a28361d40a

SHA1
8e6cad3e25ca44eb82a90f6f0a25978f4f7115bf

SHA256
444e8f00b61c81387ce283445da00ab67ed6b6b0457491d431f0a969bd5d4321

SHA512
9a8dd66c0f693aa05d989f9a9c81e3b4f5c907a8cb3a03cf3bf0d0ad7766ba81d7611db12dbcdce2924513d145ab44fc61411fb3e3602ac9fea9731e0582754e

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\images\NewTitleMenuBG.png

Filesize
2.5MB

MD5
f06ef06eb31362f4129f4bec0a08f623

SHA1
388c5b411bc2b74e6d7a8d68481848b8b06892a7

SHA256
0894eac542973479e1d89b5118791786f0f069b2a11fe6a440ef2e0e2df230ca

SHA512
931394dabadaa903ec8fc30e1871d547a6de92559bec3bde7b9d93e494c99f62011addd206477a58540e1e4f47ee131bde19bc3175239699640be6b0c87679b1

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\images\NewTitleMenuBG.xml

Filesize
1KB

MD5
d1b8a952c3ca3019eac82707c5dd97ea

SHA1
20c4d69dbc1a103251c97a418f2906d40268d5b3

SHA256
7b0f3cc8bf70b4040171dbccd5cacd18a7a9e70a83e6d431fb32cb6ea2f88be5

SHA512
f3f03a857fdff5dedcf6f2fb0e6c6cc1067da60fa7fddde59fecdf255ca3254cac3d4737e13db9ebc0755a6e11002dd30c45a543c3d3878f801955adf61c68c2

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\images\pixelUI\week6.png

Filesize
4KB

MD5
84c28b179f3bd22f3a6c35be24f838ff

SHA1
b3fada2b74adef160ddba44c8f692999d1b90277

SHA256
6266c996de59ee3884bf8105a0f695325e30ebff4c45ae7f2b1df5663dc1b58f

SHA512
987e4c899a32a438ece09db752fc589ceb254b09c0cc8c00d670853bd786653f157916ebefd2f6cdf2a616f6282017dc0a37706f33be63481e2916a91a3f4568

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\images\pixelUI\week6ENDS.png

Filesize
357B

MD5
73a787ad8daacc6e4aed1c5b9b036fbd

SHA1
cc66a5f9024c0ec1bd24bd213e5f6d811180b753

SHA256
3bbb775dd4158cf80828ca227c7422a2f0fc0402d624d24fa11a696c713ee4e1

SHA512
f6e77855d0a912ffb88d5be6cb7a0c3501029c67bd81cbcb2205e1287f0d523f30facc86a9a9ec46c6095a70f388e92bb1fcf55be88320dadbc18cd70c4ac23c

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\shared\images\white.png

Filesize
10KB

MD5
99824404f50654ecf0457b146bbb2442

SHA1
2485d78aee3e43dd9615f39f0be739bf76ebdca3

SHA256
6e8835778b5ae9c95b698d9a6173cd6b56076417a1372d665fe46f069e10b070

SHA512
71ba4bf803e8ef938147b174c8fca3c0b93bba59514ee0f5e9091589cffd3feffc99819538afaee66ddff5ab01bb6f1bda322f4fa98af277039705d8139610b6

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\shared\sounds\laser_moment.ogg

Filesize
31KB

MD5
af14ee0cef3c960504ff3461b9f71f9f

SHA1
5a63b94240f2fa74eb249260f01cf01f07d87c6b

SHA256
389f16f3ae7016885af4b89aaca07310d7856f5bb3076810a784bf6d8fb1d516

SHA512
9d8e52727bba79d0d0cd664a2710b6dacf82e5e59712f0ed942accc430358d438fdb53bc8ee26fa6f2c962945dd4cb722091e6d5e0dedf01fba671f3e7828bfc

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\SUPERBF.ogg

Filesize
27KB

MD5
ba9ab57158bfd62237177326c9e10c19

SHA1
7536d7033af85a02364334a151f387285e3098c5

SHA256
87c7a9571cacfdf34ad73558d05075db5bb67e5b73f3592b45a98ac4620b4359

SHA512
02d6709cf89872b3eed8905638c017f377933735588c3246dc696d79ab962b2e229eb56e19483502646e08b2f47e2e4caa72f4b8aabd6915054357aa2dbb20b6

