0b1f0232988dddcb5fba7d5eddcef879865fe1cda56bcf858d4750dccd9ae979

Analysis

user interaction
yes
max time kernel
268s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hytale-2026-05-07-8c147f8.exe
Size 14.8MB
Sample260508-2qrytaft2s
SHA256 0b1f0232988dddcb5fba7d5eddcef879865fe1cda56bcf858d4750dccd9ae979
MD5 652b895ffd919c6ea0b2805b9716b513
SHA1 85d195fa8e84d326c9e82df577310767ea68e29c
SHA512 bfaf10263f38b4ef02c1bca66b28d31047f8ac190b062312f6126a502194abc15f9c618ab2b31e001b37e406836207d294bfe913558979092c33800bf6f8b96b
SSDEEP 393216:6Ems+jEDJ+8XnwYoFryPsSEA0xJRqvi3C5K/:6Lvjy5Xne1yPvEAcRqK3p
TLSH
T1E2F6331BF54CCE64FC9A2C75EAF4D2CD14B1B058057C0DE5A240F286AAFAA85FDD2361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware trojan

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4024	icacls.exe
4528	icacls.exe

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2620	netsh.exe
820	netsh.exe
4368	netsh.exe
2212	netsh.exe
3972	netsh.exe
1948	netsh.exe
3960	netsh.exe
4324	netsh.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	hytale-launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	hytale-launcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe	hytale-2026-05-07-8c147f8.exe
File created	C:\Program Files\Hypixel Studios\Hytale Launcher\uninstall.exe	hytale-2026-05-07-8c147f8.exe
File created	C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe.tmp.1548838577	hytale-launcher.exe
File opened for modification	C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe.tmp.1548838577	hytale-launcher.exe

Executes dropped EXE 4 IoCs

pid	Process
1412	hytale-launcher.exe
2336	hytale-launcher.exe
4940	hytale-launcher.exe
2336	hytale-launcher.exe

Loads dropped DLL 16 IoCs

pid	Process
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe
2492	hytale-2026-05-07-8c147f8.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hytale-launcher.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hytale-launcher.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4312	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hytale-2026-05-07-8c147f8.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1364	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

GoLang User-Agent 6 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	45	Go-http-client/1.1
HTTP User-Agent header	51	Go-http-client/1.1
HTTP User-Agent header	52	Go-http-client/1.1
HTTP User-Agent header	58	Go-http-client/1.1
HTTP User-Agent header	63	Go-http-client/1.1
HTTP User-Agent header	64	Go-http-client/1.1

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227543074722634"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{7BDB19BC-8B75-48C1-9B88-368734395142}	msedge.exe

