d931ce297a55d2bce8f91f2e5b300c079034735283144ed8358eb06a49967ac2

Analysis

max time kernel
1043s
max time network
1044s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/09/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GameLauncher.exe
Size

6.5MB
MD5

cb9d8fcd5d906919b112001d4e5cc8f1
SHA1

c088ae04a792187aed0c41594d78daa0ad35f510
SHA256

d931ce297a55d2bce8f91f2e5b300c079034735283144ed8358eb06a49967ac2
SHA512

4feb3ba4ebad253832e5259971d59af0dcba7d3ff7a453960f2874ca7593407ca04054127215aa57a65fa87174a0f2b0c384a329b319573e3102379a4eae7a97
SSDEEP

49152:GT7HSh6CUjW3N8utpyTvsPw9Nn4LPHW61A+/1dWA9kKqjtS2dcaZhFRbuuu9utJS:/gjSkmwQLrb2dTbuuu9utJv4xXpjGCJ

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5032	msedgewebview2.exe
2644	msedgewebview2.exe
1100	msedgewebview2.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31131045"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "305009300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	firefox.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4892	regedit.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4168	vlc.exe
4992	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	msedgewebview2.exe
4740	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4168	vlc.exe
4708	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4980	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeTcbPrivilege	4772	svchost.exe
Token: SeRestorePrivilege	4772	svchost.exe
Token: SeTcbPrivilege	4772	svchost.exe
Token: SeRestorePrivilege	4772	svchost.exe
Token: SeTcbPrivilege	4772	svchost.exe
Token: SeRestorePrivilege	4772	svchost.exe
Token: SeDebugPrivilege	3360	firefox.exe
Token: SeDebugPrivilege	3360	firefox.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
480	GameLauncher.exe
4980	msedgewebview2.exe
4980	msedgewebview2.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe
4168	vlc.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
2688	MiniSearchHost.exe
4168	vlc.exe
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4992	EXCEL.EXE
4708	OpenWith.exe
4708	OpenWith.exe
4708	OpenWith.exe
4708	OpenWith.exe
4708	OpenWith.exe
4708	OpenWith.exe
4708	OpenWith.exe
4708	OpenWith.exe
4708	OpenWith.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 4980	480	GameLauncher.exe	81
PID 480 wrote to memory of 4980	480	GameLauncher.exe	81
PID 4980 wrote to memory of 4312	4980	msedgewebview2.exe	82
PID 4980 wrote to memory of 4312	4980	msedgewebview2.exe	82
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 1100	4980	msedgewebview2.exe	83
PID 4980 wrote to memory of 4740	4980	msedgewebview2.exe	84
PID 4980 wrote to memory of 4740	4980	msedgewebview2.exe	84
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85
PID 4980 wrote to memory of 5032	4980	msedgewebview2.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\GameLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\GameLauncher.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:480
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=GameLauncher.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --lang=en-US --mojo-named-platform-channel-pipe=480.3492.8692908059229251532
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7fff8ea73cb8,0x7fff8ea73cc8,0x7fff8ea73cd8
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1764,15120345978235040022,2073286441267821573,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView" --webview-exe-name=GameLauncher.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1764,15120345978235040022,2073286441267821573,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView" --webview-exe-name=GameLauncher.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1764,15120345978235040022,2073286441267821573,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView" --webview-exe-name=GameLauncher.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2364 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1764,15120345978235040022,2073286441267821573,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msPdfOOUI,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSmartScreenProtection,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch,msWebOOUI --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView" --webview-exe-name=GameLauncher.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2020

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
PID:1836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\NewConfirm.cmd" "
1⤵
PID:628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C8
1⤵
PID:3144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\NewConfirm.cmd"
1⤵
PID:2248

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
PID:4136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772
- C:\Windows\system32\dashost.exe
  dashost.exe {e3b9ec17-6185-4385-97fa19087143e508}
  2⤵
  PID:4520
- C:\Windows\system32\dashost.exe
  dashost.exe {436848ad-10e8-4c1e-8731274d7f2f0e26}
  2⤵
  PID:784
- C:\Windows\system32\dashost.exe
  dashost.exe {b8f357ca-e284-4e7a-8c6aa363fcade243}
  2⤵
  PID:3868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k McpManagementServiceGroup
1⤵
PID:4916

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\DismountPush.reg"
1⤵
- Runs .reg file with regedit
PID:4892

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SetStep.mp3"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4168

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\SaveSet.csv"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4992