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\beam.ogg

Filesize
60KB

MD5
7312054484f6d90950ba1e0fc46142c9

SHA1
732385ce2ed0cc94538e142b092c188b4a8f90ae

SHA256
6aad50d776ac3996b96eacd1413d471f1003e65581cf2547cb695f4c6d3b49f3

SHA512
990ce5eb57d15b757f8ce969d3f9c5565952f5f76c27667c2e67416779120fb3f213928d3a89605cf6bf84d3f2306005eac8fe0ef1a0c38fa227f0d68cddabc0

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\buildUP.ogg

Filesize
123KB

MD5
d2723c3205fa8899cb0284fd2f47c562

SHA1
47f94ecc38dfd08b995aaeb6a60bac4de6711eb5

SHA256
b4c15c34402423aba4448635e991dd0d8d84329399e824a722f3f70dc3929ba2

SHA512
27bf9f7b6250fb9625117573be45c61c200ffb88b8ea0f7b011c4b2c948989412a974cd7675fff4442a9d304fdb0d8bd43bb953be72147e376cb6f1ce19b75c3

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\datOneSound.ogg

Filesize
32KB

MD5
d4bb0c9571653d14f6c6cd52712a5aab

SHA1
ad2555cd4f2aa00a724d931af6bd3dbe40182782

SHA256
ce5f4be243aac5d61a91fd6badab54178ed8180a6d3e96e3759c642af54412af

SHA512
de106f174f77aa0cbcaa5e3fc00fffb72ddcb727ed56767be13cf51ab58023d50b781e6fbb17cdf78b2c6c4b6e0a1596755e3696d309f32459e23d697d61e756

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\firstLOOK.ogg

Filesize
43KB

MD5
f2e14a95b8909d4e2e4abac55a17e2c3

SHA1
a2e61122fb99857a24d5830c450aef04bc284951

SHA256
aefca919ce1e934e3eee6563146ddcdb3790c8ec5aaad06e78e8a96c66bdddc2

SHA512
1225046df47538a613125df2aa124973ad878615d3ca7a7627e4bb508c4a75ea0519a74e3374d1b830469f04affb7c0017ee6d0c6d7095addf355f76cc2eaf83

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\flatBONK.ogg

Filesize
11KB

MD5
4f7e3d058246abc46d6be8e1d1a0b28a

SHA1
b3d0c395d393a98798fffcbb3182101395cdda09

SHA256
de99fbbfb99cf45f24b65c08f9c2c797a8336d2ed25b77b25298620d1609f9d4

SHA512
af9b3255cf968280418536def57d853b187333050cee223e8e4c30145077268f8c7d3dcd95bf3254f0d8bb627a4553deef717b32e59a26fc7557af41df51148f

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\go.ogg

Filesize
9KB

MD5
de7eddee41cd4a9c4ca2113307cf9596

SHA1
ff1f9230e3c230d3fad44d436fe90dcbb9cb9f13

SHA256
d1ed59117501b24ff8bb9d0f319e6ea3e09dc9791c149c80738fb4510e198fe2

SHA512
ffb35c452a7177765e21ce50d241cb08be7970562f1d19c2501a2ab050e259e310515bff7a8e07082a67e307ae1b235693d1007bde42d647557bd5008406d455

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\jumpscare.ogg

Filesize
90KB

MD5
9e3927d18cf730b116e4a6af36513f68

SHA1
75d8e94343480c578ccad7c1dfaba14228ed2252

SHA256
205b272d4098492c927e1c25fc6fed1a3e06bdb13555b3b24712d70a71abc575

SHA512
ebc45fa1a9c1e387550062a6eb87e73903ea837dbc78e7f4e356d0fe1980a99b96e945d70bbd201dc87985cb3d6cf0e806a1f77eba9a97403120f5cb8a59ece2

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\menulaugh.ogg

Filesize
116KB

MD5
0fc84ec8c9a4aeeb0cfb7120ec3ac327

SHA1
fe80ddfb2deba97d55dea86f3ea43f11a1ee385b

SHA256
349e09e310d69efe849fea8ade36b97fbf3fdc5fe1934ec97b9a195b2fd20c75

SHA512
58a03e857bcb9fa1c54821929e04f4998cd6e90336addd59f0cfadfd3f365f64185fe675b657ec1da5faa1be53fcd3442bc32a8ce64e5e7ddf4bb497fca48b64