Modifies system certificate store 2 TTPs 11 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	hytale-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	hytale-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A\Blob = 190000000100000010000000683f58e5528121a89cf21532e700535f030000000100000014000000743af0529bd032a0f44a83cdd4baa97b7c2ec49a7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703041d000000010000001000000056073d58ce8c0d7b5056f74735db0b62140000000100000014000000f960bbd4e3d534f6b8f5068025a773db4669a89e6200000001000000200000002e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c09000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b000000010000005e000000530053004c002e0063006f006d00200045005600200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410020005200320000005300000001000000850000003081823022060c2b0601040182a9300103010430123010060a2b0601040182373c0101030200c03022060c2b0601040182a9300103030230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000020000000cf1152c4bfbd96b6d381b61e0c66e7a74b1185518120396449abe53aaadf640b2000000001000000ef050000308205eb308203d3a003020102020856b629cd34bc78f6300d06092a864886f70d01010b0500308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f7269747920525341205232301e170d3137303533313138313433375a170d3432303533303138313433375a308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f726974792052534120523230820222300d06092a864886f70d01010105000382020f003082020a02820201008f366540e1d64dc0d7b4e946da6bea3347cd4cf97d7dbebd2d3df0db78e186a5d9ba095768ed573ea0d0084183e72841241fe37215d0011afb5e7023b2cb9f39e3cfc54ec6926d26c67bbbb3da279d0a86e9813705fef07171ecc31ce963a217149def1b67d385550202d649c9cc5ae1b1f76f329fc9d43b8841a89cbdcbabdb6d7b091fa24c7290da2b08fccf3c54ce670fa8cf5d96190bc4e372ebadd17d1d27ef92eb10bf5beb3bafcf80ddc1d296045b7a7ea4a93c3876a4628ea0395eea77cf5d00598f662c3e07a2a30526116997ea85b70f960b4bc840e150ba2e8acbf70f9a22e77f9a3713cdf24d136b21d1c0cc22f2a146f644699cca613507006fd6610811eabab8f6e9b360e54db9ec9f1466c95758dbcd8769f88a86120347bf661376ac777d34248583cdd7aa9c901a9f212c7f78b764b8d8e8a6f478b355cb84d232c478aea38f61ddce0853adec88fc15e49a0de69f1a77ce4c8fb814153d629c863806006612e459765a53c00298a2102b68447b8e79ce334a76aa5b81161bb58ad8d0007b5e62b409d686630ea6059549ba288b8893b2341cd8a4556eb71cd0de99553b23f422e0f9296626ec205077db4a0b8fbee5026070415ed4ae5039221426cbb23b7374554707798139a8301344e5048aae961325420fb953c49bfccde41cde3cfaabd6064a1f67a698301cdd2cdbdc18955766c6ff5c8b56f5770203010001a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014f960bbd4e3d534f6b8f5068025a773db4669a89e301d0603551d0e04160414f960bbd4e3d534f6b8f5068025a773db4669a89e300e0603551d0f0101ff040403020186300d06092a864886f70d01010b0500038202010056b38ecb0a9d498ebfa4c491bb661705519875fbe5502c7a9ef114faabd38a3eff91298f638bd8b4a954010dbe93862ff94a6dc75ef557f9ca551c12be470f36c5df6ab7db75c247257fb9f163f8682d5504d1f28db0a4cfbc3c5e1f78e7a5a02070b004c5b7f772a7de220dbd3325468c649226e33e2e6396da9b8c3df81809d703cc7d8682e0ca04075150d7ff92d50cefda869f99d7ebb7af68e2392694ba68b7bf83d3ea7a673d6267ae25e572e8e2e4ecae12f64b2b3c9fe9b040f33854b3fdb768c8dac68f513cb2fb91dc1ce79b9de1b70d728fe2a4c4a978f9eb14acc64305c26539281802c382b29d05be65ed965f65743cfb09352e7b9c13fd1b0f5dc76d813a560fcc3be1af022f22ac46ca463ca01c4cd644b45e2e5c156609e12629fec65261bab173ffc30c9ce56c6a943f14ca40169584f359a9ac5f4c61936dd13bcca2950c22a66767442eb9d9d28a41b3660b5afb7d23a5f21ab0ffde9b83942ed13fdf92b791af053b65c7a06cb1cd6212c3901be325ce34bc6f7776b110c3f7051ac0d6af7462481777926990611cde958074548f181cc3f303d0bfa443758653187a0a2e091c369f91fd828a224bd10e5025ddcb030c17c98300084e354d8a8bedf00294662c447fcb95279617ad0930acb671176e8b17f61c09d42d3b98a571d35413d960f3f54b664ffaf1ee20128db4ac57b14563a1ac76a9c2fb	hytale-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba129030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	hytale-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A\Blob = 040000000100000010000000e11e31581aae545302f6176a117b4d950f0000000100000020000000cf1152c4bfbd96b6d381b61e0c66e7a74b1185518120396449abe53aaadf640b5300000001000000850000003081823022060c2b0601040182a9300103010430123010060a2b0601040182373c0101030200c03022060c2b0601040182a9300103030230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000005e000000530053004c002e0063006f006d00200045005600200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100200052003200000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000002e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c140000000100000014000000f960bbd4e3d534f6b8f5068025a773db4669a89e1d000000010000001000000056073d58ce8c0d7b5056f74735db0b627f000000010000000c000000300a06082b060105050703047e00000001000000080000000000e4add325dc01030000000100000014000000743af0529bd032a0f44a83cdd4baa97b7c2ec49a190000000100000010000000683f58e5528121a89cf21532e700535f2000000001000000ef050000308205eb308203d3a003020102020856b629cd34bc78f6300d06092a864886f70d01010b0500308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f7269747920525341205232301e170d3137303533313138313433375a170d3432303533303138313433375a308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f726974792052534120523230820222300d06092a864886f70d01010105000382020f003082020a02820201008f366540e1d64dc0d7b4e946da6bea3347cd4cf97d7dbebd2d3df0db78e186a5d9ba095768ed573ea0d0084183e72841241fe37215d0011afb5e7023b2cb9f39e3cfc54ec6926d26c67bbbb3da279d0a86e9813705fef07171ecc31ce963a217149def1b67d385550202d649c9cc5ae1b1f76f329fc9d43b8841a89cbdcbabdb6d7b091fa24c7290da2b08fccf3c54ce670fa8cf5d96190bc4e372ebadd17d1d27ef92eb10bf5beb3bafcf80ddc1d296045b7a7ea4a93c3876a4628ea0395eea77cf5d00598f662c3e07a2a30526116997ea85b70f960b4bc840e150ba2e8acbf70f9a22e77f9a3713cdf24d136b21d1c0cc22f2a146f644699cca613507006fd6610811eabab8f6e9b360e54db9ec9f1466c95758dbcd8769f88a86120347bf661376ac777d34248583cdd7aa9c901a9f212c7f78b764b8d8e8a6f478b355cb84d232c478aea38f61ddce0853adec88fc15e49a0de69f1a77ce4c8fb814153d629c863806006612e459765a53c00298a2102b68447b8e79ce334a76aa5b81161bb58ad8d0007b5e62b409d686630ea6059549ba288b8893b2341cd8a4556eb71cd0de99553b23f422e0f9296626ec205077db4a0b8fbee5026070415ed4ae5039221426cbb23b7374554707798139a8301344e5048aae961325420fb953c49bfccde41cde3cfaabd6064a1f67a698301cdd2cdbdc18955766c6ff5c8b56f5770203010001a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014f960bbd4e3d534f6b8f5068025a773db4669a89e301d0603551d0e04160414f960bbd4e3d534f6b8f5068025a773db4669a89e300e0603551d0f0101ff040403020186300d06092a864886f70d01010b0500038202010056b38ecb0a9d498ebfa4c491bb661705519875fbe5502c7a9ef114faabd38a3eff91298f638bd8b4a954010dbe93862ff94a6dc75ef557f9ca551c12be470f36c5df6ab7db75c247257fb9f163f8682d5504d1f28db0a4cfbc3c5e1f78e7a5a02070b004c5b7f772a7de220dbd3325468c649226e33e2e6396da9b8c3df81809d703cc7d8682e0ca04075150d7ff92d50cefda869f99d7ebb7af68e2392694ba68b7bf83d3ea7a673d6267ae25e572e8e2e4ecae12f64b2b3c9fe9b040f33854b3fdb768c8dac68f513cb2fb91dc1ce79b9de1b70d728fe2a4c4a978f9eb14acc64305c26539281802c382b29d05be65ed965f65743cfb09352e7b9c13fd1b0f5dc76d813a560fcc3be1af022f22ac46ca463ca01c4cd644b45e2e5c156609e12629fec65261bab173ffc30c9ce56c6a943f14ca40169584f359a9ac5f4c61936dd13bcca2950c22a66767442eb9d9d28a41b3660b5afb7d23a5f21ab0ffde9b83942ed13fdf92b791af053b65c7a06cb1cd6212c3901be325ce34bc6f7776b110c3f7051ac0d6af7462481777926990611cde958074548f181cc3f303d0bfa443758653187a0a2e091c369f91fd828a224bd10e5025ddcb030c17c98300084e354d8a8bedf00294662c447fcb95279617ad0930acb671176e8b17f61c09d42d3b98a571d35413d960f3f54b664ffaf1ee20128db4ac57b14563a1ac76a9c2fb	hytale-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A\Blob = 5c000000010000000400000000100000190000000100000010000000683f58e5528121a89cf21532e700535f030000000100000014000000743af0529bd032a0f44a83cdd4baa97b7c2ec49a7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703041d000000010000001000000056073d58ce8c0d7b5056f74735db0b62140000000100000014000000f960bbd4e3d534f6b8f5068025a773db4669a89e6200000001000000200000002e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c09000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b000000010000005e000000530053004c002e0063006f006d00200045005600200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410020005200320000005300000001000000850000003081823022060c2b0601040182a9300103010430123010060a2b0601040182373c0101030200c03022060c2b0601040182a9300103030230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000020000000cf1152c4bfbd96b6d381b61e0c66e7a74b1185518120396449abe53aaadf640b040000000100000010000000e11e31581aae545302f6176a117b4d952000000001000000ef050000308205eb308203d3a003020102020856b629cd34bc78f6300d06092a864886f70d01010b0500308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f7269747920525341205232301e170d3137303533313138313433375a170d3432303533303138313433375a308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f726974792052534120523230820222300d06092a864886f70d01010105000382020f003082020a02820201008f366540e1d64dc0d7b4e946da6bea3347cd4cf97d7dbebd2d3df0db78e186a5d9ba095768ed573ea0d0084183e72841241fe37215d0011afb5e7023b2cb9f39e3cfc54ec6926d26c67bbbb3da279d0a86e9813705fef07171ecc31ce963a217149def1b67d385550202d649c9cc5ae1b1f76f329fc9d43b8841a89cbdcbabdb6d7b091fa24c7290da2b08fccf3c54ce670fa8cf5d96190bc4e372ebadd17d1d27ef92eb10bf5beb3bafcf80ddc1d296045b7a7ea4a93c3876a4628ea0395eea77cf5d00598f662c3e07a2a30526116997ea85b70f960b4bc840e150ba2e8acbf70f9a22e77f9a3713cdf24d136b21d1c0cc22f2a146f644699cca613507006fd6610811eabab8f6e9b360e54db9ec9f1466c95758dbcd8769f88a86120347bf661376ac777d34248583cdd7aa9c901a9f212c7f78b764b8d8e8a6f478b355cb84d232c478aea38f61ddce0853adec88fc15e49a0de69f1a77ce4c8fb814153d629c863806006612e459765a53c00298a2102b68447b8e79ce334a76aa5b81161bb58ad8d0007b5e62b409d686630ea6059549ba288b8893b2341cd8a4556eb71cd0de99553b23f422e0f9296626ec205077db4a0b8fbee5026070415ed4ae5039221426cbb23b7374554707798139a8301344e5048aae961325420fb953c49bfccde41cde3cfaabd6064a1f67a698301cdd2cdbdc18955766c6ff5c8b56f5770203010001a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014f960bbd4e3d534f6b8f5068025a773db4669a89e301d0603551d0e04160414f960bbd4e3d534f6b8f5068025a773db4669a89e300e0603551d0f0101ff040403020186300d06092a864886f70d01010b0500038202010056b38ecb0a9d498ebfa4c491bb661705519875fbe5502c7a9ef114faabd38a3eff91298f638bd8b4a954010dbe93862ff94a6dc75ef557f9ca551c12be470f36c5df6ab7db75c247257fb9f163f8682d5504d1f28db0a4cfbc3c5e1f78e7a5a02070b004c5b7f772a7de220dbd3325468c649226e33e2e6396da9b8c3df81809d703cc7d8682e0ca04075150d7ff92d50cefda869f99d7ebb7af68e2392694ba68b7bf83d3ea7a673d6267ae25e572e8e2e4ecae12f64b2b3c9fe9b040f33854b3fdb768c8dac68f513cb2fb91dc1ce79b9de1b70d728fe2a4c4a978f9eb14acc64305c26539281802c382b29d05be65ed965f65743cfb09352e7b9c13fd1b0f5dc76d813a560fcc3be1af022f22ac46ca463ca01c4cd644b45e2e5c156609e12629fec65261bab173ffc30c9ce56c6a943f14ca40169584f359a9ac5f4c61936dd13bcca2950c22a66767442eb9d9d28a41b3660b5afb7d23a5f21ab0ffde9b83942ed13fdf92b791af053b65c7a06cb1cd6212c3901be325ce34bc6f7776b110c3f7051ac0d6af7462481777926990611cde958074548f181cc3f303d0bfa443758653187a0a2e091c369f91fd828a224bd10e5025ddcb030c17c98300084e354d8a8bedf00294662c447fcb95279617ad0930acb671176e8b17f61c09d42d3b98a571d35413d960f3f54b664ffaf1ee20128db4ac57b14563a1ac76a9c2fb	hytale-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	hytale-launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A	hytale-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A\Blob = 0f0000000100000020000000cf1152c4bfbd96b6d381b61e0c66e7a74b1185518120396449abe53aaadf640b5300000001000000850000003081823022060c2b0601040182a9300103010430123010060a2b0601040182373c0101030200c03022060c2b0601040182a9300103030230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000005e000000530053004c002e0063006f006d00200045005600200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100200052003200000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000002e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c140000000100000014000000f960bbd4e3d534f6b8f5068025a773db4669a89e1d000000010000001000000056073d58ce8c0d7b5056f74735db0b627f000000010000000c000000300a06082b060105050703047e00000001000000080000000000e4add325dc01030000000100000014000000743af0529bd032a0f44a83cdd4baa97b7c2ec49a2000000001000000ef050000308205eb308203d3a003020102020856b629cd34bc78f6300d06092a864886f70d01010b0500308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f7269747920525341205232301e170d3137303533313138313433375a170d3432303533303138313433375a308182310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3137303506035504030c2e53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f726974792052534120523230820222300d06092a864886f70d01010105000382020f003082020a02820201008f366540e1d64dc0d7b4e946da6bea3347cd4cf97d7dbebd2d3df0db78e186a5d9ba095768ed573ea0d0084183e72841241fe37215d0011afb5e7023b2cb9f39e3cfc54ec6926d26c67bbbb3da279d0a86e9813705fef07171ecc31ce963a217149def1b67d385550202d649c9cc5ae1b1f76f329fc9d43b8841a89cbdcbabdb6d7b091fa24c7290da2b08fccf3c54ce670fa8cf5d96190bc4e372ebadd17d1d27ef92eb10bf5beb3bafcf80ddc1d296045b7a7ea4a93c3876a4628ea0395eea77cf5d00598f662c3e07a2a30526116997ea85b70f960b4bc840e150ba2e8acbf70f9a22e77f9a3713cdf24d136b21d1c0cc22f2a146f644699cca613507006fd6610811eabab8f6e9b360e54db9ec9f1466c95758dbcd8769f88a86120347bf661376ac777d34248583cdd7aa9c901a9f212c7f78b764b8d8e8a6f478b355cb84d232c478aea38f61ddce0853adec88fc15e49a0de69f1a77ce4c8fb814153d629c863806006612e459765a53c00298a2102b68447b8e79ce334a76aa5b81161bb58ad8d0007b5e62b409d686630ea6059549ba288b8893b2341cd8a4556eb71cd0de99553b23f422e0f9296626ec205077db4a0b8fbee5026070415ed4ae5039221426cbb23b7374554707798139a8301344e5048aae961325420fb953c49bfccde41cde3cfaabd6064a1f67a698301cdd2cdbdc18955766c6ff5c8b56f5770203010001a3633061300f0603551d130101ff040530030101ff301f0603551d23041830168014f960bbd4e3d534f6b8f5068025a773db4669a89e301d0603551d0e04160414f960bbd4e3d534f6b8f5068025a773db4669a89e300e0603551d0f0101ff040403020186300d06092a864886f70d01010b0500038202010056b38ecb0a9d498ebfa4c491bb661705519875fbe5502c7a9ef114faabd38a3eff91298f638bd8b4a954010dbe93862ff94a6dc75ef557f9ca551c12be470f36c5df6ab7db75c247257fb9f163f8682d5504d1f28db0a4cfbc3c5e1f78e7a5a02070b004c5b7f772a7de220dbd3325468c649226e33e2e6396da9b8c3df81809d703cc7d8682e0ca04075150d7ff92d50cefda869f99d7ebb7af68e2392694ba68b7bf83d3ea7a673d6267ae25e572e8e2e4ecae12f64b2b3c9fe9b040f33854b3fdb768c8dac68f513cb2fb91dc1ce79b9de1b70d728fe2a4c4a978f9eb14acc64305c26539281802c382b29d05be65ed965f65743cfb09352e7b9c13fd1b0f5dc76d813a560fcc3be1af022f22ac46ca463ca01c4cd644b45e2e5c156609e12629fec65261bab173ffc30c9ce56c6a943f14ca40169584f359a9ac5f4c61936dd13bcca2950c22a66767442eb9d9d28a41b3660b5afb7d23a5f21ab0ffde9b83942ed13fdf92b791af053b65c7a06cb1cd6212c3901be325ce34bc6f7776b110c3f7051ac0d6af7462481777926990611cde958074548f181cc3f303d0bfa443758653187a0a2e091c369f91fd828a224bd10e5025ddcb030c17c98300084e354d8a8bedf00294662c447fcb95279617ad0930acb671176e8b17f61c09d42d3b98a571d35413d960f3f54b664ffaf1ee20128db4ac57b14563a1ac76a9c2fb	hytale-launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000190000000100000010000000787d09f953c59978ecd8d6e44b38e24f0f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	hytale-launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A	hytale-launcher.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3368	msedgewebview2.exe
724	msedgewebview2.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	whoami.exe
Token: SeDebugPrivilege	4312	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2324	2492	hytale-2026-05-07-8c147f8.exe	93
PID 2492 wrote to memory of 2504	2492	hytale-2026-05-07-8c147f8.exe	99
PID 2492 wrote to memory of 4024	2492	hytale-2026-05-07-8c147f8.exe	101
PID 2492 wrote to memory of 4528	2492	hytale-2026-05-07-8c147f8.exe	103
PID 2492 wrote to memory of 3972	2492	hytale-2026-05-07-8c147f8.exe	106
PID 2492 wrote to memory of 1948	2492	hytale-2026-05-07-8c147f8.exe	108
PID 2492 wrote to memory of 3960	2492	hytale-2026-05-07-8c147f8.exe	110
PID 2492 wrote to memory of 4324	2492	hytale-2026-05-07-8c147f8.exe	112
PID 2492 wrote to memory of 2620	2492	hytale-2026-05-07-8c147f8.exe	114
PID 2492 wrote to memory of 820	2492	hytale-2026-05-07-8c147f8.exe	116
PID 2492 wrote to memory of 4368	2492	hytale-2026-05-07-8c147f8.exe	118
PID 2492 wrote to memory of 2212	2492	hytale-2026-05-07-8c147f8.exe	120
PID 2492 wrote to memory of 4344	2492	hytale-2026-05-07-8c147f8.exe	122
PID 1644 wrote to memory of 1412	1644	explorer.exe	124
PID 1412 wrote to memory of 3368	1412	hytale-launcher.exe	126
PID 3368 wrote to memory of 4228	3368	msedgewebview2.exe	127
PID 3368 wrote to memory of 960	3368	msedgewebview2.exe	128
PID 3368 wrote to memory of 960	3368	msedgewebview2.exe	128
PID 3368 wrote to memory of 960	3368	msedgewebview2.exe	128
PID 3368 wrote to memory of 5040	3368	msedgewebview2.exe	129
PID 3368 wrote to memory of 4324	3368	msedgewebview2.exe	130
PID 3368 wrote to memory of 4324	3368	msedgewebview2.exe	130
PID 3368 wrote to memory of 228	3368	msedgewebview2.exe	131
PID 3368 wrote to memory of 228	3368	msedgewebview2.exe	131
PID 3368 wrote to memory of 228	3368	msedgewebview2.exe	131
PID 1412 wrote to memory of 2336	1412	hytale-launcher.exe	132
PID 1412 wrote to memory of 4940	1412	hytale-launcher.exe	134
PID 4940 wrote to memory of 2960	4940	hytale-launcher.exe	136
PID 3200 wrote to memory of 2336	3200	explorer.exe	138
PID 2336 wrote to memory of 724	2336	hytale-launcher.exe	139
PID 724 wrote to memory of 1240	724	msedgewebview2.exe	140
PID 724 wrote to memory of 4368	724	msedgewebview2.exe	141
PID 724 wrote to memory of 4368	724	msedgewebview2.exe	141
PID 724 wrote to memory of 4368	724	msedgewebview2.exe	141
PID 724 wrote to memory of 3936	724	msedgewebview2.exe	142
PID 724 wrote to memory of 1372	724	msedgewebview2.exe	143
PID 724 wrote to memory of 1372	724	msedgewebview2.exe	143
PID 724 wrote to memory of 1748	724	msedgewebview2.exe	144
PID 724 wrote to memory of 1748	724	msedgewebview2.exe	144
PID 724 wrote to memory of 1748	724	msedgewebview2.exe	144
PID 2336 wrote to memory of 4312	2336	hytale-launcher.exe	145
PID 2336 wrote to memory of 3732	2336	hytale-launcher.exe	147
PID 3732 wrote to memory of 756	3732	msedge.exe	148
PID 756 wrote to memory of 3252	756	msedge.exe	149
PID 756 wrote to memory of 1364	756	msedge.exe	150
PID 756 wrote to memory of 3968	756	msedge.exe	151
PID 756 wrote to memory of 3968	756	msedge.exe	151
PID 756 wrote to memory of 3968	756	msedge.exe	151
PID 756 wrote to memory of 2412	756	msedge.exe	153
PID 756 wrote to memory of 2412	756	msedge.exe	153
PID 756 wrote to memory of 3512	756	msedge.exe	155
PID 756 wrote to memory of 3512	756	msedge.exe	155
PID 756 wrote to memory of 3512	756	msedge.exe	155
PID 756 wrote to memory of 5000	756	msedge.exe	154
PID 756 wrote to memory of 5000	756	msedge.exe	154
PID 756 wrote to memory of 5000	756	msedge.exe	154
PID 756 wrote to memory of 3264	756	msedge.exe	156
PID 756 wrote to memory of 3264	756	msedge.exe	156
PID 756 wrote to memory of 3264	756	msedge.exe	156
PID 756 wrote to memory of 2440	756	msedge.exe	157
PID 756 wrote to memory of 2440	756	msedge.exe	157
PID 756 wrote to memory of 2440	756	msedge.exe	157
PID 756 wrote to memory of 3532	756	msedge.exe	159
PID 756 wrote to memory of 3532	756	msedge.exe	159

