7e8f66408f12842b5b46b5e78fde8bf59cd6ed3bb7fa70122629fe089132a96d

Analysis

user interaction
yes
max time kernel
315s
max time network
317s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher.exe
Size 2.6MB
Sample260601-a16feacy5m
SHA256 7e8f66408f12842b5b46b5e78fde8bf59cd6ed3bb7fa70122629fe089132a96d
MD5 825dbc3fc11f12876ffcabaa6a709b9e
SHA1 25a4e81b1239223d67266c9e33c5abc117573617
SHA512 fa79dc05e59e4828bc0a9454aa29c62d31821437855bfa18599c644b60429084358edac3ab24e81c50fedc1da60990489bab2e7204375c7d9c83e195ebd0b4bc
SSDEEP 49152:iJZwNWWyhaT2BME+0NSGm42F7keS15tB1ofewx2WhDTuQRje:iPwNklSUjeSvtofeURy
TLSH
T1BCD5BF07D18440FCC49EC1B99747A726EA76BC890764B2CF27906B222F76BE09F2D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
1504	zombsroyale.exe
1200	UnityCrashHandler64.exe

Loads dropped DLL 5 IoCs

pid	Process
1504	zombsroyale.exe
1504	zombsroyale.exe
1504	zombsroyale.exe
1504	zombsroyale.exe
1504	zombsroyale.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
964	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zombsroyale.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zombsroyale.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	zombsroyale.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zombsroyale.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247515566215587"	msedge.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{563CAED0-CE29-45E9-8DE5-DA1AC4ACDAD7}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5600310000000000ae5cd01a12004170704461746100400009000400efbeae5cd01ac15c5c0c2e0000003a57020000000100000000000000000000000000000034b69d004100700070004400610074006100000016000000	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{0877A4A0-9A52-424F-83FF-75E0FBFC695A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000ae5cc624100041646d696e003c0009000400efbeae5cd01ac15c5c0c2e0000002f57020000000100000000000000000000000000000051982b00410064006d0069006e00000014000000	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5000310000000000ae5c231d10004c6f63616c003c0009000400efbeae5cd01ac15c5c0c2e0000004e57020000000100000000000000000000000000000019c803004c006f00630061006c00000014000000	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000ae5cd01a1100557365727300640009000400efbec5522d60c15c5c0c2e0000006c0500000000010000000000000000003a00000000009702ac0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1"	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	launcher.exe
Key created	\Registry\User\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\NotificationData	launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3668	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3668	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4348	launcher.exe
4348	launcher.exe
4348	launcher.exe
1504	zombsroyale.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1504	4348	launcher.exe	96
PID 1504 wrote to memory of 1200	1504	zombsroyale.exe	97
PID 1504 wrote to memory of 2728	1504	zombsroyale.exe	101
PID 2728 wrote to memory of 1036	2728	rundll32.exe	102
PID 1036 wrote to memory of 4700	1036	msedge.exe	103
PID 1036 wrote to memory of 3820	1036	msedge.exe	104
PID 1036 wrote to memory of 964	1036	msedge.exe	105
PID 1036 wrote to memory of 3820	1036	msedge.exe	104
PID 1036 wrote to memory of 3820	1036	msedge.exe	104
PID 1036 wrote to memory of 2528	1036	msedge.exe	107
PID 1036 wrote to memory of 2528	1036	msedge.exe	107
PID 1036 wrote to memory of 3856	1036	msedge.exe	109
PID 1036 wrote to memory of 3856	1036	msedge.exe	109
PID 1036 wrote to memory of 3856	1036	msedge.exe	109
PID 1036 wrote to memory of 3612	1036	msedge.exe	108
PID 1036 wrote to memory of 3612	1036	msedge.exe	108
PID 1036 wrote to memory of 3612	1036	msedge.exe	108
PID 1036 wrote to memory of 3876	1036	msedge.exe	115
PID 1036 wrote to memory of 1804	1036	msedge.exe	111
PID 1036 wrote to memory of 2220	1036	msedge.exe	112
PID 1036 wrote to memory of 3144	1036	msedge.exe	113