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\menumomentclick.ogg

Filesize
134KB

MD5
d4455bdfa7057b992fb12974101c291a

SHA1
a1b380e625538ede9ecbf6651b5623234e985c6d

SHA256
e2a436d267c844147ce8f54666c8938c418046d4cdc347a87a4edeeb0e3b248b

SHA512
0cb06e8785994e119908cfbbf87df6560b97f4a9f7496b6be31beba81daf7d9afa64713ea766f7191f776cf6d451c267125a8d56e85ed780d4039c41585c729e

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\ready.ogg

Filesize
7KB

MD5
cac153702393e88de151a0d7bc889070

SHA1
705436f9dca50d8ad0025689026a73ea42a8059b

SHA256
de7631ca13a4d6f7f213174f0e5faf09c98759a03c78019c3c2c957998923f4e

SHA512
6d8cc1bce77e56e944bc7e0c0281559a7a9c9537ebb2a7511e60b626f5e059aa11358dc7b4730d02071d72b8887282fe81ff7f7a112a9e6f3e9bd24b9c34cdd4

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\robot.ogg

Filesize
27KB

MD5
654da468307b56f3d9063a60954f7d42

SHA1
59dd12289e8572485d198bdbb401d6a2f1a9eb03

SHA256
9b670b36ea904c3dde54aaeb8ec51b3ce29ac05c7941c99935a2b8c14f2c6679

SHA512
05af6759a85caf7c147d839a5b92b0ca5bddbd1db5a6c5c3b5b4c4b3bde933f2d1e7d9f60f95d80f7a3c04c9dadbc7c29de45437e689d33e1ef823613bcd34a3

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\secondLOOK.ogg

Filesize
79KB

MD5
941d4cd3b3d646707c0c92d8a53a4f5d

SHA1
aa3c2631635a402623c5749b6d19d29f79365638

SHA256
2aaeba4fe969426f4a149f4bb4dfd3a874e9d8cfde249f9eac11ebf0544c82bd

SHA512
4f9f00748f37484ca45b98ea4b86626d3fed35eb285f37e542dc478a6c3f4908d8f331aa3c888e1cb800df5630cd2b47f66c2926cf1f7fc960d0894e869e8aaa

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\set.ogg

Filesize
7KB

MD5
a795405c15e1e3bc36dcc412829c906c

SHA1
cf26868472c6694462c5b0320aa6890fc4a95b61

SHA256
a77d096e1f853ee3dbcada5b90c9cf2cd0d2684dbb25a2ae643a440fae868667

SHA512
94e4c3b83d3fd8dc06eb3707e235d527a174a2fb85fed7d7da38f3aa594a8851db0b02aac919913182d436353a02de10906095f8bdfad0259491219f7347d45e

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\simplejumpsound.ogg

Filesize
5KB

MD5
92610858f9ba54ee178741b7ab9b13c5

SHA1
f615db902f34d3ab81ad007a76df6c39a8ba1a5c

SHA256
419271470ec7fdf8e63a3be8e58048e2b5c4ed5b5da1d48e1900ce6532dcca7b

SHA512
0cf0fb780bebaed0750a197c92b41900d08c63aa670b9f86888ce18f481ab88b4e16b0045545b26f3f128ff6bad625621dac78405dade071d6d86a859e03db36

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\sonic.ogg

Filesize
37KB

MD5
ea1d1cad0773db01f8a507ae28ba510d

SHA1
039228384f5e6a4d192acf77814a05443b092ee6

SHA256
7b55788e2417f373d96a3d659fc64d857921f5df0155ad993ddcdca4dfcf623f

SHA512
bd5bf232ac3a45b2264e889c28c79c3babbd5f4df39124fd7b1c10d3b3ee67af94fc54ea4f5b1fabe37d022ee13fd5e83769debceaaf9d0be4e03b858d530b6e