C:\Users\Admin\AppData\Local\Temp\hytale-2026-05-07-8c147f8.exe
"C:\Users\Admin\AppData\Local\Temp\hytale-2026-05-07-8c147f8.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\whoami.exe
  whoami /user /fo csv /nh
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\SysWOW64\reg.exe
  reg add "HKU\S-1-5-21-745935970-1373868228-562466063-1000\Software\Hypixel Studios\Hytale" /v GameInstallPath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Hytale" /f /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Roaming\Hytale"
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4024
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Roaming\Hytale" /grant *S-1-5-21-745935970-1373868228-562466063-1000:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4528
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Hytale Client" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\game\latest\Client\HytaleClient.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3972
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Hytale Client" dir=out action=allow program="C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\game\latest\Client\HytaleClient.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1948
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Hytale Client Pre-Release" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Hytale\install\pre-release\package\game\latest\Client\HytaleClient.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3960
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Hytale Client Pre-Release" dir=out action=allow program="C:\Users\Admin\AppData\Roaming\Hytale\install\pre-release\package\game\latest\Client\HytaleClient.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4324
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Hytale JRE" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\jre\latest\bin\java.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Hytale JRE" dir=out action=allow program="C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\jre\latest\bin\java.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:820
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Hytale JRE Pre-Release" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Hytale\install\pre-release\package\jre\latest\bin\java.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4368
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Hytale JRE Pre-Release" dir=out action=allow program="C:\Users\Admin\AppData\Roaming\Hytale\install\pre-release\package\jre\latest\bin\java.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2212
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe"
  2⤵
  PID:4344