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4708
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\SwitchRestart.xps"
  2⤵
  PID:824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\SwitchRestart.xps
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1852 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c88da39-c769-4cdc-8ea9-2682615f7117} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" gpu
      4⤵
      PID:3892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2252 -parentBuildID 20240401114208 -prefsHandle 2276 -prefMapHandle 2284 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebb36c44-bb89-48ec-86f9-1d024d554007} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" socket
      4⤵
      Checks processor information in registry
      PID:4496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2644 -childID 1 -isForBrowser -prefsHandle 2700 -prefMapHandle 2656 -prefsLen 24739 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ded0be5-077e-48f4-adba-8b134042e9da} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" tab
      4⤵
      PID:2456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3572 -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 2944 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a409d44-6a8f-4f02-b19f-31d2b3b2f0f4} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" tab
      4⤵
      PID:4624
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4728 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4720 -prefMapHandle 4716 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f15cd4c-edb7-41ac-87b3-8ba110c185b8} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" utility
      4⤵
      Checks processor information in registry
      PID:3544
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5584 -childID 3 -isForBrowser -prefsHandle 5560 -prefMapHandle 5536 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a89ce0ef-aa7e-409c-a9a3-f3262eec545f} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" tab
      4⤵
      PID:2168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5824 -childID 4 -isForBrowser -prefsHandle 5816 -prefMapHandle 5812 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18d6471c-e841-42ee-9846-9d070330816b} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" tab
      4⤵
      PID:3308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5932 -childID 5 -isForBrowser -prefsHandle 5940 -prefMapHandle 5948 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {817c8392-8498-4fad-aad2-226d60c1216b} 3360 "\\.\pipe\gecko-crash-server-pipe.3360" tab
      4⤵
      PID:1624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\Desktop\SwitchRestart.xps
1⤵
PID:3740
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\Desktop\SwitchRestart.xps
  2⤵
  - Checks processor information in registry
  PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
45de609736a652ead099a45af0f333b5

SHA1
e658ce844112e03380439271c8d753bc5dec53b3

SHA256
2602c88ece00551b6c760c33fe44a2e29056d0c791302dcb0b4d615e895bb878

SHA512
ea2c59891b374075e376001342c126b06ac2a859c487927b7b7181a39d6ccac1a228655311d3a10f588d2acd2d359740908f6b3b3f13e3cbdde6f328aaad22d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
a7f391566ceb7d310b04c1376aa66a07

SHA1
eda88e9134d3de209152481c9e8aa02054d4c2eb

SHA256
8ecb81fa22792fa6bb09abc86b9b5afb50773e2c5537def45dd8ba297f6c714e

SHA512
163bad20eaa9108286367367e6a54a9ac612026954ee2466b8f88f732a992695fe160d3fb5f092976ef15c1c1b71400e577a9a4833dfa616d7c9ee6a8237033c

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\8c3d602e-2839-4d93-ab8b-8292bdd24dcf.tmp

Filesize
2KB

MD5
5864521eed3ff10ddbda7c9113b93c2b

SHA1
13c10a311a4e70381c91e1a8081912350451ee5e

SHA256
5b6fee948e2110e6666ed4ea6cb9a9d7acd33507b42477dfa6a94d97091dc26b

SHA512
88424a453f2e0c44031a7f585697e501cad4c4f01a82974c17cd1bad0b17aeff34df68ef927b638ce617d55c099b6ea80a7e9f7f557c3d6a53f7d361fd9229c9

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
352fbb20482c6adf21d4d4ad85d62bcd

SHA1
2c55340df1ec205b14fb2a19962f1fbb650b2f72

SHA256
1c14d25603cdbcfa428b73311a20bba805fcfdac2db970eb06d3ceb17666783b

SHA512
5e1c186a03a0759afa2f2b66c7dc5c3933fd069413b753a4833ffa2d6804ade7a9a261eebffd7a666e3500b06151d85b3e6b50e40fc141efa4544790485e9aec

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
b38296bf48967c5aa3ff6b868fd32af6

SHA1
e6b2a564d4bd3c13f8d0fb08e9a011ada6663be5

SHA256
e3212166b1775733662fcb4d22a94699314db886d0c3612aaf130a6f0fb2b925

SHA512
34f0bad9d6b968fb882ccd403d4072cf50d73bf03419dd7f2b872fafe6e564148b7d43c69f85bbbfccc07eceeafc231214470d15079d5d1d0d02ea423895b547

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\xyz.lncvrt.gamelauncher\EBWebView\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
329B

MD5
0d5419e8b1997ea1aea1b5d52b51ea95

SHA1
c0a63dbcb9594925fc6d3254431f5e4602fd4764

SHA256
1b64721e4b6b01ed6a7e9ce01131cd80403b05556e775a863bc1e69d131bbd53

SHA512
c1a4c045f355e0863542636e838fce6c80cd3c843f20a554805bfb9be47e44db71f2ec3583b06eec93738fc33b852b678b85431954f1264ca975e5429b4bab2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
185ff028f0b6914db68238d553ae02eb