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\assets\sounds\sppok.ogg

Filesize
51KB

MD5
a72efe564370f1c4ceb2bcea9714e60d

SHA1
2de7f73a3a080f72de4e8e1f7766c88da5394b73

SHA256
6ae33465f7c20de564d8acb29aa10e77ea3da2c65fbd1aa320d54a17baba6ac3

SHA512
ec7fab84d8e6d7eddd8bf0b1b225d7ddd217eb49cbaec9eea08d57ecff3c94d8325a3aae83cbbab9ababa5db4829ce69f21dd36340f83c477030719d020bfc6e

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\libvlc.dll

Filesize
116KB

MD5
1aedf215a622eb7b789cdb4902198a71

SHA1
6a8262d663f0a9b7c91cbc70125b6def9aae364e

SHA256
b3718fdade3db2871373b8bc8cd7d876576891a159a9b71fd0ef75bb886a8f2e

SHA512
990d80fcc8cfa6963f4cb9e0697673c4ef7a4def57b466a8955d0a7631aae8af11194d8b81dd02a1486faecb8e2ce1e5470c2b42b7e701cfd369b4895e41cda8

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\libvlccore.dll

Filesize
2.3MB

MD5
ac339261be9024fe5608ef7af9c62269

SHA1
7a70e5a38001b910a1ab0ca43b2a0ec01026eb35

SHA256
f6e848e456917185a58f91eb0b2de116744ba5d8f06deb6c94cd367e42e275ba

SHA512
8ede2696a8397843dc4e4a99a780929b10bce7839f41568e37ea6e5261b846c1e71828f28cfc50538958ff47c57e31cf49de88386287346b0b4106e6d25e3e80

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\lime.ndll

Filesize
7.6MB

MD5
be84895583793267a175cb47de5e35c4

SHA1
128f39acd08e56f846b2149750410df1337ca3bc

SHA256
acccec9e231efb545cd8d7f94c4655c0c4950a9cf8d208f822f2b9112b2f5368

SHA512
6248af44c90a10f70818d552fb4d1285c38afdd6e037d9add099975235abed021877174994fedee6043c5bfac88b086685e014ed0f47b7ed1b91d8a8692801a7

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\manifest\default.json

Filesize
57KB

MD5
201ed86457a5bd121148e85bf7f0fff2

SHA1
caaff02315edd45455f9b6a5848cbc52ecf360aa

SHA256
2f4228d659ddcfc10e5869441d56c479111758cf5afbe8f4559719b87a13f050

SHA512
eb5f557a85ad8db00bcc6802856c0289fcb2818ca9934a7989c0f99451ea7e66ab31e7693e4c82d027d8aad07f1c200aa381a665497ba32dcfac98517c368210

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\manifest\exe.json

Filesize
23KB

MD5
0d48869e189b926b705110e5edbdb8ca

SHA1
05b153a8544d155592264aaf91183c6e0ae50e36

SHA256
c9a4764237cbbfea9feee7d2fd78be74e418d80112e970db41a7effefebdcd9e

SHA512
4fdf74048527e2f6b7e09ceb5832c13469c30281c6aedaf60edf6150cc7ed4bbe69ff4b766b0ef0708fccb1c54e901c76ea97d92cf9eb04f0b59c16104d834c5

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\manifest\shared.json

Filesize
25KB

MD5
ce5050fc10870be20f7d64df31163502

SHA1
55faf67b9b96673a00a075a550da2bca1c8ab628

SHA256
cfe11c540cb9425cf7cda32ba9a585f30c967837469c1b43a0e70f439ff5e159

SHA512
0ab7bf279e2bd14a4a64737973a87f9b2d0531d6487a5af09818cc8a7282732aa747676b114e388bf200b8edfa9e7b6d90512f1a18f775503fb605537ee409eb

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\manifest\songs.json

Filesize
2KB

MD5
6bcfacb5ac2ab8d501998f8deda48272

SHA1
e7a51e7e6aac0a3195d21b8db0cafd6d8cb55f83

SHA256
3ec565b302773d663e21002440357c78b9c120a51f64b84e5b282b0fffc037df

SHA512
9c87379c39c9e1143ffd541c0f090b37b36c1f8b58305cdd82f886545f507f8f1789b275d9c3718732939c1942f8d9ad7e35426dedeb53b96484ad82014a1582