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe
  "C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-8c147f8 --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=1412.2472.9235054864544944722
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffb73dfb078,0x7ffb73dfb084,0x7ffb73dfb090
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-8c147f8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,6255593608679413587,12788250289440362960,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-8c147f8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,6255593608679413587,12788250289440362960,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-8c147f8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,6255593608679413587,12788250289440362960,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-8c147f8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,6255593608679413587,12788250289440362960,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:228
- - C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\launcher\2026.05.07-c55b318\hytale-launcher.exe
    C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\launcher\2026.05.07-c55b318\hytale-launcher.exe -test
    3⤵
    - Executes dropped EXE
    PID:2336
- - C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\launcher\2026.05.07-c55b318\hytale-launcher.exe
    "C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\launcher\2026.05.07-c55b318\hytale-launcher.exe" -start-pid 1412 -source-exe C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\launcher\2026.05.07-c55b318\hytale-launcher.exe -dest-exe "C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe" -launcher-patchline release -launcher-version 2026.05.07-c55b318
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe
      4⤵
      PID:2960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe
  "C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-c55b318 --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=2336.2908.4983689139820409572
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x1b8,0x7ffb73dfb078,0x7ffb73dfb084,0x7ffb73dfb090
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-c55b318 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1848,i,16105059907309949122,8913681822691236728,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-c55b318 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2096,i,16105059907309949122,8913681822691236728,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-c55b318 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,16105059907309949122,8913681822691236728,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView" --webview-exe-name=hytale-launcher.exe --webview-exe-version=2026.05.07-c55b318 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,16105059907309949122,8913681822691236728,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:1748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command (Get-Culture).TwoLetterISOLanguageName
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oauth.accounts.hytale.com/oauth2/auth?access_type=offline&client_id=hytale-launcher&code_challenge=XaS2--pE4CEzTgB7cCgdnWZObqavLcDjnZ9PCodiWqY&code_challenge_method=S256&redirect_uri=https%3A%2F%2Faccounts.hytale.com%2Fconsent%2Fclient&response_type=code&scope=openid+offline+auth%3Alauncher&state=eyJzdGF0ZSI6IkVPSERaV0xPV0dXTkZVTlJPVFRBSVpESURFIiwicG9ydCI6IjUwNjU5In0%3D
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://oauth.accounts.hytale.com/oauth2/auth?access_type=offline&client_id=hytale-launcher&code_challenge=XaS2--pE4CEzTgB7cCgdnWZObqavLcDjnZ9PCodiWqY&code_challenge_method=S256&redirect_uri=https%3A%2F%2Faccounts.hytale.com%2Fconsent%2Fclient&response_type=code&scope=openid+offline+auth%3Alauncher&state=eyJzdGF0ZSI6IkVPSERaV0xPV0dXTkZVTlJPVFRBSVpESURFIiwicG9ydCI6IjUwNjU5In0%3D
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffb7579c188,0x7ffb7579c194,0x7ffb7579c1a0
        5⤵
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,17983444788571079089,13736723464378943929,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:1364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,263128355987350096,5196306066032445065,262144 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
        5⤵
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,10795078858393160318,8288377660266455390,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
        5⤵
        
        PID:2412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,9443834054693938865,14839437964479690348,2097152 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
        5⤵
        
        PID:5000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,9184379292480743066,13588794277336917319,2097152 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,11683163053016071578,3684698576627823376,2097152 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
        5⤵
        
        PID:3264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,9040315012895704968,11700040265540459512,2097152 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
        5⤵
        
        PID:2440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,7794541664130489205,100365978686379471,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:8
        5⤵
        
        PID:3532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,18121475983425455949,15804167166734262160,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
        5⤵
        
        PID:1512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,16641735747115959867,104546919747366746,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
        5⤵
        
        PID:1332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,4520198896253260598,1557799472982084750,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
        5⤵
        
        PID:672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15519306879054786720,5987166302129738821,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
        5⤵
        
        PID:2076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15519306879054786720,5987166302129738821,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
        5⤵
        
        PID:3700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,17164029904825770862,18269848054985440669,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
        5⤵
        
        PID:4004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,13944879833291656582,16618072692299999047,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
        5⤵
        
        PID:1656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,5335498462455714960,7410381895671690186,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
        5⤵
        
        PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16124364948045101578,17436908543020601744,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
        5⤵
        
        PID:1656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,18044199503321268012,15852792043566124246,524288 --field-trial-handle=2216,i,8689042540443027532,15563476522874442639,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
        5⤵
        
        PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hytale-launcher.exe

Path C:\Program Files\Hypixel Studios\Hytale Launcher\hytale-launcher.exe
Size 26.3MB
SHA256 4b35284a17d72956038a8325259355f6665e70df75b6425e33bf6e821e78d315
MD5 0dc1124b80142bbd9938b240592d4848
SHA1 eda5f6c1cefcc0bff654ff76c9fb6ba4bd7679f1
SHA512 4969ce8a1bea8b9d585f631cbfbf693e931db0ef3b7199e82a2a93d78e8c96fee2fa5f1d3b8ed0fc9a62ea76f82a4fcb7dbf8b253271c9aab57aecbc9cc2c2db
SSDEEP 196608:8wszLq+e286vZq9wgdQeppTbs3h51LFz9mr26CYaBmzD7F3:8Vz49Bsx/FzcH1
TLSH
T12A579C43FD6609E5D0EED670C53251227FB17C454B2023EB1AA4B6286F77BD0AEBA350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 346ea60a0ae4d17c01949616e7832cf3b359983afcbb7e8912fe8a59321ed461
MD5 203e8ac15dc2fa01607dca121531cbf9
SHA1 6bb9e33e0eaaee142dcc669c175ec6b9508af90e
SHA512 9cbb9572308545c1a11487db03ac7301a81dad98c83fd39ad60fc0ba640dee016818808cbd7f5e840f2b2084982cd60ac725f84529aac2387baa86bafeb505f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1d5424e3203c3272db4f9cd9e0161e78bf7ec337d47156675c54f4d3d506d304
MD5 8212224641bfd663af879f2432d08605
SHA1 0a8c1e47a8f5685459133bd46e371a096422b444
SHA512 eb3d78eec2daf44f68dde59f88f997b77e5f4073744be69b8762cc4ec27f95007c3e9c5241c43b52caf353244173e80c0cce66f49b93fb82ff4ebe6c9753be89
TLSH
T1EED0A736B74A7411E66D81315523C31A1B2A84A469974581E22CC64CEBFC1D857C71D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d812d63b94e52acac0ff3d23d196b3c185f5ddb1e01deeb75aec3c1bafd468e
MD5 6152b0c1f75d5d080bcd3802185a9245
SHA1 4f64d728e6f0df535705d56e0e7a69fc1e71917c
SHA512 28c794bb2d2495521df039966b1a9e94a2843c311371b43db2ea79c54226693c48e9527fea13c5656d1ef3768cdbacfe060b82385bc27c6d4a2715b8b656c7da
TLSH
T1C3D0C00C73722C30C4C9CC300858730F2D19C8F28E42436254371A385DC20C045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8b794ddae1c182cd5bdf3280502fc20e0d1bbb83fa98695dd9554e580b515db
MD5 e2acf35f85cc51742b6dbfd089a22de7
SHA1 d2f831a4d2d2a72bc82294e0db4496d425f3c241
SHA512 dc7c313b6984de31fba866906b65c34a375452af96f5f8d900080a50233e15566612618b446d95b3283af79511b9492a004b9a8f220a70ac98cbe8ba536fdac4
TLSH
T1A8D0C00CB3322C30C0C9CC300859730F2D19C8F28E42036154371A386DC108045C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 28fe2b9e59bda111bc6575154ad81fa0b4345d27306ae5c6f4952c33b805ac73
MD5 af3a7d5b18504dbe12f812ea001d98c5
SHA1 f4aedde2046431b494a6ccb680fdb9e88112ad3e
SHA512 da4cd9089b23d958b65d972da7092449693571c0d7a68f04353a1d1ed8d3399d4290bd0f8a072526146369a0555f52b16d62c3092d6ac185481289d774c4166e
TLSH
T19C817189606580C5EFE690B05EAA128B3370C76FA1FB0E2935F0263EDB99F6E4341604
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bdd7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5bdd7c.TMP
Size 3KB
SHA256 db26979e141313b67988e8fc3b6608a95b648d40effed9a99869e38a8785fda6
MD5 38d7d6e9360f5074a1ed0672227469fa
SHA1 050b9b7dec6372643ddd7fd1da872d1dbe28f7a6
SHA512 8060893bcf2ba57c9e764f7932633d5986e9e10982a4ebf2b649840caf0cb991c8fcee505999efa787ce4a0cf37ac6021687411bbf9fec0de39d489f5daedb3b
TLSH
T1B5613C49406A8088EFE450B05EAA109B73B0C76F21FB5E6A35F4473EDB9EF6E4385614
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5558062cff25592e0c2e0127e5342f581df9dc0d029678696c82aea25e22307e
MD5 ca1a18ede775f547e9f2ef144e16f787
SHA1 4301d9f946993e2778fce2ff242b07588cf3ebdc
SHA512 dcf501797dbf167a2cf0f5267b8c80cb15416622875bec3df85cc1cfc967ab4f08ef7b5fa900ef2a888a88ef551cca47dd0a74ea4fa2f975f27b89e9419ed545
TLSH
T1F851AFF7C7E8856E8D1156F0AA24AE1FCE2D0918431C3D6A85E4AF0BD3E3571D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 215356ce5dc6064c727d145bd77be493d38da1853e476b1060d86eb52183c013
MD5 9ec3522ec88cef5881352cf9cc9ce656
SHA1 6006dfef5f87d7173fd79048bdf8a955ca77b6b4
SHA512 a242e5242ea77378724b3e540823a9b732e7a7feace008b0691bf8929f0ee7362c2100f2c881be539c84a0264281954121245876106f5afaeb7796204a1d19b3
SSDEEP 192:sxZGRSyM//K1Ml8Mii/f0sElSnU3BIdpTyHW6+WNWDz/z9oqlGDIg4J:sxZGoqi/f0sEEcq2Hby/Mc
TLSH
T1B052E706AA385A77CCDBD219BA15BF53D6F54563D2840E4499FC8B0C00E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 173351e4ec88143ac28c73a46f8e9fd4b8444d0efe71b3d73e43067b9b8546ea
MD5 aace4d30843df65547b15bf1da6c9174
SHA1 93fa96b9519bfe970dae42456b38a4675780878b
SHA512 d217e59b39e6dc18058d219258839907aa2d1ecb001f020aae7219ef8432812be207ba6973ec940a7b196cb078bff96a990e2b47d281528af798a6b17994c275
SSDEEP 192:sxZGRSyM//K1Ml8Gji/f0sTWpVXlSnUxBIdpTyHW6+WNCrDz/z9goVjrRIgbMJ:sxZGozi/f0sTWvXESq2Hba/BB8
TLSH
T14762D606AA385A77CCD6D319FA55BF53D7F9092292940E44A9FC8B0C00E6BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 19a124d407a44b629540f97c179ba6458ec7b3d204f7e8103cf0d89e794bdbb0
MD5 92f94bb83f6ff2f157377e1c7d906318
SHA1 f5dbd83b41378cc3dc399045c983b0d04e8dc319
SHA512 6d17a645ce9206689d1eb738ec2af78cdebf619e92d17f3780df070e18441d2604bbdb0c0034423e04bdd67b7d626aa042f62b1cb08e01ec742710f7f7e63746
SSDEEP 768:xasalzb7pLuLnNVWvNT6D8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHlwoLl6QF5CroI:xasalztEnNVWvNT6Du1jaWlwoLIs5Zfw
TLSH
T1D9F2FA3B6C0CCB7E4F804E9CEC2A7E8B6DE801CB96D8899447E9844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 924da5137e5bcb86fbdf548703e120407e0708387ea080b6f3cc962f0bdf646f
MD5 ff70a1b160f654876ed982a6ec344bfc
SHA1 f9c40befcfa7ef3a1706da9eb05ac444889ed865
SHA512 4d8f593f30a1996fc0df3a699bec213fe530c86914e9fc9a1f700765c1dadf455322f51f25579180c82b8aaa78d9789a2e778222d61234625a71efae809e79cf
SSDEEP 96:KoleKm8sCoKTa6u12KmURm4KjS2CGcK76r:EWX5xbfM
TLSH
T103D15B89317F02A53A3D285D9894B42F46C135633069E92BBBB800A50F67E60DDFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 22509c23d330652d3b3ae3e5d7d2d4418593e6c9562df1e9d502acd284c5fec1
MD5 cfeb34b9c3d3b412c9ef28d850146a95
SHA1 ebf5ec4865fddabf800594bc134b0ccb53475517
SHA512 8aeaada886f1680b746bc8fd820c2d72e5ddb82b886092cc4eb0f7d9df26536c891401a9416d2a1bbc7c13d8cff4cb64fda9acf029bfffbb9b113d25eb439af8
SSDEEP 192:IONk6QnQmiUy4QYZ/COQK5RxPv2RtnHqUSVU6:IONk6UsYZ/CO/deXWU6
TLSH
T16A120A32B9785C3B5EF2A554F84736135EE5416BEA8A7F80D5DC2F0C01EFA9C234A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 db9d39aa8b83b364147c188fc084d521f03610c6872b7b138aaf0cf2037dd117
MD5 e9518cc1d3027bbb167307286bb29af2
SHA1 ea2eebf11c6031b747541d784cc49c640ce4418b
SHA512 11a89a66057a088310a3c6b5573dda3981b29b3a3a2904dda8ce2daf6c74ed77327fa849d54268233baeb8a730f5b187d76f52812cd02ba22a0f4c37f79f1cc4
SSDEEP 384:nNCcmyWCXsNhatVQnIX4E/CO/dXTWe4KV8p0HHi:scpXTtJXL6OlXTWI8p0ni
TLSH
T1DD827E32A87C0D7B5DE2A318F80B29079EF5957B97C56F54DADC9F0D01EA2AC130B416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d560412b53e03d884d165eb7340cd2d703c6b0a4fdf4aa7363e45cfb71b3838d
MD5 b03278dcc98da23762b6a3b375d8de23
SHA1 3fea07ac743f78ba7b18d0dc818fea2314884428
SHA512 d1ffde233f3214e4b2c404185ca6f42862407638d4311c9ddf65ad98f35ec44dc7988673f692c54b42d29c3de075b8522cd504d68fd0a3aa5f56532413220b7b
SSDEEP 384:npCcmyWCXsNhatVQncX4E/CO/dXTXRAStkf/ob+KqzmLwSVe4KV8p0HHi:wcpXTt7XL6OlXT+SzaKqzqTVI8p0ni
TLSH
T197B24AB1D8A90DF744E1EAC8A907E5132DE8453B86C95D1CDBF9BB3A309F5B81306022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 94baaafabd5b8e3bf218d93c5bbccee04f307937c323c3660c1f02fd2f78d214
MD5 9ab2777c983b1d170f6cf07c6260f34d
SHA1 a66a031d32c14c406cb6edb69691947761f82498
SHA512 2edace482974a3b388da921b6850f0b1443617c1d32e6ed5befe145231cd7024dc1cc450e2b12dc76cf30645c7860a51b732579103560e445a734d118f084673
SSDEEP 192:gONg6QaQmiUy8QwZ/COQK5RxJRxMpz8U6:gONg6vmwZ/CO/zoB8U6
TLSH
T19202E835B9782C7B8EF2AE09B44B67275FE4106BE9962F84DAD81F0C00D769C1346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b75b9b60-d885-454c-8fe4-3d872e8f05b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b75b9b60-d885-454c-8fe4-3d872e8f05b8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fgtzpuz3.hgr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fgtzpuz3.hgr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a230f7b2-9736-4b17-835d-b4b12ce4d5b8.tmp

Path C:\Users\Admin\AppData\Local\Temp\a230f7b2-9736-4b17-835d-b4b12ce4d5b8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ee2714cf-6d30-4d9e-8601-5bca0afeca10.tmp

Path C:\Users\Admin\AppData\Local\Temp\ee2714cf-6d30-4d9e-8601-5bca0afeca10.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nstE7A2.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nstE7A2.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nstE7A2.tmp\ioSpecial.ini
Size 980B
SHA256 7b974ae9a29c1445b49c1d618b033fda5ba47213a700f3181e705ab5ceecdce7
MD5 07ac724cb7f9cee231dab2b7806d50f9
SHA1 6be0f9481633715c71c1195774fe26c07b12c6f0
SHA512 58503e989e8307230186e4ad2d04d805fd804a4c1bb166c6ed015b4221bae44b453edc75f1f98f48e3988a1f5185810e1bf2e148f08178f9a85669d59570288b
TLSH
T15E11AC133EE85014F2BBB608FEF480758B39B811982DC50E81D14A0E48E1B808863BEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nstE7A2.tmp\ioSpecial.ini
Size 1KB
SHA256 69fad11704fcf6e583a658477bede5096267cb552c1e17f74fd549420b8933c5
MD5 091f15fda7fa9f7539222bf4dbfc4aa4
SHA1 0eafe46673f0dfaaa4d98c159dc816ed8a3d6740
SHA512 6e9b18f198c588558cd3597643f4373f6c59d50ec56a582affcc6d91f5c49ffb1046483b009e38b0860b897eb3dc624f5edf05c04d5ff842b644481e9220f280
TLSH
T142319F132EE91024E1BBBA08FFF580759B387856582DD51E91D14A4F48F6A808867BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nstE7A2.tmp\ioSpecial.ini
Size 1KB
SHA256 1ecb33544e5baf7ba44dc99b53ab319cea0894dbeaaf4dc3c1c31f0dee0c6bbf
MD5 04e7b46524af935cd017152c29f1773a
SHA1 003643913b6db9eae2228f8a763694474440078d
SHA512 7625c423291ab243a02ac39a7e3e7c10ab540332c5d51373f7d8ca79675dec54220cbafca10e695bcd5d8950561f6dea7a363539ee274f6eea516333ce0051d5
TLSH
T11631B4132EED0024E1BBB648FFF5807597347852582DD90E91D10B0F44F6A808927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nstE7A2.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nstE7A2.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a2b53d-31d1-44c1-878c-fdc45235bd21.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir756_1526125081\e5a2b53d-31d1-44c1-878c-fdc45235bd21.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir756_1740983362\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CE2C1010-7741-4834-9B96-73ABDABC6B6C.key