PID 1036 wrote to memory of 3876	1036	msedge.exe	115
PID 1036 wrote to memory of 3876	1036	msedge.exe	115
PID 1036 wrote to memory of 2220	1036	msedge.exe	112
PID 1036 wrote to memory of 2220	1036	msedge.exe	112
PID 1036 wrote to memory of 3144	1036	msedge.exe	113
PID 1036 wrote to memory of 3144	1036	msedge.exe	113
PID 1036 wrote to memory of 1804	1036	msedge.exe	111
PID 1036 wrote to memory of 1804	1036	msedge.exe	111
PID 1036 wrote to memory of 2600	1036	msedge.exe	114
PID 1036 wrote to memory of 2600	1036	msedge.exe	114
PID 1036 wrote to memory of 1840	1036	msedge.exe	116
PID 1036 wrote to memory of 1840	1036	msedge.exe	116
PID 1036 wrote to memory of 1840	1036	msedge.exe	116
PID 1036 wrote to memory of 3952	1036	msedge.exe	120
PID 1036 wrote to memory of 3952	1036	msedge.exe	120
PID 1036 wrote to memory of 3196	1036	msedge.exe	118
PID 1036 wrote to memory of 3196	1036	msedge.exe	118
PID 1036 wrote to memory of 3196	1036	msedge.exe	118
PID 1036 wrote to memory of 864	1036	msedge.exe	119
PID 1036 wrote to memory of 3952	1036	msedge.exe	120
PID 1036 wrote to memory of 3952	1036	msedge.exe	120
PID 1036 wrote to memory of 5124	1036	msedge.exe	121
PID 1036 wrote to memory of 5132	1036	msedge.exe	122
PID 1036 wrote to memory of 5124	1036	msedge.exe	121
PID 1036 wrote to memory of 5132	1036	msedge.exe	122
PID 1036 wrote to memory of 5248	1036	msedge.exe	124
PID 1036 wrote to memory of 5400	1036	msedge.exe	125
PID 5400 wrote to memory of 5584	5400	msedge.exe	126
PID 1036 wrote to memory of 5776	1036	msedge.exe	127
PID 1036 wrote to memory of 5776	1036	msedge.exe	127
PID 1036 wrote to memory of 5860	1036	msedge.exe	128
PID 1036 wrote to memory of 5860	1036	msedge.exe	128
PID 1036 wrote to memory of 6008	1036	msedge.exe	129
PID 1036 wrote to memory of 6016	1036	msedge.exe	130
PID 1036 wrote to memory of 6008	1036	msedge.exe	129
PID 1036 wrote to memory of 6016	1036	msedge.exe	130
PID 1036 wrote to memory of 5560	1036	msedge.exe	131
PID 1036 wrote to memory of 5560	1036	msedge.exe	131
PID 1036 wrote to memory of 6028	1036	msedge.exe	134
PID 1036 wrote to memory of 6084	1036	msedge.exe	135
PID 1036 wrote to memory of 6096	1036	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale.exe
  "C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Local\ZombsRoyaleio\UnityCrashHandler64.exe
    "C:\Users\Admin\AppData\Local\ZombsRoyaleio\UnityCrashHandler64.exe" --attach 1504 2794124939264
    3⤵
    - Executes dropped EXE
    PID:1200
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" url.dll,FileProtocolHandler https://zombsroyale.io/user/login/google?csrf=aUKebMyBKRBjcUNN
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zombsroyale.io/user/login/google?csrf=aUKebMyBKRBjcUNN
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffdf3edc188,0x7ffdf3edc194,0x7ffdf3edc1a0
        5⤵
        
        PID:4700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,12309006173887638990,5883178814922344515,262144 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,13557793014517913177,9153762253189171574,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,1390656343693302133,11472384318055323680,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
        5⤵
        
        PID:2528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,4695972790340549090,14057531848442709146,2097152 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:3612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,6662192992228706333,5603475209195163261,2097152 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        5⤵
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,498566507032994595,16759122303083058509,2097152 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
        5⤵
        
        PID:3876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,6041345764906188516,1406922716400739859,2097152 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
        5⤵
        