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\manifest\videos.json

Filesize
1KB

MD5
b9654959472cb5c659a186abc44b9468

SHA1
0aa6849539d3e87a114a54721783fe5904403999

SHA256
3561d3bd8e9a59ed46683371d03199658f6432073cf3157375d2d1808090a917

SHA512
d870bb1fcffd1b2c2aad268e974294f229ddce0d4006eefe6455a4e22c9f9d319e513f3f26aa6b478035fb8c0cdbf3a34ad5af4fccbfabfa0bacf9a1c2774862

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\plugins\access\libdshow_plugin.dll

Filesize
259KB

MD5
ad6dd572b5bd520beb957522e80b5d25

SHA1
1e38963697e281052c4d95c52a41e244178b5d19

SHA256
9ff2ad259148c6e09b1bb8cfb2ab3de44b664a0369cf81633369b2928196db1b

SHA512
90f78d7e94c938a22411fa14e4ea8441b7450f64fd64424df9a073b336fc404c2351166ab16b2086425af9b7c1b8ea2e97c1117dab3d70209774f3cb055c7e2d

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\plugins\audio_output\libdirectsound_plugin.dll

Filesize
29KB

MD5
a18e26cd79c51818cbf9c81f1ff89001

SHA1
ed5c8a3bc428f95dc820635c6e6ef2017504ce57

SHA256
91e8b886aa0fce2c4316576b9ec5539146a92e1b0beff7180d1a9b8b51f1efe3

SHA512
e64dcfd6b33c6519fb680cbc1a16e509b44f90bad8a3deaf92a2a28cb80b2720d524a338e18e9013c24c3de9048384f172d8e61b526b9fd5d3f78761431ef0db

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\plugins\audio_output\libwaveout_plugin.dll

Filesize
32KB

MD5
c3616e11f2ce94b998db796ac1dff050

SHA1
d0b889abfbc561395b5de0eae1232fe7b97416bd

SHA256
b79fb9880daecc4056d43fac8e66288416a0ba8c0489757ccc9fed01aba702e3

SHA512
2cccbf758ca5cff518908b96c0b5546f1d4dc4228ecd86db086169f9903a0fa3141cea74c681c854a8fafc0da273833874ceff527d36567a9e0898788b26d738

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\plugins\plugins.dat

Filesize
250KB

MD5
09eda922f1a75ce62fdc5c1eafa3a61d

SHA1
6c41dbaa00f662b8c431e2512023f9710c5e3f97

SHA256
dc6387f1c4036849d818e44501ac885021d39c571b7413ffbb37611a702c1e07

SHA512
a7f0ae179d2ab5cf778e47c1cbf68d08eb7e47f612ea51e22b67f928a1ed1b9c1d28a9ff6afc9b656ec4fac107e75c74f8d98005fa060538dac49990a390eadc

Download Submit
C:\Users\Admin\Downloads\exe2.5unplannedrelease\bin\plugins\video_output\libdirectdraw_plugin.dll

Filesize
70KB

MD5
b70bfa0081e2e309ddd259332462976b

SHA1
b03761852d40427d1942ca818ba8de8dc4f979b7

SHA256
85d96a5f1f78a63cdeeebc4c048a154649673c52f78e27b120ad9e579156f477

SHA512
53ce1c7f300a2425f83e68020ce4a52d765893d109440d51c22a46d6f49c32500a4386305b6069ce7d769def26f7f4b05d37426130f7dcc4bd600fb88adde9db

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
\??\pipe\LOCAL\crashpad_4100_ZQWHZGIATQWOTSVP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4436-3660-0x00000000503D0000-0x00000000503F8000-memory.dmp

Filesize
160KB

Download
memory/4436-3665-0x00000000500C0000-0x00000000500DB000-memory.dmp

Filesize
108KB

Download
memory/4436-3661-0x0000000050170000-0x00000000503CC000-memory.dmp

Filesize
2.4MB

Download
memory/4436-3664-0x00000000500E0000-0x00000000500F2000-memory.dmp

Filesize
72KB

Download
memory/4436-3663-0x0000000050100000-0x0000000050111000-memory.dmp

Filesize
68KB

Download
memory/4436-3662-0x0000000050120000-0x000000005016A000-memory.dmp

Filesize
296KB

Download
memory/4436-3667-0x0000000050170000-0x00000000503CC000-memory.dmp

Filesize
2.4MB

Download