Path C:\Users\Admin\AppData\Roaming\Hytale\.keys\CE2C1010-7741-4834-9B96-73ABDABC6B6C.key
Size 262B
SHA256 e170c0ddc699ef2c0cf742e7abb7c20277fdb4a14f2b6508f4ffa6736b0d4de3
MD5 1ae0aa079becbc78448bb81c1415d895
SHA1 1a80cb474d5905b8a9ec86db8a7f3e22acedd037
SHA512 07e81a81556c2a69ded949653ffa8478e9238e0441d5e5ef1415231840879f39fdf02f194bdbc89c37a9bacc60620792902dca4cfc217fee66fe12f73d1bfe53
TLSH
T1F4D02B4AA15A4053D1E85FF8CCD7198515E1890095B58D9D4A465410C3316808011E66
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 91b34a72320d67da6196313fdcd599e33d8c94a06f2607e2b2b81b43f59fbbf5
MD5 1055f5f669dab1b483768b9596e64e1e
SHA1 fd0c6f491fc8a09a53665bc61bc40da6417d5b84
SHA512 10dc90e4adcb5e47ea8172a229cd87c0989cf45ac15ab6ef2937d30e18c848fb6245bf3d2db8f0f92186a9a482fb7462776bc6a5a85221a87fb6504b846009f6
TLSH
T1A9D00414530001C0D55411734414C14035144C0417130300D770551D55C1101404D005
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7f5bdf9e2f99593b8ac772fe10a320f96e427a85d6bc7b793483c8e808377a8f
MD5 2702b610bdfa19b573dea1ae341f3d74
SHA1 9cb4551e202087d8d8291a7f3f1a09b27b63fd62
SHA512 4a859d87bdea4fce10775c3d4f733a86f52aaaf595b8f5b2aedafec0841d17ae25b70364bd4d06e0d41da4f367985bf27894eb59efe5262aee1abfcd4388d655
TLSH
T156D01216330102F4C42021730402A1482800C90F42064100E938DA2E6B44050090A442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e404d43dddd3db9f60107355c466471c1174bd06d9c2a480f23333525e4e0772
MD5 07aaac7e3c401f9132d464539e173a3f
SHA1 9379851dd6d4ff37f560225d4042307ac8ea9411
SHA512 8e065fb4e4d371f4e870eeafb983beded8cbe93a688d8c11e64805d9257426d9b416ecc67dc6cc6de0a712715ebb0a5fd0bef21b78a499158efddc1de747838b
TLSH
T18BD01216370102F4C42022730401A1482900C80E43064200E938CA3E6F45050494A442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 631b6706b065e27e2ac322c8754c4b2717e18c32c10e08187de5438e08aaf8ce
MD5 9f8da894cdd81fe050826de792db10be
SHA1 428202395124ffa3e1e2efea2d3c25c05ffb4c53
SHA512 5a2ae30562a4b707c2739a98addfead4fa61898e17516ad54b6f47318b48c7318ea00e80815084af7000431d270a68214bda0f2de1128cc1875b1db60c7a27f3
TLSH
T148C02B1DC0D68CEBD715C830DDC717B0303CC80040C3AF09039DAB234947F885481408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 48edef942d5244395a4b9cc10104bbd117dad8d2a946b6184f81178100b2b5a4
MD5 0d931cd4fc78e50f433b8473ebd57ef4
SHA1 e9bbcdf42f9c39923bb404392d9a607ca1803c77
SHA512 841fbd7e0376ba35c7fb55a27b033dcd8d5b488f12e69baed45168957a417f14cf79ff7c564fa429a60871c8cc5eca7ff4c3ab7233e25648fcf535d7ce9c000e
TLSH
T1DAE0A78C8AC988FBC314C2308DE131FD3E31CA05B5D35E09114D493F4D17B48185354C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad320.TMP

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ad320.TMP
Size 48B
SHA256 c05626301b439630b307da4c14542fee19e3509ca6ff00df722bb1f741581dea
MD5 4451c58775179e8f4ecbf87246f90320
SHA1 5d41cbeb75509f9cc81b7d726cb9a485ca4f9fd5
SHA512 95e132dee14ca429c5f23ad0e43525548060b125f834f0d84d13de39d6f66bd01e2709bc766bc01f238880b97de151f1097875484c405a11fae7048f4540ae2b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\History
Size 184KB
SHA256 f3a5e30ef430e4313151a998473d1cf0426aa173070163a48b68c8e91927bfe3
MD5 36273e002e4d0115c6258bb6abfa0754
SHA1 4a27c31a429ffe169a0e70e774e1e26533f02fe4
SHA512 b609ddf09ab385a3e88eed7890e5d0f55713a06d543b2ea02d3b3f87ca2d43f9ee5677fe8fc457b5f06e9a9458404ee2d5b86265a6bbb8496536087b63247b9d
SSDEEP 192:HBs5aH+fFqH+bF+UI3iWGVLWN3qL/XVgZQW3dFm:hs5wcqIkUI3ijVLWN3qL//WN8
TLSH
T180041E1E5F743202CDFE913668E605B35C7DF02F87236A866C6508B0CEE2656B06C5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 28ab2a64a933addce500532c20f626fefeb2b9c639a07c812cbe56cb7485c544
MD5 8a67593a645fa6cbd6226fa4b3a62cbf
SHA1 0f5fae9e3419754dc3a27c984bf103b1e7813308
SHA512 a91f46f9fc5329ca01b9d47827ff430cf8689339d9e561c2ad34d9ac46c95412de7d0fccfe4b4ca3ccc39d59dda4911e9818a85944dbe08850a73d4965a4ce05
SSDEEP 192:st00zcBf1Z8paqyy/S+WiQhIWQdyorAaMC:stFzU4ey/VIFQF+C
TLSH
T1A1E197025E686A774CC7EA197E35BF17E3FA1062A6C50E59EBF8871C04D66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 c73831dc14bd4b3302ddbde8ad90cb821f0805c11ad65f4155bd44e2b3d62653
MD5 833b0650027cf7866d58f215c7a44d09
SHA1 e01f83d8228da5f177abedee9212321211d4fbd2
SHA512 3f473ed73b7c99a71016484d7636e76af07b41107adb15ba701d1eabfda1fc295a467b21acfe0497871547de4f3653279891eecdfdab37c7cd361f0905c2eac0
SSDEEP 192:st00zcHf1Z8paqyy/S+WiQhIWQdyOrAaM8:stFzu4ey/VIFQ5+8
TLSH
T144E1A7025F687A774CC7EA19BE35BB17D2FA1062A6D50E59EBF8471C04D62CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 71d4d598ed160ddd5507197fc492dd6525703e283259193c451bd96a542bfa88
MD5 31352aed393e4aade9fdaee27d705ce5
SHA1 959982610ef37cbbd79b95f2dfb05c2f6b63d8fb
SHA512 136dcd5f651e23538d7f98b0d6b18d991a6b88aea02e2b1d7fdf33decfd3b7be7b67650b2fa2d918dce398f64292d508233331bedae4214fcfda3adf6c26e610
SSDEEP 96:st005tHG0b9bHffq8dZ8i0vhEvkcfm/7qx+WVHMSm+uecSl11idQjT+gGrAxKEB:st00z7Hf1Z8paD+/S+WiQl1wdysrAxK8
TLSH
T10ED185039F68A9374CC7E619BE35BB17D2FA1062A6D44E59EBFC461C04D52CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 adc138b82a7dbe98f17aa04a6810902752d2ba9bdf84e05cbd3975882c438f2a
MD5 b80fb3fd63e44a8dc858713d8a067c87
SHA1 7e2320eebaca9b160360a3aa06642af7af631500
SHA512 dda3e968949bfb1c18d56ee2e46b2f21ccf00467c0bdd3fa0757d79c906570dfa4dd0f5cbe9e5187081fa4447f1ebc85d0a4a421d0d817e0ea4ce60ba8695e3d
SSDEEP 96:Hlhxi1Plf/ROoKOpkF5d1hxi47sMaTEv9V5h5pg5+ee8VCvHr2a2gShK2k8:Hg1WGz89l+GL2a2gsF
TLSH
T1D2D1C5A7456DC634BF454BEADC397ECB9DBA00DFA8C5481AA7D2C44802C2EFC11DE495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 137572f60fcde6d30c70b6f47f5311613bcea9e9c43075092a0ad7920d4c94d5
MD5 5ff852b5d5b20cc4c8a36931a39de7a5
SHA1 f5e5675e29ad2fb00c19954d92d8f77e9c2287ee
SHA512 084496559d21298ce6c69327e72dcb43934ad4496a36fac41f5f26d5601ba5458dd9079ceeb6f56a016bcd8b603090df915326857d965528764cb03f86d1b695
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 c528e9d62187fbcba00defdbb93d07224ce3fe89396ad43dc45193bbff632816
MD5 9fdc1168a000ca350f177f6d447b6dad
SHA1 1d4c4a7f5b046d529df0af34da48fff547a4e69a
SHA512 869ce466b88f82dc9bdc6358ff966d769dc45c3b39c4743ef6d51640617d6affe166566ed0de6b9e134a2459ebbafae5b54679e6d59bd372fbe19cb94233620a
TLSH
T1E9B01244B7008306D18984721F81C7957340F013200DC813DCA4AF250C0C5E47F00CA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Site Characteristics Database\LOG
Size 313B
SHA256 d331322b73081a9d5e1bf280bf7a3b0340b56be933409c21d9f6bb5e33944c26
MD5 855d6e36a64cfef164a3e01c3433445f
SHA1 f294282fd53ec5f03fdf478006757267636d609c
SHA512 fe2b496d9be429d9bb435a454140fdb8bd7451a1cace77f2991cebcece98da5c797f3bf8bd190fe8e0e957dd0966918f0073dde3146b6158c9bbf899e4210939
TLSH
T175E0263036D9872B25C30AFF2371D38AC7E2B802F5CA26258D1CF6C83547084B016942
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Sync Data\LevelDB\LOG
Size 291B
SHA256 056b320ca9f10f3e328ef0f1aa45f69e00b0cce92f48217a91418681a267b840
MD5 770513a2a02b3e206f302b3542554f12
SHA1 a67d3fd3994c0d344accb15ae516f48e84a44aa1
SHA512 c9227cb1486ebf45b29d8ac078ec87bbd38d000cdc8b2465961314da2a71c2ae669040059d08cf452506969242a4c796e367f8a4b1a6b6b4dfe89d3416441dfb
TLSH
T12CD0863035D9C62518828AEA53B593EBC2E4B80677C736598E0C95C83907044B139582
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Visited Links
Size 128KB
SHA256 0aac85644ec900db40f4ce2f380955237c3f222e935f7e4d3f649547abfaf115
MD5 c2e4e9c05e41978bd149e797b015c53c
SHA1 936940a9f540bb009c29f3633b613f17d218af12
SHA512 5074785c6b5304ac328f247fb0888b30249b690ba3562a196076e91a1fb9d8e79b4ff3d0853f63e24ee5a6d4f5ad6fa6f685ed357b759c51d33cc8343d8a5755
SSDEEP 3:ImtV6XvGl/iU25OR9lnf:IiViGQUkOR9ln
TLSH
T1FCD302E254754814F58484344A555465B3FA5A684857414F97685C2352827CB0F83554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 2KB
SHA256 4878b65a94c951d40752387feca0c8c83b29f354e6a84a28178e744d146d9d21
MD5 993cef5eded288ec633dd9528f2701be
SHA1 b02ecd30585c760145fd66c29a404da114f6e0cd
SHA512 06a923ceb6bd79204f89f8f1cc493b8dcf15d14837105d32fbf61d43113595c7e27576907a2e78425dcd69f91684cdde069dad48d2215029d7e152e7fc9b552b
TLSH
T1B5518633B898B77789E64B84B9453B376A355096DB662F9195ED0B1C00DB25C2703C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 17KB
SHA256 79232db482d3d119d0e54068977dc6499c7f941ae82e7b8774280c6876bde9e6
MD5 2e38702f9ed99d8ef563cc8a883d965f
SHA1 a55881fdd11a10d8f4e4d3b101a9930cc949fb9b
SHA512 81a1d2ec49055f4ff3f08d4edf27ba75efde041f1f39b559352a3a861806bf190ddf45b8f565637a85e5f849f82187ca1b4a562c8362d9d51aadc32a0b9e03d6
SSDEEP 384:zyvsrvyOiyp4+IWA1eUVWGfvvLR3NbuZJAEGT4Vduw6+t:u0raxyp4sQe6WGfvlgZu2Vt62
TLSH
T13E82BF7199B4EA379CF68A86BC0B7A1FBAE45556DAC81FC498D46F0D018B6CC0707C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 3KB
SHA256 a191a1e7f8808cc76dcac0a152627e08d137130ee393f845f9980a07d6bcc1b9
MD5 a8a96d9371d6430a0cdca76415206bad
SHA1 9b28708b1941479e7d70e97e11fcb251d7147093
SHA512 23dc0536515668c5bdd7603775e45a69615234b42ecda6e943f4095e45d13713744928249c4d23bb34f86570200042d77c3294bea69e2a46d941c70670757195
TLSH
T1E271B633A5E8B6374EE28A44B8852B2B76654067D6953F99C6FC0F0C01DB3982303C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 4KB
SHA256 f149ace716ebd522055e2bb2813d4d34a4199d291167a2acc8b7dacc69017a25
MD5 c9efe437b7d8ca78e5a97b98bc8bea25
SHA1 069e75b26efdf5901ff9ad3b3ed320b913c85c3d
SHA512 6b1bf75fa8774877d7c7189c7b00ea5cd107202d733cf6c8f51e8ca5d0d33361b3f19331e2615ca3667c81c0e9f5441ee87b2c29fe62f3f8ddc866507121d5a2
SSDEEP 96:zu4F3NkCE8m0fGqktQ58Frh/cInURoDotoTQSDHB6jGE6BUZkrZNTolIDa:z1F3NbLmvquooDU4Hh6jGBJFG
TLSH
T15991B523A5A8AA374DE6DA44B9453B1766644023D6952FD9DAFC0F0C01DB3991303C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 4KB
SHA256 8f5e99bb30f1e659d105419336c6fad9e0d8d201a690cf3759c6a0ade662ef7c
MD5 64ba55b07cd7b2e346134332d0e5c5d4
SHA1 d234ef885437e4d22659612243460076a2933bf1
SHA512 1ca529814c6fee886e257ec7049325a3a0b3285cd35ecf823b69ee0df5ea19285f1dd3c1c7cd90468a215c54f637bacffe2f5ea0c6e9d1d6606153923b01182d
SSDEEP 96:zu4F3NkCE8m0fGqktQ58Frh/cInURLl8DotoTQMDHB6jGE6BUZkrZNiElIDa:z1F3NbLmvquoiDU4Rh6jGBYZG
TLSH
T1E891B523A5A8AA374DF6DA84B9453B1B66B44023D6952FD9DAFC0F0C01DB39D1303C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 4KB
SHA256 c1d69d01c201d1d93bb9e970a143e90d22c437ea5ff596b13d7a4d3111cf7241
MD5 96632318bbe91f4ca180142e7db73ccd
SHA1 53cec49712f0aecd2a3af08c2d257d85430b99e2
SHA512 1ed76b89579f4213f1354a31e0948108868a06b115cf6023fe5dd1b0297553f903dabe181f9800de8a488fec42443c0cedd59a7f7a31f900867afbf56977872e
SSDEEP 96:zu4F3NkCE8m0fGqktQ58Frh/cInURoDotoTQSDHB6jGE6BUZkrZNTElIDa:z1F3NbLmvquooDU4Hh6jGBJZG
TLSH
T16391B423A5A8AA374DF6DA44B9853B176AA44023D6952FDACAFC0F0C01DB39D2303C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 1KB
SHA256 0e14b6f74fa3eebb532f846c5bd88c7080ce3865d584ec4f14f36999f29bb146
MD5 20b896a1111787b0b7e6c5ed51388971
SHA1 0a1dc741c30a2eec93f635b3d69861f3713576d1
SHA512 e73b06c6099685bef3cf20cd0c18e9c5e7156b23957d53566e52a2c3b59be17a6d76a2ed34981f78a9d2db193276873891dfa0fbaab9318bddd9bbad1a029e05
TLSH
T1CD316573E0D87BB699D54785B5412A7B2D35446AC2255E4862ED0B2C01E729C9A27C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 16KB
SHA256 bacc069dedbb00220aaa05b85105bd2d4290ce31ab9bba16bf9972a27aed6223
MD5 fa1b40e94072d9b622c555b51f9624e5
SHA1 e72410e46bc6ba5c408d0b5dc0d30fb8ed1c97f6
SHA512 9440fc84e39150e6478091f5561bd73941c07440c535a6e505e00386e3bd721681e7446abef5369196679fd0cf8f8b979b6b0a276cbbeb2651e8601e9f9e2a85
SSDEEP 384:zZvsrvyOiyp4+IWA1eUVWGfvvLD3NbLZLEEG+duw6+t:N0raxyp4sQe6WGfvnpZ4wt62
TLSH
T1E172BF720AB4AA379DE69D46BC0E3A1F7EA89466DED52F85A5E46F1D004B18C0703C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State
Size 16KB
SHA256 0b07cab9111d49fd56dc914ad9ddb1450f77c4e23ec08097f5386107e264afa5
MD5 80d5d3528896161c3cd6d82dcabed483
SHA1 f64b1504b73bbf479d2ec8c200912285ed080668
SHA512 9ac7d2ea7fdcb5e22625977e40c1d24f8f2b25a3ec922d333944a0cedf29f512307a3c20267d5e34f5a62aa53a841a049535fd5bdb9998f878ddeb9e08367e00
SSDEEP 384:z1vsrvyOiyp4+IWA1eUVWGfvvLR3NbuZeAEG+duw6+t:J0raxyp4sQe6WGfvlgZHwt62
TLSH
T10372BF711AB4AA379CE6DD46BC0E3A1F7EA89467DAD42F85A5E46F1D014B2CC0703C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5ac17c.TMP