        PID:1804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,1415475009756930074,4955871235637612270,2097152 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
        5⤵
        
        PID:2220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4320,i,17261713601127044759,7363997530190285487,2097152 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
        5⤵
        
        PID:3144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,12922651668112208135,10128497003836956134,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
        5⤵
        
        PID:2600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3936,i,14782568767967008787,11997309024950542428,2097152 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:1840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,14705594127924492349,8902855184168588550,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
        5⤵
        
        PID:3952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3636,i,11439474609579055611,14552198987501026076,2097152 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
        5⤵
        
        PID:3196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,15322304518402860178,3264736168181547229,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,5459355888759057525,10168992419754946636,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12
        5⤵
        
        PID:3952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,4625328047503119211,1224477563799662465,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
        5⤵
        
        PID:5124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14415225904660627866,12467200495097515381,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,416605420656904931,8304814308825308957,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
        5⤵
        
        PID:5236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,416605420656904931,8304814308825308957,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
        5⤵
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,12444819826175198925,7993009501623803020,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5400
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        6⤵
        
        PID:5584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,15820628331277378710,16520656644933474215,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
        5⤵
        
        PID:5776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,6778904907916006498,10196946470678549654,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
        5⤵
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7336,i,7558440866110619787,17083251629313957517,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
        5⤵
        
        PID:6008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,13195364107718752872,8896841819125995202,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:14
        5⤵
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,14700636140046543564,17912491076959647071,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:14
        5⤵
        
        PID:5560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,292637303053897269,13822635458001332239,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
        5⤵
        
        PID:6028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,3401804214967226127,5581760806687634109,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
        5⤵
        
        PID:6084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,3283532144514053174,2585605327126702736,524288 --field-trial-handle=2172,i,15637952350620923054,6109363746975839440,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
        5⤵
        
        PID:6096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3756

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Library

Path C:\Users\Admin\AppData\LocalLow\Yang Liu\Zombs Royale\Cookies\Library
Size 641B
SHA256 7a02e2d3042cab50511f1e650d32303063052134db548565a2a7aeddb5019e60
MD5 b728bcb93003d9622522674cec4a1b70
SHA1 a62123583cacf47762778075484222f5be683cc7
SHA512 487c37a22ae7ea6660344c2e38e1d81f26def6f147c2c23738f4350d36e3080c4f87b9c72915a1c859142cef2bd898eb202d318cd397bd98da9b112574d360d3
TLSH
T144F0D8D9E0775072E240903AAD04778190AE9EAACD1343C168CAF5D21537FD18B3B0B9
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\LocalLow\Yang Liu\Zombs Royale\Unity\ff961094-0c09-4a18-b11a-72bdc82bb029\Analytics\ArchivedEvents\178027792700002.87ea6f12\c
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\LocalLow\Yang Liu\Zombs Royale\Unity\ff961094-0c09-4a18-b11a-72bdc82bb029\Analytics\ArchivedEvents\178027792700002.87ea6f12\s
Size 462B
SHA256 ff52fdc989c038aaf84c6c70db9e77afbe58b0ed8451c42bc51abb350fd1e2b4
MD5 8e418bb3d95f5ade78e213c2f2b1e597
SHA1 aff2ddcbcbefcd1e58db020b03de9cf8176376ee
SHA512 eb9577e21c03240fabbcae3bc554ecf6c24b88d2fded40c34cfe03a452ced92a5f860cd55912433dea1d587164abf08f4802da4976e0a332832feee80f91f74f
TLSH
T1D3F0DC3282ADBD36DBFB88830B5105221D2514E87D60CEAE98B944C4070E269BB12E79
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