SHA1
d13fb8091e26912683cd2a4c5702e5e4de20d88e

SHA256
eeae9decac6f6f2061f2d57dd6a960641c45f9565915c16bd45526978e93b609

SHA512
f811abe636e2147baeb8d1a6cfec8fe994921b6eb91ad9bc9e2c9e7dc50a1ac36f770c77103dd3259daafd1f150b16741cd6f34af4ed6110cc12b85ba0d62c87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
e3f46ac1ac721bf88badbd1077a0adfc

SHA1
959848856391b4fa7ebfb3d1b369a5287de1a85b

SHA256
4f539a0e2ff32dd985a3776ef15523af67da2666d46678e1ebd7a5b497f7ffe4

SHA512
4aa7990500f0bde11e3ef93189808c0b2d6468184bfe05feb159868475d2d75e6fac28534983d085144e331254738471c93bee9bb112234c8bb1b2622edcfcb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b0818216ef825730b4f64351f4eaf6c3

SHA1
2c5bd25780931d430c01b29d97835a2ee2dbdd09

SHA256
ceee5f7042deec3f4991dd562e1c79189744f1984ffd290ae61243bac609fdb5

SHA512
e132e7b7756443edadcd94df34aaf5a999b100130f0e8706774971e5fb698fa3f02b54ea5a002d8f6ca48af76e4266e37f47c2a4e5c02e17dd2c0b36931f3492

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
8c24fdf585493df715f42fe2811636fe

SHA1
ff61e7e6f7b2c7f3e3a5aa445bb3185912250ab2

SHA256
a2e0e3aa9a32519cfcdf80e468fe4a0f56562b3c0341a6827845e98ca334b354

SHA512
1e6b9d92f3b1e819c6bac0d7377d72a26f9f4fa83a8258e34a37910d04bf3ef32192fac0cc9c70b995995a707526449252250fc9641cfaea78fa6671d6d6be22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\2b7b7812-2b04-47b5-8e81-2cae478c9eb4

Filesize
26KB

MD5
13565720e4161caa23dae4934122294d

SHA1
20a337805f69a337ee3b7c674f4362370dc2b985

SHA256
42d1c9a437973259287f3763900c5053a9ab5e5859597be63113373a7de5f607

SHA512
9ec777e15e17c947cece03853c1adbb7fd4dfe51dc724d4c0a8dc4e2a558f11608c5775ce3227c866aacefa6ad224625512471349e085e29574e4825f758b4f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\4be250eb-2a8a-48c4-8349-5dfa32f013c9

Filesize
982B

MD5
26902b2ffe9f83237551dc35a09de4f7

SHA1
92a5d870708cb295e8465aa8bca26d33d39afbbe

SHA256
e8a8081adde238bf3a0f8e27a203a5d88b33a0970060994d1a7edf4da39b5ddf

SHA512
5a5fb17766940f287616f6dc4754cdd929162be0a0b32abc52695ea0997f140e295d4c1699d0b3524942cc8fb79429b4dfdfb5678a723942c4008d15294afe15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\7cdc7204-8ada-40c9-b3c5-e8669b5f288f

Filesize
671B

MD5
4e15818b06bf806985503d7e81891c54

SHA1
93d3e857411b7286f5ccabbb8e5fefd7c75c9f92

SHA256
60b9ad1b4d7a1dd6309128e5685b732c4f6dd816e2df03902a1ff6830929f32e

SHA512
57652674fd9e4a2c50e735e04e136e9c725baf543a84d14be9f595e0b57ed0dc9a0f1d061529757b90240d3199169da820eeb701d2577f6eff13f2d01f74f2e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

Filesize
10KB

MD5
e3a7796e6ba5adbb462b3f861f01b80b

SHA1
678445561fbad89b086a8f982769bda8277bd3a3

SHA256
34cbef1f7149efaec167bdb160e2e93314273512cc606ac82ca7a8df6830f8b8

SHA512
10b2d868c2e68212be314653c3b6f70c5b4d4a5dc8d46d17bc8a7968a13b87d04cc818ae955a3a32f7a890e95e1edfc77d2ac97d0b51f3966e8b29e9f67f04d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

Filesize
11KB

MD5
32ab65c124866ae13895585c90eaa2d6

SHA1
19ce18266190c6b7c15d6f5632ddf9ef8f3d51a0

SHA256
3d79a60e0581ce93b641e3f34c69d62056839063e5dbcbb43bfa50ed1be7828a

SHA512
ebf2484ae3006dbf5d7f9a82987475214736d66eae5c3e89fc60b1e792974bec2766dd4edf58c0524f4c5a4074f5d9dd2e5b4de795285bd8dc14107c57bece80