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Local State~RFe5ac17c.TMP
Size 1KB
SHA256 38b8346b7192a658def5347226cc1e80de9bc8c45776aac8b3271f68b1f0b158
MD5 894b1a7507dcc57a60eaf18e3d39dfa2
SHA1 dbd696e5dac3a3f98d5d4f64f5fbe7d9ecd3d56c
SHA512 03334a657e7bb189f87305f3dc04d4a4dffa198138b810ddcdf8e06639eef52ac217e504a73df5041041f1654b0fd82a47fc21a5a517568a15340bd153f4d71e
TLSH
T122216573D0DC76B695C54A85B1417B5B2D6484AAC3251E4992ED072C01EB5EC9B37C33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\ShaderCache\index
Size 256KB
SHA256 fedec98e1f7b9e67612ce58b756e6d832a4c8aea7b5c1ecec3bc4e08250293ba
MD5 fc2270ff568ff96408121136ff3a1216
SHA1 47b87debb7fd246c674887975c1ede37b9a3755c
SHA512 b542488ff53ad5dbece63c2d9bc2cccb461493b69b220a16404fe19b125da421777daac1d25a5a9ba62e3bd120fad86df7b583bb6b6df3583c10f5b2fd503008
SSDEEP 3:LsOllllklkXlRKK/ll:LsUlPsul
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Roaming\Hytale\WebView2\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

hytale-launcher.log

Path C:\Users\Admin\AppData\Roaming\Hytale\hytale-launcher.log
Size 2KB
SHA256 d4392407b10d7922bf84625f9257e195344706d3d6a053298f6dedf518d972db
MD5 e251094326b01e7f8a44d696b5b812a9
SHA1 816adc09883759420e2e0cd5f7eb5f61517a4338
SHA512 c7a4c0ac17ad7539667542fd3af763210d7a5030bacecc55ff3154a058b5fc7b05313d479f7aa3b4eb2f6e288dd6aca82e49952f8d2352303583381b97273c64
TLSH
T1E4417B3110F2456634172AD3831C3AAB16A4650B1B5122BEAB982DDE345DB3C7F79383
MD5 SHA1 SHA512 TLSH

Submit Download

hytale-launcher.log

Path C:\Users\Admin\AppData\Roaming\Hytale\hytale-launcher.log
Size 3KB
SHA256 830158884b3ae51592b92cc6e8346d6706d97f7a6491641c4bc624da11901dcc
MD5 637ab939f79f5745646515b22dc43384
SHA1 2d2ed58748c7d6b99e6908766841566c5c03fccf
SHA512 967aa2cb0f99a968bd28da4cb244f0e4eaadb751582283e8b39e6abfe473cfe180e910722614695f404942b5982e9458e7404b9916f18a2ddec0c0eb3150c248
TLSH
T1A2719D3020F7866A34176AD3431D39A715A8650F1BA523BDEBAC29DE344D63C7F762C2
MD5 SHA1 SHA512 TLSH

Submit Download

hytale-launcher.log

Path C:\Users\Admin\AppData\Roaming\Hytale\hytale-launcher.log
Size 4KB
SHA256 98f46e4d2ce7d65aa71e63cb22ecb66104fc534337db6754b8fa9320527c703f
MD5 681f2194cfed79c0a2770590f6cc3499
SHA1 a44cefce54bb29d65f8b08d2768d40953993eaa5
SHA512 d5d3ef7973fbb215b670f487974f394f85bb650aec0c1ed8a01a73ebfa550300f67754838d999c50f728c0cad6015900f9dfce24062a5cb3888c03e96e6529d5
SSDEEP 96:bW0zJkxEzgEzfr7ZRblLXz7Wez2zXaz9Rk7azgWez2zbzXkF0nzvk2kvkrlhkXcG:CmJkUhHn9isEo9Rk0ZsEXXkF0zvk2kv3
TLSH
T102A1AE3024F7D56634176AC2431D29F71598650F1B6623B9ABAC2ACE344DB3C7F792C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hytale-launcher.exe

Path C:\Users\Admin\AppData\Roaming\Hytale\install\release\package\launcher\2026.05.07-c55b318\hytale-launcher.exe
Size 26.3MB
SHA256 64b7f11241b95ac8711023bbec7f4b21e6bded1e5b768415fefea9bb6e646ff0
MD5 e2cf57af6dd7358aa906b8b94d3d1312
SHA1 1fec48e5cfada3b39f120e10f1e25964f59a6c24
SHA512 2255a3243bf786a01016ee5d89137f910275a7e2518ddd08b903baa3f4a9980c9cf81a64de5c84859e714ec762cd544047d473a4531df65c1f2956db1cb66e3f
SSDEEP 196608:DcKC19185RxVZvbrXrNjdQeppTbs3h51LFRR9m+6CYaBmR7C3:DvCa1DrTsx/FRSHW
TLSH
T1A8579C53FD6909E6D0EED270C57252227FB17C464B2023D71A60B6242F77BE0AEBA354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

self_update.dat

Path C:\Users\Admin\AppData\Roaming\Hytale\self_update.dat
Size 73B
SHA256 f9d9c33632f73479b42f107b057b85b8c0c0eb60dc0a7ba163087549ac732380
MD5 a0b363d07b395a7d7550df336f0f083f
SHA1 9876d7435a08ca4127ce5235813ab9672aaab6bd
SHA512 4d76de048a7045bac451fc0c07b0c8fb2a221912e7cb75c9936edeb00dbf3abf382d70b5f66b3c6adb68c3816d848f1c602abe023e29ea821c2fc27b837814ab
TLSH
T17BA022B2CA2B0002E3E0838A8F08303828CA820E83F830CAE0E2000AE0000CAC0000E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/228-448-0x00007FFB905B0000-0x00007FFB905B1000-memory.dmp

Download

memory/724-752-0x000001506DDF0000-0x000001506DE1C000-memory.dmp

Download

memory/724-751-0x000001506BAB0000-0x000001506BBDA000-memory.dmp

Download

memory/724-753-0x000001506E9E0000-0x000001506EA07000-memory.dmp

Download

memory/724-754-0x000001506EA10000-0x000001506EA4B000-memory.dmp

Download

memory/820-151-0x0000000000AF0000-0x0000000000B15000-memory.dmp

Download

memory/960-624-0x00000239DCE10000-0x00000239DCF3A000-memory.dmp

Download

memory/960-622-0x00000239DB380000-0x00000239DB521000-memory.dmp

Download

memory/960-322-0x00007FFB905B0000-0x00007FFB905B1000-memory.dmp

Download

memory/1644-625-0x0000000002610000-0x000000000273A000-memory.dmp

Download

memory/1644-935-0x0000000002610000-0x000000000273A000-memory.dmp

Download

memory/1948-135-0x0000000001060000-0x0000000001085000-memory.dmp

Download

memory/2212-159-0x00000000007E0000-0x0000000000805000-memory.dmp

Download

memory/2324-90-0x0000000000F00000-0x0000000000F63000-memory.dmp

Download

memory/2492-287-0x00000000029E0000-0x0000000002A43000-memory.dmp

Download

memory/2492-81-0x00000000029E0000-0x0000000002A43000-memory.dmp

Download

memory/2620-147-0x0000000001170000-0x0000000001195000-memory.dmp

Download

memory/2960-630-0x00000000026C0000-0x00000000027EA000-memory.dmp

Download

memory/3200-734-0x00000000031F0000-0x000000000331A000-memory.dmp

Download

memory/3200-1353-0x00000000031F0000-0x000000000331A000-memory.dmp

Download

memory/3368-626-0x00000255D6000000-0x00000255D612A000-memory.dmp

Download

memory/3368-627-0x00000255D8040000-0x00000255D806C000-memory.dmp

Download

memory/3700-1352-0x0000025CF2210000-0x0000025CF233A000-memory.dmp

Download

memory/3936-757-0x0000027A39B10000-0x0000027A39C3A000-memory.dmp

Download

memory/3960-139-0x00000000008A0000-0x00000000008C5000-memory.dmp

Download

memory/3972-131-0x0000000000F20000-0x0000000000F45000-memory.dmp

Download

memory/4312-711-0x00000289EBC90000-0x00000289EBCB2000-memory.dmp

Download

memory/4324-372-0x00007FFB90760000-0x00007FFB90761000-memory.dmp

Download

memory/4324-143-0x0000000001110000-0x0000000001135000-memory.dmp

Download

memory/4324-373-0x00007FFB90CE0000-0x00007FFB90CE1000-memory.dmp

Download

memory/4344-290-0x0000000002AE0000-0x0000000002C0A000-memory.dmp

Download

memory/4368-155-0x0000000000A00000-0x0000000000A25000-memory.dmp

Download

memory/4368-755-0x0000024815D80000-0x0000024815F21000-memory.dmp

Download

memory/4368-756-0x0000024817810000-0x000002481793A000-memory.dmp

Download

memory/5040-578-0x000001ECB3740000-0x000001ECB386A000-memory.dmp

Download