947b9e1a-94a0-4ea0-aa16-9f20781bc1bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\947b9e1a-94a0-4ea0-aa16-9f20781bc1bb.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ca02403a0b7780e90299b950fa9dc820b21932ef181ecdce599b4ef5d0e77495
MD5 9462523b76615a8ee7a7141cd3f32504
SHA1 5c7914d1086cb2cf7710aba856dc8e2cb4b968f9
SHA512 0d28242241ae3ee5567e96b792183dadf6d60bf50fee4f45dc69b136fd586150c7026f4e5bf223d52670c5c82d4bf40f492d874340a3d233bb4c3ca82e7cc352
TLSH
T1F671E9160FD223B0F3610B70B7D2A5183B759035C6AF5E763FD446B6ED0AB6E622520B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c814d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c814d.TMP
Size 3KB
SHA256 dca27f5e407105b5b0b4a69392b304351b2b83442defd68ca8ea8e1b081ecb61
MD5 1c17e8fb15574c89d59aba63bcdc7f03
SHA1 939a518ab7e381036e9f5f6330cb5070dd11fb95
SHA512 8831f874b0932dc213484c8572dfb9ecae298b048b95836bf8291c82ad7afc9f7be3f74482a77f51de9be7ac696e0828c2c3d8dbbcad1191794ad505ea92539c
TLSH
T174612F1A0FD313A4F3610B30B7D152183B719075CAAF5E763FD446B6ED05B2D612650B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 498bfd6a0646f62e5141e036691358a7841ed4e93fdb2ef26d228097ad3e2796
MD5 7407e726878a3b89637fb4beb00f1296
SHA1 775f4f98f541d7b8c768f766b1428a312e77b731
SHA512 1cf9a36a5a7346af2b573cd540516f0f542102c03fa55237ab89eaf7d15d81c8af6a8ebb4f604d17e7df5527e349fd6a876e94bdc6e8a7446c78159e321faeb6
SSDEEP 192:sxZORuyM/jK1Ml8MNp/fZsbEJjQYQIdp4hL/W6+WNuwf/Y0540aIg4J:sxZOk1p/fZsoJMYxI/bV/5Wc
TLSH
T11652D816AA345977CCCBD209FA55BB53D6F91563D2841D489AFCCB0C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 27c69110eeb400c112329e70a3d53d517b2c513374c40535c494bad311b96c70
MD5 8b80e05319db301220e603098e5a0e7a
SHA1 efccfb00f9f98295ef17b254192a668803fa0507
SHA512 fd859dc944865050a7e42bf8c66a30bf03d9e12cc59e37d43f5c9e3c9e493f3b788653765a704244f683603343600172fad219b3c0af1a3307f7517936812bc9
SSDEEP 768:hgzXl8pZ2H77pLuLXJ1WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3ot1/LlY:hgzXl8pZ2HNEXJ1WRmsYQL0u1jaKot12
TLSH
T1FC031C7B280CCB7E4F844E9CEC267F8A6EE8018B96DC895447FA494C03C66EB11164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c21dcb8b19a1cac8d7ea7bceed6429c3efc348c49a4086ee41e927786d57e062
MD5 2c3ff3511c40761a02e18515aa907d08
SHA1 11480c9fff79b97869b39df6100dce47dad7255b
SHA512 4e552c8424e28397e7dd1c283757e8fff8bc04e6ad7ae6d06070b0e7ff9679c47911040a71338f9abe35cc1fce87b6af21c233b908e4b5c47f6e4b9944ff9e5b
SSDEEP 48:KJwbpIxKTCIPKvqwjyJSI/KbKglMIjK9KMvyD:KJwbpmKTCkKvqeaSMKbKmMAK9K2g
TLSH
T1ABA10FD275BA12513C7E3458C2AA961A0A8273673715F83B3BEC10B34E26E254DFD4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a81ad4db12cc518d0eaabd8237e880d52b01ed6dc753081e278b3c115c7c8628
MD5 8dc64b5ec3b31901643e5180b273c4a8
SHA1 a844831e1f07ae42fc59d8ac88f75d0ece5697dc
SHA512 fde1a46a65cb4e10404a8e79d408854a33daadba4cd3fb40af3379e1b329e7e04fbc9f0e5551d3f4af8d0f7f7a857760cc3295a85a1deea04f51a14ee842b03c
SSDEEP 384:ystNnNnb9+8NHSWHEMv3IK/h89Xjtgta/hJAOI:RjZbE6b/YjtgtAqOI
TLSH
T135929E356839AD2789F7A105F14B3793AFB814A79EC42F94E7E84F0D00D729C235A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9d4e8bf42ba5509ca59e60c92b79aa9825ea41e2a01a106839eed8aeba26be30
MD5 c3a603dafd995907ff27539b1362c29a
SHA1 1ebd8d07dcbc488a60c887bf5d6868f355b35528
SHA512 d830bd06091106817d0eb0039ed7baece69d5aa15555612142a56907906b1c9ac44730be783d16d3e5cd0348c8b9c47f69b8055321d3389cebdf48258f58efc2
SSDEEP 384:yHtNnNnb9+8NHSWHEMv3IK/h89Xjtgta/hJAOI:mjZbE6b/YjtgtAqOI
TLSH
T1F7928E356839AD2789F7A105F14B3793AFB814A79EC42F94E7E84F0D00D629C235B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a3fd3f45ab2911319754af9fc3ebc268025f928e3bc91f5421f0441c43bd01a9
MD5 4667df14fc75eaa7d061c1596d429b72
SHA1 d1ef362eb1d01cb5680853596cca46aeba217382
SHA512 c41602805e8fde40bb34c65ee5c4d66883ced12e8fba2a30c34b2d3e882daad028c261a9fb8c023f1c930b20ebf9fb2ad7c4429ade617e075e1a6c14dde9e655
SSDEEP 192:7GNj6fNNQmiUy2zHePL/GPTKjzor5XR6V7qEQU6:7GNj61Ldz+PL/h8qU1U6
TLSH
T1CB02F935A8A86C7F8EE2AE49B58737139FE4112BE6952F54D7E81F0C00D769C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87aea6d76bfba147e6d3965d410d34174c51856f13a25493495134fd0794ec0b
MD5 b7fa93e2ce1d47001d8f5f556405713b
SHA1 739def556dd2ed4e5637c9998905e71476c02afb
SHA512 a15f2df22ad67719cc36de69c04ddb246a32b0db981f80f99a7b66f54712db7e64087c0b2fa2f79ff641e2d8924f7ff7df77f6bfc4b73780586469a9950c822e
SSDEEP 192:7GNK6fNRQmiUyWSe4L/GPTKjzor5XRtXV5V3Z+q8UGU6:7GNK61v7/4L/h89XLLgtU6
TLSH
T19312F935B4ACAC2B5DE2B555B4873253AEA52077DEC56F54D7F41F1C00CA69C270A832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7031991d-4642-4560-9cee-d448dfb63075.tmp