Download Submit
C:\Users\Admin\Downloads\Hk-O8O2V.xps.part

Filesize
639KB

MD5
5e570aa28d35ce9ca3a1de010479a7fc

SHA1
974a3f1ef8fdb28e37dfb5d5b77e1239a2ddc67e

SHA256
b75848e17972b1761d49c440cdcfb1dfe7a06fdc37005aff586afce56ed00692

SHA512
68046404eca0f5572bfdb18823ce41012e0a6833d2d27d8c4b54d7eeda5ad71a1efbe09c03ece23d918b842112af43887a6a0d12d5107a9d258cd0ce2a05d6c4

Download Submit
memory/1100-14-0x00007FFF9CDA0000-0x00007FFF9CDA1000-memory.dmp

Filesize
4KB

Download
memory/1100-162-0x0000028D84140000-0x0000028D84260000-memory.dmp

Filesize
1.1MB

Download
memory/2644-81-0x0000017A652D0000-0x0000017A653F0000-memory.dmp

Filesize
1.1MB

Download
memory/4168-190-0x00007FFF92950000-0x00007FFF92961000-memory.dmp

Filesize
68KB

Download
memory/4168-203-0x00007FFF8B8C0000-0x00007FFF8B8DB000-memory.dmp

Filesize
108KB

Download
memory/4168-188-0x00007FFF96E40000-0x00007FFF96E58000-memory.dmp

Filesize
96KB

Download
memory/4168-214-0x00000221E3740000-0x00000221E3751000-memory.dmp

Filesize
68KB

Download
memory/4168-213-0x00000221E3720000-0x00000221E3731000-memory.dmp

Filesize
68KB

Download
memory/4168-212-0x00000221E36E0000-0x00000221E3715000-memory.dmp

Filesize
212KB

Download
memory/4168-211-0x00007FFF7BEA0000-0x00007FFF7BEFC000-memory.dmp

Filesize
368KB

Download
memory/4168-210-0x00007FFF83F20000-0x00007FFF83F38000-memory.dmp

Filesize
96KB

Download
memory/4168-209-0x00007FFF83F40000-0x00007FFF83F51000-memory.dmp

Filesize
68KB

Download
memory/4168-199-0x00007FFF7C160000-0x00007FFF7D210000-memory.dmp

Filesize
16.7MB

Download
memory/4168-208-0x00007FFF7C070000-0x00007FFF7C0EC000-memory.dmp

Filesize
496KB

Download
memory/4168-207-0x00007FFF7C0F0000-0x00007FFF7C157000-memory.dmp

Filesize
412KB

Download
memory/4168-206-0x00007FFF8B850000-0x00007FFF8B880000-memory.dmp

Filesize
192KB

Download
memory/4168-205-0x00007FFF8B880000-0x00007FFF8B898000-memory.dmp

Filesize
96KB

Download
memory/4168-204-0x00007FFF8B8A0000-0x00007FFF8B8B1000-memory.dmp

Filesize
68KB

Download
memory/4168-191-0x00007FFF8EB10000-0x00007FFF8EB27000-memory.dmp

Filesize
92KB

Download
memory/4168-202-0x00007FFF8B8E0000-0x00007FFF8B8F1000-memory.dmp

Filesize
68KB

Download
memory/4168-201-0x00007FFF8B900000-0x00007FFF8B911000-memory.dmp

Filesize
68KB

Download
memory/4168-200-0x00007FFF8B920000-0x00007FFF8B931000-memory.dmp

Filesize
68KB

Download
memory/4168-192-0x00007FFF8E740000-0x00007FFF8E751000-memory.dmp

Filesize
68KB

Download
memory/4168-193-0x00007FFF8DEC0000-0x00007FFF8DEDD000-memory.dmp

Filesize
116KB

Download
memory/4168-194-0x00007FFF7D210000-0x00007FFF7D41B000-memory.dmp

Filesize
2.0MB

Download
memory/4168-195-0x00007FFF8BD30000-0x00007FFF8BD41000-memory.dmp

Filesize
68KB

Download
memory/4168-187-0x00007FFF7D650000-0x00007FFF7D906000-memory.dmp

Filesize
2.7MB

Download
memory/4168-197-0x00007FFF8BCB0000-0x00007FFF8BCD1000-memory.dmp

Filesize
132KB

Download
memory/4168-198-0x00007FFF8BC90000-0x00007FFF8BCA8000-memory.dmp

Filesize
96KB

Download
memory/4168-196-0x00007FFF8BCE0000-0x00007FFF8BD21000-memory.dmp

Filesize
260KB

Download
memory/4168-189-0x00007FFF936E0000-0x00007FFF936F7000-memory.dmp

Filesize
92KB

Download
memory/4168-186-0x00007FFF92590000-0x00007FFF925C4000-memory.dmp

Filesize
208KB

Download
memory/4168-185-0x00007FF66DC80000-0x00007FF66DD78000-memory.dmp

Filesize
992KB

Download
memory/5032-161-0x000002DA15AD0000-0x000002DA15BF0000-memory.dmp

Filesize
1.1MB

Download