e52da1e4da5cad31d31cf26f45a06ccad45903da3983e4ff5081c151be9abc99

Analysis

max time kernel
550s
max time network
551s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27/06/2024, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

19KB
MD5

afb122ce4bf482346dee48e829e4343b
SHA1

caae7b855f7b481ccb7b45661486f1869179a6d3
SHA256

e52da1e4da5cad31d31cf26f45a06ccad45903da3983e4ff5081c151be9abc99
SHA512

d55251ab563d482afd83aa0c58f49e691ac31ab97138abbd89c0626009b0ea0c1e30fffde2f3589317a125f2422e4b8e3a26b910e3786035cba1817d8df86a88
SSDEEP

384:fX10nqspY1ocy4N4lbGakBvhpNcGmqwK2fa2hOwV0b0cfiHExCJUrI:Nv1ocy4+EaQJpNLmi2hOwSb0KyExXrI

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
3964	launcher.exe
5424	KRInstallExternal.exe
4232	TQMCenter_64.exe
212	KRInstallExternal.exe

Loads dropped DLL 64 IoCs

pid	Process
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
4232	TQMCenter_64.exe
212	KRInstallExternal.exe
212	KRInstallExternal.exe
212	KRInstallExternal.exe
212	KRInstallExternal.exe
212	KRInstallExternal.exe
212	KRInstallExternal.exe
212	KRInstallExternal.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	WutheringWaves-overseas-setup-1.5.3.0.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x000700000001ace5-559.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WutheringWaves-overseas-setup-1.5.3.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	WutheringWaves-overseas-setup-1.5.3.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	WutheringWaves-overseas-setup-1.5.3.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	launcher.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WutheringWaves-overseas-setup-1.5.3.0.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f868411ea8c8da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b4a25b1ea8c8da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	launcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WutheringWaves-overseas-setup-1.5.3.0.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
3964	launcher.exe
5424	KRInstallExternal.exe
212	KRInstallExternal.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
3964	launcher.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3504	MicrosoftEdgeCP.exe
3504	MicrosoftEdgeCP.exe
3504	MicrosoftEdgeCP.exe
3504	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	664	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	664	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	664	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3228	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3228	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3228	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3228	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5012	MicrosoftEdge.exe
Token: SeDebugPrivilege	5012	MicrosoftEdge.exe
Token: SeDebugPrivilege	4576	firefox.exe
Token: SeDebugPrivilege	4576	firefox.exe
Token: 33	5208	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5208	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	5952	wmic.exe
Token: SeSecurityPrivilege	5952	wmic.exe
Token: SeTakeOwnershipPrivilege	5952	wmic.exe
Token: SeLoadDriverPrivilege	5952	wmic.exe
Token: SeSystemProfilePrivilege	5952	wmic.exe
Token: SeSystemtimePrivilege	5952	wmic.exe
Token: SeProfSingleProcessPrivilege	5952	wmic.exe
Token: SeIncBasePriorityPrivilege	5952	wmic.exe
Token: SeCreatePagefilePrivilege	5952	wmic.exe
Token: SeBackupPrivilege	5952	wmic.exe
Token: SeRestorePrivilege	5952	wmic.exe
Token: SeShutdownPrivilege	5952	wmic.exe
Token: SeDebugPrivilege	5952	wmic.exe
Token: SeSystemEnvironmentPrivilege	5952	wmic.exe
Token: SeRemoteShutdownPrivilege	5952	wmic.exe
Token: SeUndockPrivilege	5952	wmic.exe
Token: SeManageVolumePrivilege	5952	wmic.exe
Token: SeImpersonatePrivilege	5952	wmic.exe
Token: 33	5952	wmic.exe
Token: 34	5952	wmic.exe
Token: 35	5952	wmic.exe
Token: 36	5952	wmic.exe
Token: SeIncreaseQuotaPrivilege	5952	wmic.exe
Token: SeSecurityPrivilege	5952	wmic.exe
Token: SeTakeOwnershipPrivilege	5952	wmic.exe
Token: SeLoadDriverPrivilege	5952	wmic.exe
Token: SeSystemProfilePrivilege	5952	wmic.exe
Token: SeSystemtimePrivilege	5952	wmic.exe
Token: SeProfSingleProcessPrivilege	5952	wmic.exe
Token: SeIncBasePriorityPrivilege	5952	wmic.exe
Token: SeCreatePagefilePrivilege	5952	wmic.exe
Token: SeBackupPrivilege	5952	wmic.exe
Token: SeRestorePrivilege	5952	wmic.exe
Token: SeShutdownPrivilege	5952	wmic.exe
Token: SeDebugPrivilege	5952	wmic.exe
Token: SeSystemEnvironmentPrivilege	5952	wmic.exe
Token: SeRemoteShutdownPrivilege	5952	wmic.exe
Token: SeUndockPrivilege	5952	wmic.exe
Token: SeManageVolumePrivilege	5952	wmic.exe
Token: SeImpersonatePrivilege	5952	wmic.exe
Token: 33	5952	wmic.exe
Token: 34	5952	wmic.exe
Token: 35	5952	wmic.exe
Token: 36	5952	wmic.exe
Token: SeIncreaseQuotaPrivilege	5276	wmic.exe
Token: SeSecurityPrivilege	5276	wmic.exe
Token: SeTakeOwnershipPrivilege	5276	wmic.exe
Token: SeLoadDriverPrivilege	5276	wmic.exe
Token: SeSystemProfilePrivilege	5276	wmic.exe
Token: SeSystemtimePrivilege	5276	wmic.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5012	MicrosoftEdge.exe
3504	MicrosoftEdgeCP.exe
664	MicrosoftEdgeCP.exe
3504	MicrosoftEdgeCP.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
4576	firefox.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
5824	WutheringWaves-overseas-setup-1.5.3.0.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
5424	KRInstallExternal.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
4232	TQMCenter_64.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe
3964	launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 3228	3504	MicrosoftEdgeCP.exe	77
PID 3504 wrote to memory of 3228	3504	MicrosoftEdgeCP.exe	77
PID 3504 wrote to memory of 3228	3504	MicrosoftEdgeCP.exe	77
PID 3504 wrote to memory of 3228	3504	MicrosoftEdgeCP.exe	77
PID 3504 wrote to memory of 3228	3504	MicrosoftEdgeCP.exe	77
PID 3504 wrote to memory of 3228	3504	MicrosoftEdgeCP.exe	77
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 3968 wrote to memory of 4576	3968	firefox.exe	81
PID 4576 wrote to memory of 3328	4576	firefox.exe	82
PID 4576 wrote to memory of 3328	4576	firefox.exe	82
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83
PID 4576 wrote to memory of 3424	4576	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\sample.html"
1⤵
PID:380