Path C:\Users\Admin\AppData\Local\Temp\7031991d-4642-4560-9cee-d448dfb63075.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b0e3d4a-0c5a-47c2-8e1c-3f86ccd88d3e.tmp

Path C:\Users\Admin\AppData\Local\Temp\7b0e3d4a-0c5a-47c2-8e1c-3f86ccd88d3e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2dccc68f-46bb-4b0d-a052-072d3691494a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1036_1431593945\2dccc68f-46bb-4b0d-a052-072d3691494a.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1036_1472491629\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityCrashHandler64.exe

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\UnityCrashHandler64.exe
Size 1.1MB
SHA256 a76ba1f83d325fd246b652395ce46b1f311e77e60cf4e23e9b16d0f24d24e94e
MD5 8b3a2c4b34e357f8f31232d20e9e045c
SHA1 b4c4a124454b93445bad57cf5eb76fec016c2e46
SHA512 fb14ad48bf1b888a3ff29fa887e1985903f9b5a4da671b245a37a6c3c3f51a79a930ac6addd14559bfdca5ddaa276c45af54829d2d2cf70e932f121709017c9a
SSDEEP 12288:zo4M8g5CFF3vK3YjRJKC1Zj4xl6PwsinRZw2mtxb4TRq7QsoPo4nHcKylQfz2fzS:zo4fg5CFWYii0zRZw2mX0M/wn0Kz+zAt
TLSH
T1D2457C6A66A800E9D5779135C952490FE7F27C1907609BDF23A0B7A72F336E41E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityPlayer.dll

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\UnityPlayer.dll
Size 29.6MB
SHA256 7d14ea4d5bf0b6706bda818b4fefe5007e1025aebb4f5b93477edc192952d915
MD5 fbc2e8f70f1669a48424163026e25b17
SHA1 6fd0de20258ba81f2d32d607d986537362b4ee6f
SHA512 cc10bcfbfaeaa565a757ac1fe0e7dd7e9289a28b382886e76eb9543c2bea6de4bf73f9c4b1b2f3e8173b4b7196ee5a110707f1d454a6ca5f1386af7eaded0849
SSDEEP 393216:/g8yX+8DGWBwgQqysVlq0+c2lBSelJLxFJbmd1:/iXgsVMeEmT
TLSH
T1C4679DA6B2B800D4D47BC078D65BA90BFBB1344A033086EB52E149956F73BF11ABF751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baselib.dll

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\baselib.dll
Size 409KB
SHA256 1e35be4c04d748071d98247c199eaa6ddfcbd297e3de96842c27576777a691fd
MD5 8b727802e0de4ad39e6b96563c043ac0
SHA1 ab7f68bb949441cb024ac6925a418e0c711b06c8
SHA512 a64a06805e9a6f0356cb0ada0aa4b13b1ad58d95f15e3a8c9b1068184c2508d73b40decf706d2f1ae40ab61bf18f88001cef7169499d03854a437d76d5479179
SSDEEP 6144:tuInkY6mJtoLpzxkzt0R60Htptb+REDqDY92q31YM9Ci4DTF89GCXTnD:4InZ6mXWM0NptoDY92qFn9J7D
TLSH
T162946B59F76408B5F5A790788973850BE7B23C8A176487CF23A4439A2F33B91593E372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zombsroyale.exe

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale.exe
Size 651KB
SHA256 89d5f8570f762e4771bfe2e5607d9bfde88f135716217956eb25f1ff08af5b09
MD5 aa607f46538872a314b3d1777add06c2
SHA1 ae5df753a9be9f413550ec15f26535ccee2b04a6
SHA512 f4781045cd91a075f136fc18097c2b84a93cfc9900f9bc9c1c3c0f42041530361d7915a4002cc3947fc4ae948a1cce4d174d26941b71cebf0d253a245c6170a3
SSDEEP 6144:5/7Fu9mpcJ/OD8s/8uY7PGG7PpNY+x1XxSm+6jGCgKzAtCub75kYXTzRgzIm/Rt:5/7g4aOD8puGNY+xptDetCuBTzikm/f
TLSH
T16DE4945D2813731DC6BE25731F044A6EF7D41E7A91EB183B6E0BB9EBAE1B1705E81240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

anticheat.dll

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\Plugins\x86_64\anticheat.dll
Size 4.2MB
SHA256 f62152f96df4a4b743d7776f53e606d595d4c52f2c153441bed800e446bab19d
MD5 74944d9a065351ae3385ff892d7683ab
SHA1 67aaa82936da6beb27feb0197ccd58e513e13b16
SHA512 116b6dae3a3d620fcbdb8b2c900ac317d21d3fdc45c3ac9231af407b7f76189ad7078dce70efe4178c34a2dc4068af8c071462cd2a535ff2eb3e326305af6058
SSDEEP 49152:yahjxoBaHRAb/OgFC7fg/WOMSwbocFO8vl726F2mGcN2Uk4BtKN:yaF2xXFC7pDbjT2mGcNrCN
TLSH
T159169DF726C2B7EEC217C4FE8322F9BF994F743A0516B4A3A164B15AAD16C847214F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_game_sdk.dll

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\Plugins\x86_64\discord_game_sdk.dll
Size 3.7MB
SHA256 4280da16b652e3f62308b654177bd6a68083c6ad264fee8bfb4484f4d34c827a
MD5 1b0baff829bc346916a9cbf77d14eb97
SHA1 d3da341efab8e3af27aa1ed90c1a8ad07678ce7a
SHA512 60effb43c445848cca150431dce0ce66f7909061cfcfd6428fc8fc0fc4a5ba4d2c4fe589f0e10d1a223e7e4d303fce964df7318938993c32b37e5aadcb5815ab
SSDEEP 49152:7vFkhH3Js7MAt17i12vxI8V0ult2H/XHtgWNi+5qPDbqOHtM2ArUylfbL6AxMzJ6:cA+Wer9G6G+Sc6UI6+nzS
TLSH
T1F20649217A56647CC1ABC4B483874A365E3134CB1B39BAFF44C156782F69AF46F3D228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unity default resources