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5012

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4392

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.0.546882299\673568150" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40bfe6d8-03cd-4f53-bd5d-013a0da1f646} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 1780 1a7215f6658 gpu
    3⤵
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.1.1827244170\1650781566" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9411f7d3-c682-437c-9a4b-3e4c8e3e5ff4} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 2136 1a720f30e58 socket
    3⤵
    - Checks processor information in registry
    PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.2.1721392888\1214624686" -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2864 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1526f5d-cd04-4b88-b335-52ceb2a2c5d6} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 3060 1a7255abb58 tab
    3⤵
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.3.696206621\940622948" -childID 2 -isForBrowser -prefsHandle 3520 -prefMapHandle 3516 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70dc672d-3108-46d3-8ff1-378eec6c166c} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 3528 1a716362558 tab
    3⤵
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.4.292459952\1634146163" -childID 3 -isForBrowser -prefsHandle 4380 -prefMapHandle 4376 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {903f72e4-c230-44ce-9742-f0c49244fce4} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 4392 1a7273e7158 tab
    3⤵
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.5.346109242\11568081" -childID 4 -isForBrowser -prefsHandle 4788 -prefMapHandle 4832 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a30f64c-947c-463a-8a62-40812cc62204} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 4804 1a723858b58 tab
    3⤵
    PID:1840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.6.338047703\1234751269" -childID 5 -isForBrowser -prefsHandle 4908 -prefMapHandle 4912 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1cec5ff-5805-40d5-ae69-8d37b0bd9908} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 4900 1a727992c58 tab
    3⤵
    PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.7.991752089\708779331" -childID 6 -isForBrowser -prefsHandle 5100 -prefMapHandle 5104 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9c548bd-776f-4440-bb33-53c7bb1b941b} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 5000 1a727b97e58 tab
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.8.1436486349\1959139741" -childID 7 -isForBrowser -prefsHandle 2752 -prefMapHandle 5448 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df655ffa-a84f-452e-b7bf-d1c37e1bc181} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 5524 1a728dd1e58 tab
    3⤵
    PID:3980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.9.1222675650\1650069467" -childID 8 -isForBrowser -prefsHandle 3704 -prefMapHandle 4840 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a492f8a-a34e-48a1-90d9-21bb4b590756} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 4856 1a724651e58 tab
    3⤵
    PID:920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.10.903152277\1799773398" -childID 9 -isForBrowser -prefsHandle 5072 -prefMapHandle 5752 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a595d35-b794-4372-839f-650c7780967f} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 5376 1a728014858 tab
    3⤵
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.11.1909000798\2106860584" -childID 10 -isForBrowser -prefsHandle 5384 -prefMapHandle 5124 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b39693e-c4a9-48e0-b19e-f33ed5ddd680} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 5292 1a728014e58 tab
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.12.400614410\882851274" -parentBuildID 20221007134813 -prefsHandle 6036 -prefMapHandle 5960 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9073e05b-4f21-4262-80e9-3a8779a36a6f} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 6028 1a729a1fd58 rdd
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.13.409245537\566390142" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5768 -prefMapHandle 6060 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a779288-ddd5-4067-b2fd-a09a60788568} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 6008 1a729a1eb58 utility
    3⤵
    PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4576.14.785301607\311294042" -childID 11 -isForBrowser -prefsHandle 6360 -prefMapHandle 6356 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de8c6d9a-c480-4c77-9503-99e7a73a05e4} 4576 "\\.\pipe\gecko-crash-server-pipe.4576" 6368 1a729d7fa58 tab
    3⤵
    PID:5412
- - C:\Users\Admin\Downloads\WutheringWaves-overseas-setup-1.5.3.0.exe
    "C:\Users\Admin\Downloads\WutheringWaves-overseas-setup-1.5.3.0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5824
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic diskdrive where index=0 get SerialNumber
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5952
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic cpu get Name
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5276
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic cpu get NumberOfCores
      4⤵
      PID:688
  - - C:\Wuthering Waves\launcher.exe
      "C:\Wuthering Waves\launcher.exe" KuroGameSTARTUP
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Modifies system certificate store
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:3964
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic diskdrive where index=0 get SerialNumber
        5⤵
        
        PID:2416
    - - C:\Wuthering Waves\KRInstallExternal.exe
        
        "C:\Wuthering Waves\KRInstallExternal.exe" ewogICAgImRiX3BhdGgiOiAiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcUm9hbWluZ1xcS1JMYXVuY2hlclxcRzE1M1xcQzUwMDA0XFwiLAogICAgImRpZCI6ICIzY2M4NjNhYS1kOGJhLTQ3NWYtOGJjNy02N2YwY2E5NzM4NTAiLAogICAgInJlcG9ydF9pZCI6ICI1ZDQ4MTNkZTBlODk0MDJmYTI2ZWE2MmU0YjkzZDNjYSIsCiAgICAicmVwb3J0X2tleSI6ICJNSUdmTUEwR0NTcUdTSWIzRFFFQkFRVUFBNEdOQURDQmlRS0JnUURDSy9MMStnc2YvWXFJcXNLbElLSDhLOGRmRitPSlVmdzRJdkNuNU9sbytyRUszYlowclMrMncvKzl4TS90c3d2ZDU1Y1BWVUhzWkQ3a1RzbUl2K0dnNTdKanFQZmJYMW5Ub2FXZkNHdEVuWE11TWNtU3JkblBDOUZwNGs1WXlCY2ROV3lSb2Q3bGp5M1g1TGRudkVpWEQ0Qjk4WjRpVzg1YjFVODVseURjUFFJREFRQUIiLAogICAgInJlcG9ydF91cmwiOiAiaHR0cHM6Ly9xY2xvdWQtc2ctZGF0YXJlY2VpdmVyLmt1cm9nYW1lLnh5ei8iLAogICAgInV1aWQiOiAie2M3OTI4OTExLTk1YmUtNDUxMS04NTMwLTFkNjY5NGU2ZTc1Y30iCn0K
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5424
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic cpu get Name
        5⤵
        
        PID:748
    - - C:\Windows\System32\Wbem\wmic.exe
        
        wmic cpu get NumberOfCores
        5⤵
        
        PID:5392
    - - C:\Wuthering Waves\tqm64\TQMCenter_64.exe
        
        "C:\Wuthering Waves\tqm64\TQMCenter_64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4232
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Wuthering Waves\tqm64\stm\"
        6⤵
        
        PID:3236
    - - C:\Wuthering Waves\KRInstallExternal.exe
        
        "C:\Wuthering Waves\KRInstallExternal.exe" ewogICAgImRiX3BhdGgiOiAiQzpcXFVzZXJzXFxBZG1pblxcQXBwRGF0YVxcUm9hbWluZ1xcS1JMYXVuY2hlclxcRzE1M1xcQzUwMDA0XFwiLAogICAgImRpZCI6ICIzY2M4NjNhYS1kOGJhLTQ3NWYtOGJjNy02N2YwY2E5NzM4NTAiLAogICAgInJlcG9ydF9pZCI6ICI1ZDQ4MTNkZTBlODk0MDJmYTI2ZWE2MmU0YjkzZDNjYSIsCiAgICAicmVwb3J0X2tleSI6ICJNSUdmTUEwR0NTcUdTSWIzRFFFQkFRVUFBNEdOQURDQmlRS0JnUURDSy9MMStnc2YvWXFJcXNLbElLSDhLOGRmRitPSlVmdzRJdkNuNU9sbytyRUszYlowclMrMncvKzl4TS90c3d2ZDU1Y1BWVUhzWkQ3a1RzbUl2K0dnNTdKanFQZmJYMW5Ub2FXZkNHdEVuWE11TWNtU3JkblBDOUZwNGs1WXlCY2ROV3lSb2Q3bGp5M1g1TGRudkVpWEQ0Qjk4WjRpVzg1YjFVODVseURjUFFJREFRQUIiLAogICAgInJlcG9ydF91cmwiOiAiaHR0cHM6Ly9xY2xvdWQtc2ctZGF0YXJlY2VpdmVyLmt1cm9nYW1lLnh5ei8iLAogICAgInV1aWQiOiAie2M3OTI4OTExLTk1YmUtNDUxMS04NTMwLTFkNjY5NGU2ZTc1Y30iCn0K
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: AddClipboardFormatListener
        
        PID:212

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x200
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFC57FEBC0BFF92EBE.TMP

Filesize
16KB

MD5
697e65dd6fb9ddae31799b2f2916cc26

SHA1
01e8bf6cf3495acd0d8249e7f9c2250174a8257b

SHA256
000eb61892b25a1a7111dbd49b9726d677d0fbb642548fe7550301357cf50fc9

SHA512
96e152287d20a5b119a825427ead24710ab1586aa3e5a84bf04a4db3075cdc89abd722a87830e2f7b85b1f35a8bb8c0a41fbbf3856b9f80ae97dd3de9c003b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss57C1.tmp\Qt5Core.dll

Filesize
4.9MB

MD5
1849ef00f2b0d4bb8c475df4d714b8ff

SHA1
10bd730411fe8c6c3fa75994763c542591fbdd72

SHA256
fa6c28d6fc6e319f9c6348541cf8803ee5d32e6afccb666b3c67a54c50c81ba3

SHA512
c41794646549b5d7c22ee0cbdcff78450476f965bbf6cb83d07d97a2e23c5c2085366deaad62e37e0cc3dc072ac9e15bf40b39cf20e22a0980dfcae318f35136

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss57C1.tmp\Qt5Gui.dll

Filesize
5.2MB

MD5
0906103e25f7349766fc6025c491aa5a

SHA1
350589ec1f12ba5f65afc263c10243e10a362287

SHA256
ba869785c14c4ace0924c123295a503a59cf90cc4da68e0c61c47187b3754fe6

SHA512
ab28b7c562a342c8cbc1dad5290c2c9d2e0678de871f8ae71163fdc6bd7458084481f84baeff3349f9f79c5f07fa3e20cea4553b163fcbec75709ddf599b808b

Download Submit
C:\Users\Admin\AppData\Roaming\KRLauncher\G153\C50004\5d4813de0e89402fa26ea62e4b93d3ca_accountId_tag

Filesize
38B

MD5
f83fcaa206416dc5b22aa844473db542

SHA1
31b8e9547ade79e35747cb062c352cc53066cb33

SHA256
1b1b0152962e2e318a648e3fd4b60ad70aa60ab4d70c85d5c067aa6161c59ad4

SHA512
bbf8d33d16dcbb2b1a199b400446f824c9828a153435c27ac059ce2d48f81a9fe2646df2a8d1be236b599f81a9e3341944ad032d63846d24760d1bb1d8767235

Download Submit
C:\Users\Admin\AppData\Roaming\KRLauncher\G153\C50004\kr_starter_cached.json

Filesize
46B

MD5
5e078a62fa79fbe63899fc372e35a095

SHA1
23d7e415a1d9febf9b7c89eac164a02027295735

SHA256
8cfa09799bc7a72dcf600fbcd761297c696b85f922362f30b64b1d92e57c3b0f

SHA512
c1b803f243868eb873ea431b0f02e1744090adfb2a8b1e37a33f00d8d391dd7177f662c55d53c6ca137e691356118c976a5a197f62672226b80922241b660305

Download Submit
C:\Users\Admin\AppData\Roaming\KRLauncher\G153\C50004\kr_starter_language.json

Filesize
17B

MD5
328e0e1fad82abfe205b19a36153dc2f

SHA1
e228898ef0eb8a2740d86d07920633d4d6b2fa19

SHA256
114a6e8f5c43bea09a4a73b24b44b030440a6f3be212bbe943becdb363f15e29

SHA512
6b38ad8681bead6a5a58db08ffdf916e0eb6cb51c3f94fb2451a272e433aaf90dcfb5db8f15a1ee6458690e29faa3a4de65b1a427b45d364afdd45bc3ef15d58

Download Submit
C:\Users\Admin\AppData\Roaming\KRLauncher\G153\C50004\log\2024-06-27\kr_launcher_2024-06-27-15.log

Filesize
19KB

MD5
45aec87cfb2d33ed04ccfc8186a7b5ab

SHA1
7aba06ea7b7eabba9ac6de050e806b816e14d1a6

SHA256
bf74bd2c6baffe3b26d062058036a6b29b0d4c7923f6688bc458cb8080f0bcb6

SHA512
f7b173e82c6efa98e7880ca6ae1524234da5b8308d145ecf5b9f665237f8eb5c4575fdf8bc4365fb5499dd5f5ee00cb67fd2a40fd13b300e8bb9980570c43050

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
79d37b450c58dc086aca24ded9437363

SHA1
e0853da2152cd3a2c897e7bf0a1bc117248cc98c

SHA256
e6dbb4410a361cb3e5dd45743fab4a77516cfc727b6e742d1952e85646228e1b

SHA512
f6969d5f2446dcaec9a33cbcdc2b8a8fb04998a2c7930e06a0a7657c10024537a99ed3047471199e0270cc3c55e50cdf7942ec939dc36dce8c36bc98d1b521af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\02923acb-f7e4-4c99-a568-e5a72ba65290

Filesize
746B

MD5
7c7102e111bd3a0b8289532fbdc81b3f

SHA1
aec3126b57fb01324cdd1556ff66c8d494864773

SHA256
0a9cb4a05ac88b7de7bb5bb66a53493f998116e7a3448bd09c99606b665ae726

SHA512
6c9af84295d5e5465ac2df84df3e1478a8b8ed93cf4e71562e706c3960d4bf00479caa597bdbcec3352b085d8b674de1725de878845c430f1485955c893caf64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\ac17796f-7cb4-4d83-a6fa-7c360852df3f

Filesize
10KB

MD5
0943bd1cf4158214af2776ee9aa896f0

SHA1
a06b1fcb47b51f19e9bda0df9eebfe7ade4df364

SHA256
026f807c3a0e80eb3a2696b4a7fe28a787d0b4e42a014d2e02a6055c83179720

SHA512
b7b875af583d1ad2ab39279c20e8a83a682dfe8d94265ba93ed38171fc92dcdf6132ffef7652b19051dbc525f35c7953d8b221ed6d7997227d2f71f7bb51cfe6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
34495ac94a6355688fe5460a1c6a6c47

SHA1
43f0bb2899cd77702ac791967ee3e381509d91c1

SHA256
0e534212a20f2886123f1436c33bed8491a97a79c967f62ad66e2b905ba93ee7

SHA512
f012b8ed93897c56199f564146e990081c44cc36c7d5d9c36b8ea81d0bf8471a6a01a01804286e0668d066775749f6d9a9fa209e24e1a012b2e15c39fc8f81a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
c34b7912e5da13cd001e51142f6a6d1d

SHA1
623d23b08a0205ca0fe3dd508c76443b5c286e9a

SHA256
8f3b2e600047da6631a432a051b5ca4e22277280a311a3a3e6044e4ea90c9617

SHA512
ba9e5b46de6bee57cfd8878bbaa6b8a9768fc7cca99a9afbfd7b0962d267549352a006e150b899754ad36ace39defe7af3d83e5427cd7edcd5282777bbc32785

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
1a0db467ffd57a5f9e3a86c1b4050896

SHA1
7c7d112c075053d8139b6528fdfc19b6d0b93fd8

SHA256
aa24eb25ade9bf29953433bd739ed0460f63e52384c3322c630e51c4f7829c26

SHA512
1588af0c39491aa1f7a41ed390c39370e381b928ecb4396a6925ab536d1cd98227d6a4add799b2acc455da55e2b117f36ca6bde9b931c22d85d82b85f6bf30ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
7970bf3b89e1af1907a6f07072c75433

SHA1
db7a4b4eaa79162e2deb828889a4ffa17821fd7e

SHA256
72dce9c1dc7e57e7a9af3cd3fbdedd5475295b91ace23489390b08454c9590bb

SHA512
b788cc4788dabe004c14e955adc48a3cf997cd80ad92ebae05835aa141661726125e0dd4d9df5cc2ad6994fe71f8c36e2fa2886adbcc3c6fa6b5f2ad8d932115

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
29440a8ebcd8cf3fd2a07341aa008d4e

SHA1
affdfe80c7adc39b0b7830845f3127acfc0d3daa

SHA256
ce46f83f84420409a6d4a53832c9b9159b79226712b4bac400cd69acad29f189

SHA512
a8315bc6917b3bff7f541242d7d356f994c0bd79181944a12e43dfffc4f6ac1679daac3867f685d41d8e73598571f3c8bd65d6a459dc7637bb1fd4342ffc037d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
da6b9d7acfe5a37803912e0cf95c1f19

SHA1
4d18746a07967d006545f2753947be620136003b

SHA256
aabfd1788edb3b87fd5081106fdb9b864649a133a13f8c276d8847411ac8c275

SHA512
946166424005c5b0993beda3456ec17b8d70bbd1b73e137d933cd7b393e87b3d06b7d9982615060043d32c7af871fdc8d0f9d83d37365ef17a685214cf4d1b70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
13KB

MD5
f5f9d707b081dcd0f1cc3833bbd7a3e7

SHA1
f8a160ad8f186398b7b474bd5d8e790dd7bbe355

SHA256
96e2e758ef0a324a1a3fe080fe9f27af8a2f4d9998d1b32d8e78360809c2462c

SHA512
8a602559e4639219a4cc1fdb34c000e31a6b73a624fab58d597495d9fd4dd10139e4568817c08834d0723cf4deaf6081a17433cc718f846e5f231702213eda05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
2ada51a0e38b809bc6a9329a7f2d3c89

SHA1
7add19a48bbb1ed62868678579f47e381a85bd45

SHA256
18ba990b487505c6d85033cf68e091c892c1ac1c1cdc5eb2f7331abf59b4ffde

SHA512
c72284bf300c78411ccb58b51d2e1d2a2606b88bb16888454cba3d803f2c22bd1184ba67087225b0777f9a174c7f0912f2b800622c8293677f0eec66052eaac1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4

Filesize
13KB

MD5
95b1e6f50d178124cdb25c1547f164d6

SHA1
02e3e2646296bbc0581bb7780ffe4ca44cc9e464

SHA256
5faac0d2d7e7bae2472b80c4b07a54dc0d714105e22bf8f5f93922008357eaff

SHA512
4a1c6a2afb19844a1a73bde12dc7ffc39529582f0f04ce4da0b32270c6e385cce938e61a00d78ea564be1c2fd105d8dc1b63e6a6fb49cdaf066b8b6370799e88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit
C:\Users\Admin\Downloads\WutheringWaves-overseas-setup-1.pdTh1Gk-.5.3.0.exe.part

Filesize
96KB

MD5
795e2c0e7324a434774292e6d9a18ce6

SHA1
2cd7de928400a040c5e8e147ecdb680f324e32a8

SHA256
836b52fefa8cbbb92f218eb3eea219dfe6b266627ca98720e9cdad496c92a3bb

SHA512
163bd304685128f9a80e190416d2cfde816dc98c140d7ea30b360731fd3871e1067af6c42c84f411506b3727eb9d868e61adab45cdaba4d8d96b5eae57a86427

Download Submit
C:\Wuthering Waves\G50004\Client\Binaries\Win64\AntiCheatExpert\InGame\x64\product.rc

Filesize
18B

MD5
209721ef5b114ae04e6a6a704bb7d528

SHA1
bf62fbbabd8955a083372f6c4bb115a33d1f969b

SHA256
704d93667e1a0773631c2765f97dc9444f9efe5099c3dd6e921883bb63cca36d

SHA512
3be2c54d7a5378ad748c5c48bd62eb7587e80edbaada341d0749a26e3d45470c9391faca1e94b6ba72bd5d05f1dd4b099c791dccfa80e3111ecce235021bd2d4

Download Submit
C:\Wuthering Waves\G50004\Client\Binaries\Win64\ThirdParty\KrPcSdk_Global\KRSDKRes\kr_webview_close.png

Filesize
387B

MD5
863d26e9ceb211abe80e313394efcbd3

SHA1
4afae139d7dc3e7f885cdbb4a2e35050a6ab6a2a

SHA256
5e2be47b76003004a0960435f7624d339fb33425754b178494d0f2ee26b408ed

SHA512
cdfcc54ca90cb6cf5af3e6f744964905df08aa2269ae80ae87b2c13c473bdf7c2f79ad4c5032d5061957d59f820eb51b949b99243e9c61dab020235fced82579

Download Submit
C:\Wuthering Waves\G50004\Client\Binaries\Win64\ThirdParty\KrPcSdk_Global\KRSDKRes\skin\res_common\ico_fail_88.png

Filesize
4KB

MD5
0ada3fe2a687a3ca3147398669a32cd2

SHA1
da81a0710d55323f36af00ae6229e1f05272f5d1

SHA256
bc1d55d965b428d7880169a46650787426c6ba3f495a8bdeeaf2f9413de23723

SHA512
71908b06a7f20f1b8c4583e44682c4224bd31c3e85c52d55e46bea156b2c2cc43389f586def72a1c89793ca8c7450717f6d4d51b0ffb044c5aaf5ea368b01d07

Download Submit
C:\Wuthering Waves\G50004\Client\Binaries\Win64\ThirdParty\KrPcSdk_Global\KRSDKRes\skin\res_common\ico_success_88.png

Filesize
3KB

MD5
20bd76f8e117ef149f87b8d6bdb3b1dd

SHA1
880b67ca376eaaf3f28755e40de9a9681c3c9f13

SHA256
57f691f496e7dc422cf62c70d9ab63e6cfeeb11a60a536caf6e741c3ac9a2674

SHA512
4e1e18ec544cd7a2fb163867aef9cedee41ece71e772bf534fa419e0deea41fa0e4270aec5b75b9b36169f6263f6855a8ebe070a732fd3db04b67edfeb791f62

Download Submit
C:\Wuthering Waves\G50004\Client\Binaries\Win64\ThirdParty\KrPcSdk_Global\KRSDKRes\skin\res_common\naver_logo_normal_50.png

Filesize
1KB

MD5
254312c05c74da10265a6fb4479deb30

SHA1
d27ce0db2419252d257306d3889ee9b73618a15f

SHA256
7227aae6f68131cd33b12b9f237e952d0ad4424574a21ec17a9de4d70660c650

SHA512
2d867122e61b351eba52d099b51bd9c1710b44361acc5cd59e0f11cd54e279bfca38e39102ff1a93453ee66623eca2296f33d33cfd2fd45d8d193ad06566516a

Download Submit
C:\Wuthering Waves\G50004\Client\Content\Aki\Cursor\CursorHi.png

Filesize
3KB

MD5
beae3743abf3d7b34ce9512ec883994c

SHA1
e9f5abac346938f5ba6ff298d5e7383d54691866

SHA256
ebd0949b134486b3032f3001db2abfe2663fa47fd7514ba9988db199a1e26002

SHA512
6b67281eaf56483503fadfcc8dbfa5e0cf4d239e74b617328987ec2b8bd7dcc11c97ad25892b813e26a07ec6c140520efe6ad7682b3e2e547b6bb618febedc30

Download Submit
C:\Wuthering Waves\G50004\Client\Content\Aki\Cursor\[email protected]

Filesize
3KB

MD5
72bb32035ae6265b5ee5c5d8d15712ac

SHA1
f08dcb0a5fcced52b164e529d4938fa4d74416bc

SHA256
a8c84e4cf59c275793c0d145168f825c95f438841ab47c3e5c37fe0920f91f6a

SHA512
3926f216e8f02202c9fd7e582128aec8c3cbe08bcd41786eca9aeabbf625ffc5753ec7c20224ce50a8ab94ea3c80ccb63e2d7fd291019bd88cc98053c989c4e0

Download Submit
C:\Wuthering Waves\G50004\Client\Content\Aki\Cursor\[email protected]

Filesize
4KB

MD5
7ae957f95fe66bebfdee874ca0eef3ec

SHA1
87358cfc829abdcd4802f672a9a871d587df318f

SHA256
ac909c4c0068fbbc26f736d35c6d79f059277558c6a46c14b40a219c18fd9bcf

SHA512
16a069c3a7b52f4124023e9aadd39aa2193303ad72140ce862bf44f2ab49966cb956db72fb1fc460982230f753070b8418b2a4cc4af2e81c7ee286c0c2e92805

Download Submit
C:\Wuthering Waves\G50004\Client\Content\Aki\Cursor\[email protected]

Filesize
6KB

MD5
f10574910f102eedb943caefd5bdaaac

SHA1
1c1f40166b143712d8e238b6801961cc746a59c7

SHA256
8b79cf7a21ea1b7a81b2880105e2f3ef362c46f3905b0b9d270976e4026a9aeb

SHA512
c0fd4bbdfd1e041d54cc4dc76ee056dab27af1188e553a7598e295d95be115880d9579e9a8fdeaf8ca7cf873223921f8a72301d020c9f4b27515eee911b3feeb

Download Submit
C:\Wuthering Waves\KRInstallExternal.exe

Filesize
472KB

MD5
218cecfa5ad1ff781b6390e40594e0eb

SHA1
7fe048ee70695c03f39f97c1ca11e965f4de6e5e

SHA256
7972b199e48b2b0a8ad7e9df58cbaee3151f388c040224008739301e7f295810

SHA512
bee5f8d0eba9fc0b300348840c2fb816c8136d6dc667ef460fb58ce177419d9de17c98c8f89658b9c74b3c579c8b935b9fbf420890f23861cbc5b745e7602569

Download Submit
C:\Wuthering Waves\Qt5Core.dll

Filesize
5.7MB

MD5
0e51ac35b4b2922288b956450a73cbab

SHA1
adee61361815b216ba5c6c3b1cab998f1093a06b

SHA256
3b2129169999b948ca6ef1931410c235ac2aece3088ff9fc486145dcf772dd46

SHA512
fd36ecf24fe17892817a3007d7cb1c730469f61e68c66ed2da090b9e84d782298d08849b80788f72e48e289332f6dbea7fa2222e7b9518165b0335643d710843

Download Submit
C:\Wuthering Waves\Qt5Gui.dll

Filesize
6.2MB

MD5
1273c387e80db82ee6a96ac4788da8f7

SHA1
d0ba5c2c54e535254fb1ac5866c32b4c1398e045

SHA256
90b1a7c47965eafcc896b99e9520198c097f60975b74884f1c2bc91a5ce88160

SHA512
3356e4da246a05aaa959002463835afc4154077e112acde6531b78bcaf32272f1d81d8b8aa8407d31bee48b1f439b57427874660386147729749efe790a2ada2

Download Submit
C:\Wuthering Waves\Qt5Network.dll

Filesize
1.3MB

MD5
20dc922278cd948ce6dbdcb74580f910

SHA1
1a34d4738955f99c17083fec22945b0d6af76f40

SHA256
f7c7a1ea2570d1238287470b479e384f87c39357d1a4b2eeedbf90901d9c3cbc

SHA512
90afc14985b51744e2f3ea11a0f6f0edc3c7306bf6e9539c9526adbed0caf47e2b19fa90b38a3269424f109adb80f2bd7394620a35360d5aeb0b3641eb92fb79

Download Submit
C:\Wuthering Waves\Qt5Widgets.dll

Filesize
5.3MB

MD5
91439f0387898388cb1a3150c5848d73

SHA1
d57b3c8bb6ae88f98add39890c9a8c3fdc2a0f55

SHA256
9e38324e796eb66200498dbfdcda8ac92f92155a9accdc6c97f92f475ea4c8c2

SHA512
8a282440d5b2ba67ef4d9f490c0ef93946b60351b4019cb247eac67da92398b55745f6325fe6ab7f62088132614cc9f6332726e532e692f0b709bdcaa3999bac

Download Submit
C:\Wuthering Waves\bearer\qgenericbearer.dll

Filesize
55KB

MD5
f5c0f40371076790320a963fe3794221

SHA1
9fd44234d90fe79b7024ee045624575c35e08af9

SHA256
0a4978a5af3b68068ba5945af231e68040d91fb4bb9139b8b7a8ec514e2e4d88

SHA512
712fc97ee7aada1ae0e35c60f686211246e9c04a0a71ae407eb415fb5838f121d30347881bf4fd66f137c85f00a1474c79a96218705d18ea4999da37ba3fb4a4

Download Submit
C:\Wuthering Waves\launcher.exe

Filesize
8.8MB

MD5
504abd34de600f936855029fc4394f7b

SHA1
4e3246af1ca47e8ffa07c20057334eefaad6f0e0

SHA256
5c8f55352c4e3f0e57df98cfabc1429e74c328a3ef2781754357a38470257a91

SHA512
0be254231dfe4ab56e7683ca8f52b636cdfb045f9743806994ef3db1afce173cbfb73d59c550744f291c3797cb5139e88274499a4d63b0d4dde3f69d955d9ba7

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\KRPlugin_aki.dll

Filesize
13.7MB

MD5
1ad5e8c0a9b3f3310889e98c586c5c93

SHA1
60a8a3a14987b1400a2c73d1880f33dd5ef8b5e7

SHA256
e2cc880074651596a6ab47c9657849eb1512e2745d7e6bea5c7deaf21a5b9937

SHA512
4d055b6b4a2ac97e0f0a6c739e08bcfa68c2150552cdd72c79ee947f88302bf054b33c1ec1425f5bc8cf80706ffae773967271854d28b89120e144f92810c499

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\Qt5Network.dll

Filesize
1.0MB

MD5
11c016d03aefc9e124828cb7cd775cf3

SHA1
cfdcf0bf5834e507cf87c7e283d14a7c89aa2628

SHA256
10fabe35ca0b0b9c35c2f618c801fb999bde09572a7fa10415b2b3f6b6470a7d

SHA512
87cc26fee8033ce638828fb773f62704f48a20c042faf70c9f97e9f1d76a09e6060c818ad2d4cd6cccaf4464fb23e9bcfc77d53a6f24415aa0d83455260ce36d

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\Qt5Widgets.dll

Filesize
4.4MB

MD5
07b30ed72326c030aae212224034bf28

SHA1
13283d6bd5e953a298ea2dd095bedb239dcd7961

SHA256
fae1cbde9e10955e8b0ff414e64020be20bf9d1d62e7c583b4510b60f363faf0

SHA512
228bf5d5adac1e6fb8eb4cdc75d60f44d1c81c2e5f44d1f04bb3929a06fc2ebbe33bc634a90d593d5892f75121d96a680fd988cb0b462bed82db7183c936fbf4

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\imageformats\qgif.dll

Filesize
35KB

MD5
e070dbf1a9253bde7910e040dfd5d4bc

SHA1
43f396528d643bd2c9fd8e1b63c4151bbb23c980

SHA256
7ac66b0c813585b7cd3645ad3bcab0b225006cee9076b05a21cb6b8db176462d

SHA512
317af40137f8f1d475349a926067bfb6b776c0e26352e164d6cf1fa95293b865ca6e07cf3cb305eff122c1033cd3cd7e2931b8c0083424ebc91be111d6b89a8d

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\imageformats\qicns.dll

Filesize
43KB

MD5
d617d449bff841e9e56ae5d66733c1f0

SHA1
57f9104c906d88b5193475286b9a1e9d55cd3fe1

SHA256
3587d149b774835aaebf9122945d432cb97a01f923c2bdf45c8ddf7db46fde6f

SHA512
1b4f7be9b650aa5658dde24da392262055b867525f8a2e61a2656c2617651f29dc5b61dd41f57ba84be030616d2060185f4790c7dd4a29d07b1e62af16b7f565

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\imageformats\qico.dll

Filesize
35KB

MD5
77b5eee567d88078024e3b535d6196f1

SHA1
db155287e3a3fcff2d280b5a4aa555784c2bea91

SHA256
ae2d373da197c94fd6aff5b56baf3df754722926af4f71279688ce563fe6ef31

SHA512
811b1654a0b17eada09e37d4d29a3297d5aaf9f2eae1f3cf48cb6b7c5d36f28450ca80084aec94765bee0b02c03854c3e489327911de9d96f8189a6e92c6648c

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\imageformats\qjpeg.dll

Filesize
383KB

MD5
1f8c4a04573e26286ee2fafdf03f8f85

SHA1
b3d3ed2615d63ea26ed035ad191164e0297f088f

SHA256
18706a0bff940116731de4a55d8312c054771271c49fe47f77e07b0d73529053

SHA512
699c66b862675ef4e519e962bc8ffb87536fe81f5870f91f4179d9dd34c222e9107f92fc3e6138a8ed005293f90fb993144f4eaf9ab1518072718b730d1dd91f

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\imageformats\qsvg.dll

Filesize
30KB

MD5
7ba0979da56479bd964810e8ce794e9e

SHA1
68465868b7f9e944c6d5c57e4bc1d9383e234a74

SHA256
099eef1d161e9c4bb957d73678d471cc276337233a8e715e181a352760346701

SHA512
31edacc55c659571b473ac41041bd2779fcb36576882f9250790a7a5419cd64271560f5bf9039cb49ef621e970b2db028cca653ac8e83696e5b7822f6d287400

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\libcrypto-1_1.dll

Filesize
2.4MB

MD5
e879fa16f3746a14cd46dbc514452eea

SHA1
ba9559dca54da672a81cfe711004b25259fe8cf4

SHA256
e8a549275b205df98c33d76c47d2476ea57d14ed476d759fc921357a05ab740c

SHA512
274605fc33e77d6e891f070e09a00d65bea4aebd28506d3d4b036cf4436ab29a29fce887f0091080027529f7848b84625fffeb13b7e32d3c5472995da16a6a97

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\libcrypto-3.dll

Filesize
3.5MB

MD5
3b4dce9348385fbb3dee25e3e0db7efb

SHA1
f760a89a8bbeff22d3a837ee50089a616c9e247d

SHA256
b99f87138165561775b29283879722333082c5f12f4716ee423da880aefc9fb9

SHA512
dac1a728dd9388120b05ec79bcc6005a1a50f28a4051500acca24217e9efccec8529e377537d6bc5f6cc9a87a1aa3e5ce7206a04b5283848499f5f46eb8ca800

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\libcurl.dll

Filesize
460KB

MD5
fe5e6aecb98bbcb2cb0e826526dea007

SHA1
936f0e2ade5a909e714c307c1e2aa2702f1e464c

SHA256
ec5f18199dc57130082315bfb6baedb8614da92ae256019a30b5880dded9ae47

SHA512
7ae9fa473e612791a606f6fd7043a5385b3b4eb3bc612652c05d8520d2b2f766232c03de436636362c60b08cbdfec919a35dc07075b2877753ca4779c9cdf0d1

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\platforms\qwindows.dll

Filesize
1.2MB

MD5
f52d1908e2d1f5b03b72cc87df48c8ad

SHA1
aa50aa22dbe42f20e0f67f2102cb37eb39d86dc6

SHA256
60085c5b61554a1e9d96350f039597a1b77a7576a81a12a24ace9de4c323bb8d

SHA512
70a67a052c4daa445ca200768f9675ebbc987d86efcdef8bc6b35fbf8b907c4dd48bcde890476001bdeb655606fe00a804de7f5d1b08505bcf7883a5326aa0b2

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\sqlite3.dll

Filesize
1.1MB

MD5
b8074421d9f92adb9d112b90a54d47d1

SHA1
97eecbb5adb3d75d7ba791fc8625611e8854ee6e

SHA256
8ce20d2f27c6574dcaed648971778bb11d1ec18b9a44e879c0e53c1a29273dd8

SHA512
bef2881cd618c7a8a5871e6f58032ae81225f02bd005355d00ef6b05c30e2a8112763ec1cb0474f1f3fb93d43b8609070d0daf33f0b9fdb92196e1c5fae4213b

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\styles\qwindowsvistastyle.dll

Filesize
129KB

MD5
cea2589b96f6a9f02fccc0bc0786965f

SHA1
dc115c308579d59f31346b3535fbc3e0338e0dd8

SHA256
a0b0177a40b1c74ac79bf31c9f26ab0770d54c2297d68a53d289c48ff5b23edb

SHA512
7865d1ee088cc880670bebb90ed13f5bb55b14affc98dac1ff9bdfcc94aacc84b1379dedcd1ffc992b8f45df40434bdb1c3a3e396410f2f292fd9c83d7d2c338

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\thinkingdata.dll

Filesize
294KB

MD5
e295bbb7c68f5cb535d72983227b12cd

SHA1
d42a6214e46e95f082426f52af52ddbe46725a12

SHA256
e988ebfb5798d712ca21fb8986c06a364b1d1f3b9397277898bf2e80b5818e2b

SHA512
a84ed487c75b012cd863f044865c4fb9e7cffe354737176f9626ac027d843c763be5668391219c7019fcb419267393f4dc5244020c953cf9ecdf4a68fb67b9f4

Download Submit
\Users\Admin\AppData\Local\Temp\nss57C1.tmp\zlibwapi.dll

Filesize
469KB

MD5
5b56b325dbd6a7284d2ecf09d4cc0623

SHA1
38c86384096b428f127117fe58284a03f5f09fc1

SHA256
14aca2bf23b47996f630a1c5175fa6003e5898612411eeb6cad5abf96bc27b8c

SHA512
3d5d7bf4196ffd20b1a6e747ebd0dd7f2ab83458b4360d2c003e306fe1bbf5de48ddae2404fcf297deef06ae9acd0067314e1abef8433735776805e9b1093d88

Download Submit
\Wuthering Waves\KRShmq.dll

Filesize
43KB

MD5
91e64868d9f89d3282d9fe5f70d3af60

SHA1
0dfef08302d1b946b1b9cadac2cfa84aaad4df56

SHA256
f177c55114e7b7d740327a9f292597ad3f6a9ec059a3aab6d052befd1d3e383c

SHA512
e01b893140c3780d55753db14754c1196df6d4839a1f8ea0f5a61f082309d6f67bfb89d2ba61102d2199846fe1dd48439dbf1cf8d3563b468478abbfd9b65718

Download Submit
\Wuthering Waves\libcrypto-1_1-x64.dll

Filesize
3.3MB

MD5
ad7eb78deb617d95d69b9d58dfeaf62d

SHA1
655bc2b7b077fce5303ed22166233315f4bd20df

SHA256
5e0571359a22563aa748268a910aa193437fda551f6325714f8e2216c1bff645

SHA512
4a3aec1bbebdbd4f0be5b7f7371a0a79b12319ca58ef4621753210772ccc68991dfdfd086e08ee382bce1a9072720adea4e32e7842be91d357a71c2d606d1f58

Download Submit
\Wuthering Waves\libssl-1_1-x64.dll

Filesize
690KB

MD5
16f75756bcdc99aa8ea1ecf549d9b8cd

SHA1
924f868919e15aab1766af35a04df917a1390e14

SHA256
4c593cdac689621127bd8a05b97df462c55a3da9a7a6f0f4e51febb9f0fad569

SHA512
56c1ea7e9060c515a152ed4642e9e75bbdf698eaffdfd6ae414c9413a7813b5129c6d45c67a5b47a295ebd3bf13096b978ae136145b196249ee322aa74e95d59

Download Submit
\Wuthering Waves\platforms\qwindows.dll

Filesize
1.4MB

MD5
ac584cbeb327e9d2364873f451e074be

SHA1
eb2d7b7f38c880ae4bc4f32c50e10e73ee15c816

SHA256
1fa4d2f13d22d9a859503d7b7c87ba39d379d9a14afcea7299d572eabb2bdf57

SHA512
4fca1fa9494799f382318d329a3040bc067d55e7cd99be6d768e975fb585f61f8c1360908284bb04c055dcf21a164464305e9255d52b1c57a0cfc49eea003203

Download Submit
\Wuthering Waves\styles\qwindowsvistastyle.dll

Filesize
142KB

MD5
085087d668776333d78d87ff579fce87

SHA1
861af820e28c6070fa22defbb527e55cdbe3590f

SHA256
59f3183245e4ea6a93f04eb3dc7460b3911397cb5a9f7aa429921b7957b62684

SHA512
10b2492ec88f0682264169478b966cb6584276d4dfb6a49d62ce21dff68013b3d1e17cfc51c658f5773d5cb9b374ec90205f1ebd07db70e8f0c76a96cda80e2e

Download Submit
\Wuthering Waves\thinkingdata.dll

Filesize
334KB

MD5
c0a3fefffe9f407a2a257966cd92da52

SHA1
90424515844c4f6166f19505f94733a8896835ea

SHA256
bb424f14ca1907e42db116eefb493c814d38543b126ef0409e64f5b54a928447

SHA512
7c04487c57a49cb22a01004047d04c035e0d491a8e442596147e47eb698ec27453a876499a616f40ea9068dce2571608050d7104b40a35da32a6b13ad475417e

Download Submit
memory/212-996-0x00007FFD9A420000-0x00007FFD9A975000-memory.dmp

Filesize
5.3MB

Download
memory/664-47-0x00000223E4D00000-0x00000223E4E00000-memory.dmp

Filesize
1024KB

Download
memory/3228-62-0x000002EF69BE0000-0x000002EF69BE2000-memory.dmp

Filesize
8KB

Download
memory/3228-60-0x000002EF69BC0000-0x000002EF69BC2000-memory.dmp

Filesize
8KB

Download
memory/3228-51-0x000002EF58D40000-0x000002EF58E40000-memory.dmp

Filesize
1024KB

Download
memory/3228-55-0x000002EF69010000-0x000002EF69030000-memory.dmp

Filesize
128KB

Download
memory/3228-56-0x000002EF69B70000-0x000002EF69B72000-memory.dmp

Filesize
8KB

Download
memory/3228-58-0x000002EF69B90000-0x000002EF69B92000-memory.dmp

Filesize
8KB

Download
memory/3228-66-0x000002EF69DC0000-0x000002EF69DC2000-memory.dmp

Filesize
8KB

Download
memory/3228-64-0x000002EF69DA0000-0x000002EF69DA2000-memory.dmp

Filesize
8KB

Download
memory/3964-852-0x00007FFD9A420000-0x00007FFD9A975000-memory.dmp

Filesize
5.3MB

Download
memory/5012-85-0x000001C6122F0000-0x000001C6122F2000-memory.dmp

Filesize
8KB

Download
memory/5012-92-0x000001C610580000-0x000001C610581000-memory.dmp

Filesize
4KB

Download
memory/5012-88-0x000001C6105C0000-0x000001C6105C1000-memory.dmp

Filesize
4KB

Download
memory/5012-16-0x000001C613220000-0x000001C613230000-memory.dmp

Filesize
64KB

Download
memory/5012-35-0x000001C610590000-0x000001C610592000-memory.dmp

Filesize
8KB

Download
memory/5012-0-0x000001C613120000-0x000001C613130000-memory.dmp

Filesize
64KB

Download
memory/5424-877-0x00007FFD9A420000-0x00007FFD9A975000-memory.dmp

Filesize
5.3MB

Download