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\Resources\unity default resources
Size 1.5MB
SHA256 a11e3e24520676183b3750564b4d9f5a90e8f41fd3523cbfb0c49f3989453da2
MD5 c9730fe286df07729a2811fbe1dfbede
SHA1 6f5ea5605cb6771e20ab6d75e448b75307e21ec7
SHA512 387ef73b2ad58786aac05cbf418a211664f0f0dc24aefff3af8acd83cdbbd072c7dfa6154464eb49218f7b03af62536b1a38c42e5df9f50b96d705c0e8f500bf
SSDEEP 6144:h8g9JxVJ0aYR1CCVX8BAiZahi3YW+/OJ9WqCmKISHCkcCVw:hD8TpQahXvOjdCTBw
TLSH
T197755315A2A1153DEC5E053987A31E61E3BDE99C1BEB8B133B1C321CBF617488A77274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeInitializeOnLoads.json

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\RuntimeInitializeOnLoads.json
Size 2KB
SHA256 b98b9fcfce6f15085c611e37d0ac1473d06eae1255a8ecac37c6fb9186a3e9e2
MD5 03980abe8a7163e3921514b18689d819
SHA1 b2047adc4f7f513f9829c57e0cb66a2c0150588e
SHA512 67fce584d744264c9c22c855eb265f6999df90a4e5a9020e6ef33bb2bee767d3184da5ae206770057dc1b51fc1bfcad3c10a2ae19631c7a8724124321ea754e8
TLSH
T1EE5112BD228B8F7F2F4B83D77C7A19593484060F89CE4A04ED7C1F3EA5B4555298252D
MD5 SHA1 SHA512 TLSH

Submit Download

ScriptingAssemblies.json

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\ScriptingAssemblies.json
Size 4KB
SHA256 fd1dde7e2b41cf3ad6db3ae5b0c0ee4d2a099fa89eaad2273d2246fdda0adc2f
MD5 a1b7d88b69f5e75c3bf4c5adef92d510
SHA1 8d56df813bbf5bee507c0c030ca4c4efb63fdb45
SHA512 0c5b9be85a66709c9960406530f4152725934bbb2d2abe33edfb9eaa8ef01606a3e16299002c126b829b829b87ae0d79cb2942d0933dd3fef5b0063f0ca7a363
SSDEEP 48:YXNAYrKXrjFRlClouNuQGoSfTG/fjps3M/G3Yb/lS9G5:G0jrlMouNtjsYb/lS45
TLSH
T1429128B6C08B26D32ECD5EC38C798C8C7ED301920A6590141FAEA39FA978CD63D4D5E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

integrity-hashes.json

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\StreamingAssets\integrity-hashes.json
Size 2KB
SHA256 db213ab0897240784369ddddbb252326a63ecadcf245c3512db3885fe64b2ecb
MD5 8c7f2ea231c0421b396a1a0511bd3f18
SHA1 7eeae4ceff122e7aefdfaa9107ba1f334f497e7f
SHA512 eee5ce76ff2fe8096cb800280650fbd02d0f570549696b2fc276f940e4e41d46483264fb00b693000749610f34055a017c5ee231544275b39ebb07993a9e1c45
TLSH
T137514D1BAD23324E471FB4E9B8094CCD25471C4A8C2ADE554E1B0B81F2669C571359B9
MD5 SHA1 SHA512 TLSH

Submit Download

app.info

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\app.info
Size 21B
SHA256 c464beedaec4a7485ebd93492fdd9f056bab00c9c274250116f19490fbf1a2dd
MD5 b0618923c948bd8318b47185b07e37c3
SHA1 9d728998efceb3c2d9dd2be100addc6d2fb0b1bf
SHA512 862984d9928c3bfcb29d2c10dfd947a25addcdf7347ea21bfdb15af15e48b0fa3b19dc2b4952727a7c71091667d6d02d6d7f6a35468a42f1bb2c035b1647f1d3
MD5 SHA1 SHA512

Submit Download

boot.config

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\boot.config
Size 130B
SHA256 1c96672eadf7d2d9fb05ea5d9ac2cb5dbc555830fd02824c661834c2d66d2b79
MD5 8d2b69051fb2da0e7dcafdf14b3b8e5b
SHA1 569046ba73f809562c6b5becc0c47718391b908e
SHA512 ef16278fbac5d3fa3b4c85a4f714788b55e6b8d7e2e255a4afdf949bfb06dd13dcda367a2f72096f94ffc27306d233e9828c72476a40301cc70110e36ffec0a2
TLSH
T19EC02B04E2A43B45B3CD401244A419D3E2B24000983411F85A901050232E80F6A638B7
MD5 SHA1 SHA512 TLSH

Submit Download

dkmsblob

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\il2cpp_data\Metadata\dkmsblob
Size 12.9MB
SHA256 fe72ec025148c867499979eec92b54a308dea5e517e9b660c769e6aa7b361b1c
MD5 8ecab12aacf08efc8c98385cf3c67b7f
SHA1 e016769f81a9821bb66c68b047d74d9c21ac21df
SHA512 03ee5fcb41bfb330ffa47024f77ba8384c73af316d2d0b8e4fb82274b92edacb31ca2e59c1434fb0d541e6245a95a294b97424ece14568ef3c42ff81c5cdd602
SSDEEP 393216:RRUSECYZFxfbvTPe/karMynYCno3I4HbgDjBBM:w3xfLqkaih3fgnw
TLSH
T135D6334E660D5D3860D86D463624274380ACF8BFF6C3E9912331D92BA2BAD7DE574B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscorlib.dll-resources.dat

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\il2cpp_data\Resources\mscorlib.dll-resources.dat
Size 329KB
SHA256 c5baa176a5b72cd545266340e42102d393a5e43d38c95796bc828918bb95277f
MD5 21d06dbc8af6432b2b49536ed30609af
SHA1 11a1c0e2ab2f8c06fe4507535ed47e0dd279a60d
SHA512 2971f54eaa14c3ce6e2352e5a1aea5b044f0894bf4eac92de8cd92515b6473b5ca56ebfcad4369a9d4935cbefea2540a83f332fd4d832c37768310e8776ceb5e
SSDEEP 3072:c5j+evAPQ48RhHkXKSmLZsumnWpevI1kMqXkD3by+BEL:crvS8rHXSmJmnjvXkSr
TLSH
T1F7746CD8B5728E76FE57A9BCE85E928D43D9C1E2C182523B3D75C2E04D52386181EE3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.resource

Path C:\Users\Admin\AppData\Local\ZombsRoyaleio\zombsroyale_Data\resources.resource
Size 1.6MB
SHA256 79e6a2eed7bbc557d8dad70d370dffd87189df4a1b43f998f559ae0f249ecc5d
MD5 097334b1dcdddf0678a789ce4bb2606c
SHA1 8d2eb267e43134f48b12162c99290bc816ac64ae
SHA512 7ca90c59b9e991905b6f4352d65ec0a983479bd375b62f567cff14491b46cdbf861e92ca1b41bdafa607a4f6d61e725041a1eb397916b751aecdafc0ad302a2f
SSDEEP 24576:SSc8mf+VmrycN1M1+C89HNnxX+SajGlf483QzzSKmIca9UKcJSCKaK+vheMJ:BSucNSAC89tnxX+MftTmUKcJunMJ
TLSH
T11A7533DAEA452BF6EC26A672605BE740032DD19673D406E70FA009BAFCFE709457B10D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-56-0x00007FFDF70E0000-0x00007FFDF750E000-memory.dmp

Download

memory/1504-642-0x00007FFDF70E0000-0x00007FFDF750E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads