hxxps://www[.]gamazi[.]com/cmp/3C29RL1/25MNR5R/?sub1=SOURCE&sub2=CLICKID&sub3=gx-us-pwngames-zenlesszonezero-ssd

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.gamazi.com/cmp/3C29RL1/25MNR5R/?sub1=SOURCE&sub2=CLICKID&sub3=gx-us-pwngames-zenlesszonezero-ssd
Sample260623-g8qs9aa191

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
184	5084	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	HYPHelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	HYP.exe

Executes dropped EXE 9 IoCs

pid	Process
6140	ZenlessZoneZero_install_ua_37b697dc042d.exe
5828	7z.exe
436	7z.exe
5828	launcher.exe
2200	HYP.exe
3176	HYPHelper.exe
4404	HYPHelper.exe
4428	HYPHelper.exe
3816	HYPHelper.exe

Loads dropped DLL 63 IoCs

pid	Process
5828	7z.exe
436	7z.exe
5828	launcher.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
3176	HYPHelper.exe
4404	HYPHelper.exe
4404	HYPHelper.exe
4404	HYPHelper.exe
4404	HYPHelper.exe
4404	HYPHelper.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
4428	HYPHelper.exe
4428	HYPHelper.exe
4428	HYPHelper.exe
4428	HYPHelper.exe
4428	HYPHelper.exe
3816	HYPHelper.exe
3816	HYPHelper.exe
3816	HYPHelper.exe
3816	HYPHelper.exe
3816	HYPHelper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	HYP.exe
File opened (read-only)	\??\F:	HYP.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\fi.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\chrome_elf.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\imageformats\qgif.dll	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\chrome_100_percent.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\HYBase.dll	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\HYEngine.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\imageformats\qtga.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\sophon.dll	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\en-GB.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\HYGui.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\imageformats\qicns.dll	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\msvcp140_2.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\vcruntime140_1.dll	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\ca.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\fa.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\id.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\ms.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\HYLauncherPlugin.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\HYUpdater.exe	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\sk.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\icudtl.dat	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\nb.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\te.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\zh-TW.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\ico\nap_global.ico	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\ml.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\v8_context_snapshot.bin	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\concrt140.dll	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\vcruntime140.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\fil.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\ru.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\th.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\7z.exe	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\hpatchz.exe	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\HYContainerPlugin.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\Qt5Network.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\debug.log	HYPHelper.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\cs.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\es.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\libEGL.dll	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\fr.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\lv.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\ro.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\msvcp140_atomic_wait.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\debug.log	HYP.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\pt-PT.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\vi.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\Qt5Gui.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\chrome_100_percent.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\vcruntime140_threads.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\gameicon.ico	ZenlessZoneZero_install_ua_37b697dc042d.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\da.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\pt-BR.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\launcher.exe	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\app.conf.dat	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\hr.pak	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\it.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\ro.pak	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\HYP.exe	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\libEGL.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\vk_swiftshader.dll	7z.exe
File created	C:\Program Files\HoYoPlay\1.16.1.364\zip7_wrapper.dll	7z.exe
File opened for modification	C:\Program Files\HoYoPlay\1.16.1.364\resources\locales\ar.pak	7z.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5084	msedge.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	HYP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	HYP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	HYP.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ZenlessZoneZero_install_ua_37b697dc042d.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ZenlessZoneZero_install_ua_37b697dc042d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	ZenlessZoneZero_install_ua_37b697dc042d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ZenlessZoneZero_install_ua_37b697dc042d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HYP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	HYP.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	launcher.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HYP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HYP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	HYP.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HYP.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266697573825916"	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global-1-0\shell\open\command	HYP.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global-1-0\shell\open	HYP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global-1-0\shell\open\command\ = "\"C:\\Program Files\\HoYoPlay\\launcher.exe\" \"--url=%1\""	HYP.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\shell\open\command	ZenlessZoneZero_install_ua_37b697dc042d.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\shell	ZenlessZoneZero_install_ua_37b697dc042d.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\shell\open	ZenlessZoneZero_install_ua_37b697dc042d.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\shell\open\command	HYP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\shell\open\command\ = "\"C:\\Program Files\\HoYoPlay\\launcher.exe\" \"--url=%1\""	HYP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global-1-0\UseOriginalUrlEncoding = "1"	HYP.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global-1-0\shell	HYP.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{40052EC5-E2E0-4E2C-A437-BEFAFDA5B8DA}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\URL Protocol = "HYP-global"	ZenlessZoneZero_install_ua_37b697dc042d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\shell\open\command\ = "\"C:\\Program Files\\HoYoPlay\\launcher.exe\" \"--url=%1\""	ZenlessZoneZero_install_ua_37b697dc042d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\URL Protocol = "HYP-global"	HYP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\UseOriginalUrlEncoding = "1"	HYP.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global	ZenlessZoneZero_install_ua_37b697dc042d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global\UseOriginalUrlEncoding = "1"	ZenlessZoneZero_install_ua_37b697dc042d.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global-1-0	HYP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global	HYP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\HYP-global-1-0\URL Protocol = "HYP-global-1-0"	HYP.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
6140	ZenlessZoneZero_install_ua_37b697dc042d.exe
2200	HYP.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6140	ZenlessZoneZero_install_ua_37b697dc042d.exe
6140	ZenlessZoneZero_install_ua_37b697dc042d.exe
6140	ZenlessZoneZero_install_ua_37b697dc042d.exe
6140	ZenlessZoneZero_install_ua_37b697dc042d.exe
1464	msedge.exe
1464	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6140	ZenlessZoneZero_install_ua_37b697dc042d.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeRestorePrivilege	5828	7z.exe
Token: 35	5828	7z.exe
Token: SeSecurityPrivilege	5828	7z.exe
Token: SeRestorePrivilege	436	7z.exe
Token: 35	436	7z.exe
Token: SeSecurityPrivilege	436	7z.exe
Token: SeSecurityPrivilege	436	7z.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe
Token: SeShutdownPrivilege	2200	HYP.exe
Token: SeCreatePagefilePrivilege	2200	HYP.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe
2200	HYP.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
6140	ZenlessZoneZero_install_ua_37b697dc042d.exe
5828	7z.exe
436	7z.exe
5828	launcher.exe
2200	HYP.exe
3176	HYPHelper.exe
4404	HYPHelper.exe
4428	HYPHelper.exe
3816	HYPHelper.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2344	2544	msedge.exe	87
PID 2544 wrote to memory of 5084	2544	msedge.exe	88
PID 2544 wrote to memory of 2352	2544	msedge.exe	89
PID 2544 wrote to memory of 2352	2544	msedge.exe	89
PID 2544 wrote to memory of 2352	2544	msedge.exe	89
PID 2544 wrote to memory of 4340	2544	msedge.exe	90
PID 2544 wrote to memory of 4340	2544	msedge.exe	90
PID 2544 wrote to memory of 380	2544	msedge.exe	92
PID 2544 wrote to memory of 380	2544	msedge.exe	92
PID 2544 wrote to memory of 380	2544	msedge.exe	92
PID 2544 wrote to memory of 1348	2544	msedge.exe	91
PID 2544 wrote to memory of 1348	2544	msedge.exe	91
PID 2544 wrote to memory of 1348	2544	msedge.exe	91
PID 2544 wrote to memory of 1616	2544	msedge.exe	93
PID 2544 wrote to memory of 1616	2544	msedge.exe	93
PID 2544 wrote to memory of 1616	2544	msedge.exe	93
PID 2544 wrote to memory of 1644	2544	msedge.exe	94
PID 2544 wrote to memory of 1644	2544	msedge.exe	94
PID 2544 wrote to memory of 1644	2544	msedge.exe	94
PID 2544 wrote to memory of 3396	2544	msedge.exe	98
PID 2544 wrote to memory of 3396	2544	msedge.exe	98
PID 2544 wrote to memory of 3396	2544	msedge.exe	98
PID 2544 wrote to memory of 3508	2544	msedge.exe	100
PID 2544 wrote to memory of 5096	2544	msedge.exe	101
PID 2544 wrote to memory of 3508	2544	msedge.exe	100
PID 2544 wrote to memory of 5096	2544	msedge.exe	101
PID 2544 wrote to memory of 4368	2544	msedge.exe	104
PID 2544 wrote to memory of 4368	2544	msedge.exe	104
PID 2544 wrote to memory of 228	2544	msedge.exe	105
PID 2544 wrote to memory of 228	2544	msedge.exe	105
PID 2544 wrote to memory of 228	2544	msedge.exe	105
PID 2544 wrote to memory of 4276	2544	msedge.exe	109
PID 2544 wrote to memory of 3876	2544	msedge.exe	116
PID 2544 wrote to memory of 3016	2544	msedge.exe	117
PID 2544 wrote to memory of 4632	2544	msedge.exe	118
PID 2544 wrote to memory of 5144	2544	msedge.exe	121
PID 2544 wrote to memory of 5144	2544	msedge.exe	121
PID 2544 wrote to memory of 5432	2544	msedge.exe	122
PID 2544 wrote to memory of 5440	2544	msedge.exe	123
PID 2544 wrote to memory of 5432	2544	msedge.exe	122
PID 2544 wrote to memory of 5440	2544	msedge.exe	123
PID 2544 wrote to memory of 5440	2544	msedge.exe	123
PID 2544 wrote to memory of 5968	2544	msedge.exe	124
PID 6140 wrote to memory of 5828	6140	ZenlessZoneZero_install_ua_37b697dc042d.exe	129
PID 6140 wrote to memory of 436	6140	ZenlessZoneZero_install_ua_37b697dc042d.exe	131
PID 6140 wrote to memory of 5828	6140	ZenlessZoneZero_install_ua_37b697dc042d.exe	134
PID 5828 wrote to memory of 2200	5828	launcher.exe	136
PID 2544 wrote to memory of 1464	2544	msedge.exe	137
PID 2200 wrote to memory of 3176	2200	HYP.exe	138
PID 2200 wrote to memory of 4404	2200	HYP.exe	139
PID 2200 wrote to memory of 4428	2200	HYP.exe	140
PID 2200 wrote to memory of 3816	2200	HYP.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.gamazi.com/cmp/3C29RL1/25MNR5R/?sub1=SOURCE&sub2=CLICKID&sub3=gx-us-pwngames-zenlesszonezero-ssd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff88f3cc188,0x7ff88f3cc194,0x7ff88f3cc1a0
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1936,i,13579353201570346206,17491423951287782948,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,3569294085693492401,10582253369792307377,262144 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2512,i,8905439237017898349,7238342596101139254,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,831535828745092925,10224365064183481260,2097152 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2019975703902228540,9644569360829179987,2097152 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4060,i,18121744636424299616,3596675858861901735,2097152 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,6859327155216432251,12029373117248848130,2097152 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3932,i,7468084028788712455,8907534485313359800,2097152 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5096,i,5722473517186360957,16712232844507939754,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5012,i,6121937222612133087,11924499228992063946,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5772,i,17566128832515763685,13909834803876250029,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3472,i,17281638391991949455,15506211819141771036,2097152 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5996,i,7548818264353097644,16288526628680952985,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5996,i,7548818264353097644,16288526628680952985,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4108,i,4324141044878525253,14551574876127586401,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4080,i,10003763130691850732,15264342274170780620,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4892,i,4129059468210001097,5159872862009374336,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6632,i,11801254341343883344,5370627431324230493,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5304,i,16585784374903755679,14922436699230233989,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6660,i,12404968268932451605,15341787051565435491,2097152 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5256,i,755786578130611618,2058972204815835874,524288 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6380,i,14660132599939526074,9213530820298818891,262144 --field-trial-handle=2272,i,12962818832592994400,13901370262654657541,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6108

C:\Users\Admin\Downloads\ZenlessZoneZero_install_ua_37b697dc042d.exe
"C:\Users\Admin\Downloads\ZenlessZoneZero_install_ua_37b697dc042d.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Users\Admin\AppData\Local\Temp\HYP-uvbXBA\7z.exe
  7z.exe l C:\Users\Admin\AppData\Local\Temp\HYP-uvbXBA\app.7z
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5828
- C:\Users\Admin\AppData\Local\Temp\HYP-uvbXBA\7z.exe
  C:\Users\Admin\AppData\Local\Temp\HYP-uvbXBA\7z.exe x C:\Users\Admin\AppData\Local\Temp\HYP-uvbXBA\app.7z "-oC:\Program Files\HoYoPlay" -aoa -bsp1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:436
- C:\Program Files\HoYoPlay\launcher.exe
  "C:\Program Files\HoYoPlay\launcher.exe" --jump=installer --game=nap_global
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files\HoYoPlay\1.16.1.364\HYP.exe
    "C:\Program Files\HoYoPlay\1.16.1.364\HYP.exe" --jump=installer --game=nap_global
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Program Files\HoYoPlay\1.16.1.364\HYPHelper.exe
      "C:\Program Files\HoYoPlay\1.16.1.364\HYPHelper" --type=gpu-process --no-sandbox --locales-dir-path="C:\Program Files\HoYoPlay\1.16.1.364\resources\locales" --log-severity=warning --resources-dir-path="C:\Program Files\HoYoPlay\1.16.1.364\resources" --user-agent="HYPContainer/1.16.1.364 (windows 10)" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\cache" --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-2200 --disable-extensions --renderer-process-limit=1 --enable-aggressive-domstorage-flushing --enable-experimental-web-platform-features --pretend-process-name=chrome.exe --no-proxy-server --bridge-obj-name=HYPClient --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\HoYoPlay\1.16.1.364\debug.log" --mojo-platform-channel-handle=2772 --field-trial-handle=3100,i,15719929142073361438,15198254999560703978,131072 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CriticalClientHint,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrefersColorSchemeClientHintHeader,PrefersReducedMotionClientHintHeader,PrivateNetworkAccessForWorkers,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3176
  - - C:\Program Files\HoYoPlay\1.16.1.364\HYPHelper.exe
      "C:\Program Files\HoYoPlay\1.16.1.364\HYPHelper" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --enable-experimental-web-platform-features --locales-dir-path="C:\Program Files\HoYoPlay\1.16.1.364\resources\locales" --log-severity=warning --resources-dir-path="C:\Program Files\HoYoPlay\1.16.1.364\resources" --user-agent="HYPContainer/1.16.1.364 (windows 10)" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\cache" --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-2200 --disable-extensions --renderer-process-limit=1 --enable-aggressive-domstorage-flushing --enable-experimental-web-platform-features --pretend-process-name=chrome.exe --no-proxy-server --bridge-obj-name=HYPClient --log-file="C:\Program Files\HoYoPlay\1.16.1.364\debug.log" --mojo-platform-channel-handle=3160 --field-trial-handle=3100,i,15719929142073361438,15198254999560703978,131072 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CriticalClientHint,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrefersColorSchemeClientHintHeader,PrefersReducedMotionClientHintHeader,PrivateNetworkAccessForWorkers,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:4404
  - - C:\Program Files\HoYoPlay\1.16.1.364\HYPHelper.exe
      "C:\Program Files\HoYoPlay\1.16.1.364\HYPHelper" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --enable-experimental-web-platform-features --locales-dir-path="C:\Program Files\HoYoPlay\1.16.1.364\resources\locales" --log-severity=warning --resources-dir-path="C:\Program Files\HoYoPlay\1.16.1.364\resources" --user-agent="HYPContainer/1.16.1.364 (windows 10)" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\cache" --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-2200 --disable-extensions --renderer-process-limit=1 --enable-aggressive-domstorage-flushing --enable-experimental-web-platform-features --pretend-process-name=chrome.exe --no-proxy-server --bridge-obj-name=HYPClient --log-file="C:\Program Files\HoYoPlay\1.16.1.364\debug.log" --mojo-platform-channel-handle=3680 --field-trial-handle=3100,i,15719929142073361438,15198254999560703978,131072 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CriticalClientHint,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrefersColorSchemeClientHintHeader,PrefersReducedMotionClientHintHeader,PrivateNetworkAccessForWorkers,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:4428
  - - C:\Program Files\HoYoPlay\1.16.1.364\HYPHelper.exe
      "C:\Program Files\HoYoPlay\1.16.1.364\HYPHelper" --type=renderer --locales-dir-path="C:\Program Files\HoYoPlay\1.16.1.364\resources\locales" --log-severity=warning --resources-dir-path="C:\Program Files\HoYoPlay\1.16.1.364\resources" --user-agent="HYPContainer/1.16.1.364 (windows 10)" --disable-extensions --user-data-dir="C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\cache" --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-2200 --disable-extensions --renderer-process-limit=1 --enable-aggressive-domstorage-flushing --enable-experimental-web-platform-features --pretend-process-name=chrome.exe --no-proxy-server --bridge-obj-name=HYPClient --first-renderer-process --no-sandbox --enable-experimental-web-platform-features --log-file="C:\Program Files\HoYoPlay\1.16.1.364\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4228 --field-trial-handle=3100,i,15719929142073361438,15198254999560703978,131072 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CriticalClientHint,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrefersColorSchemeClientHintHeader,PrefersReducedMotionClientHintHeader,PrivateNetworkAccessForWorkers,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HYBase.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\HYBase.dll
Size 4.0MB
SHA256 e6621fc4aef6bb3013ad97792e64130afa01410cd88617b5a8acc2f573af0a5b
MD5 4b5d67b341ab26dd7eda26720f3285c3
SHA1 ad55893ce8ade74fb41810ddd3ea0428276c3f76
SHA512 82e1f90ae28bfb64829b75216f0e0f03c64b4c4a6c52516eaaaaa1ee3116563437be615ddbad26dd0e95827dc28fca9f93f335263d305fc2ed78b415e092c072
SSDEEP 49152:fzdWhTSLZD4XZcMc1bMPH/flFXI/+k6T1vbef5OReKvx4vt0GX8CRb8MvMQ5rNYV:mcVHC2ertR
TLSH
T160167E5B719C00E8E0BBD17D8B8F5E03E6B234454365DADB06D1429A2F67FE84A7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HYCommon.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\HYCommon.dll
Size 4.9MB
SHA256 e9f14cecde5ca7713a425cc7a755f6119348011533a285bceef8d190b41ff425
MD5 2af98fb5c0d494eaba736c72b4ed06b8
SHA1 415ecae6d289b30f75bdab6abbaf43ca16664387
SHA512 15949af5c9d1de3fef06e841c011256384ae80f0283643fef27f6841ce7b3ad222cf1729786f7cdfc9370c94412f10089735124790383327116d67fc44a3cc73
SSDEEP 49152:Q+7srsEKLJdvBYJwfKti1M9mvPPH/flFXI/a6T1vUDTD9ZbNYQqlzNOz5GX8eqfS:KaJDYPtJ297CS2jf5d5dz
TLSH
T119366D5772AD00E8E1BBD07D8E8B5E07E6B2344543119BDB06D1839A2F67BE84D7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HYEngine.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\HYEngine.dll
Size 204KB
SHA256 2bb2c3aa21fd2b2d882c508716d6de94fe746fb518133647cafce4eae0dd0859
MD5 067c1c909834eedc003b5a6ffda00085
SHA1 0ff4a5afdae9285f73216cbc82ab324181ed097c
SHA512 5d32d9c932d8feea493476aa97d0535688dec04d5760c9d8cd454d5f0725d6bad8ceb4139a5fed34fcdf6ddd100883cda95a357918905abd3ed411fd6ef43c56
SSDEEP 3072:lfbj6BjXiUxDmG90OaBKS+IqkdfiexRseFhgbMMIMN:Z6kUwDn+I93xeeFhVle
TLSH
T1EF14296B72680099D527D17DCA864A03F77278430712DBCF02A4D3BAEF736D429BE661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HYGui.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\HYGui.dll
Size 146KB
SHA256 a00a70355b7b5036434a5f018d77c718255c3ab2d1083dfc4f59bfe9cafa5852
MD5 2837acbeb1eeaa84de46e397952d3ad6
SHA1 4ccb32a614fc9526b2660bf99503deb2178fe5b5
SHA512 2b9008fc4eae3862677a1ea1a4a55cf691071e9871136bf0b7721e7a5dd282b5900a671a95b614c5543603a9187d6ccf89d594c400d74b1820ab21787d6ea535
SSDEEP 3072:RVzBIBcOHjsVlSHuFt29nx6I/NrC/OlmE4BCc6M+Mb:WB7jsHSOF0nx6I/NQE4BCL7w
TLSH
T12EE38D277725408AE06BD2B9D68B0B12DB73B856071297CF539AC1682FA73C03DBE549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HYP.exe

Path C:\Program Files\HoYoPlay\1.16.1.364\HYP.exe
Size 694KB
SHA256 87da01c6adda3e62b18ac5dbf03318dfc289f9c2f0d82ce511de690c7b3c1a30
MD5 f6121f9120366a4ba031a616356c469c
SHA1 cdaa5e7aa05e28a69ce58c988c3aa661136c65f0
SHA512 187914fdc674b95a559a7f944b6771debc8a0c805521cd5c070d56da5b4ac4785e5a61590f1e377419a33cb6b0d57556c88c00876b17cadfa54934db8b155522
SSDEEP 6144:z/0qjlXDXXzormXbrPhPf1tQF+bEkcEJ2UXnl844ERjopElp:z/FxX1PhPBbEkTJ2UXnKERjy+
TLSH
T175E469A66103B05CCCFA92F9998185BDA6722C0B333342BA47067D7D5E361B7DFE6121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HYQComm.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\HYQComm.dll
Size 998KB
SHA256 b729aba2329a735d91b8f88877c1f974fba3524fad5f95c56d5a9c8010af3da5
MD5 65469de34537a3642d91694718f4d2f8
SHA1 4ca7b95c165273fc98c9358828614ff2636abfec
SHA512 82036c9a3a6967693c5a8fdbd20e3afea8b003bb736c8d98efa4abf55f1ba0ada6d12aacce05f51f335a0e1959319ed1b32e0598c618e5d58d184a5634269106
SSDEEP 24576:ztH1D8Loov3+y3IQQO2oH59kJO9XJnPLsDYt0yO9a2CYexE1UPhFCBmAobkNkNwn:JtioovZ/w
TLSH
T124256C3B371901A5F47BC1BDCBC74A23E1B6705643628AEF0650DA297F376D1AA3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HYUiKit.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\HYUiKit.dll
Size 701KB
SHA256 56b0dd0b5436c769c0489699d06c2788aea5e02bd1bd8c456cdc26c504b70daa
MD5 830773e35ee3be0e24c428ee4f8db342
SHA1 93986725c21c11d365568cbab364eb364e59af14
SHA512 d790411b7f1362de82d86469d9fe6d0a6acfae4be09ed2f7f8cca2c6889e5dcec4bbd7530c941b5abab4240998eb744a2fc23bd78916625ab7169f10452b45e6
SSDEEP 12288:kBSqi63oy5K1Dy3w59PmijVzi9vM6fOmZUs:rC3oT123w9PHZzi1h
TLSH
T16CE45B9773664381D26BC27AC69B4A22E772705587C2E7CF8129DE081F237D93A3D349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QCefView.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\QCefView.dll
Size 946KB
SHA256 6e180c3c702530679a9438d8eebe4ad51aa3c370d9b603a8f59d708a2266a9a1
MD5 a2d34944324312551b694b96939d535d
SHA1 a03044fe01e0930a48ff4b17ba285798b5c7619f
SHA512 c7d94aaffc156ed25a6f9420ba85dbcb9917f75aee44b8f173160b328c4bc18d099648f4dd0a0ade0324a8e94ae1489216b31376877be59ac71a5c9312ee810b
SSDEEP 12288:lcwpKHUoIAq7RGiPEVBr5jgBkWMXywR6F/8vYKdqfbmw:lcZZIAqJPEVBrGYXJvw4ebV
TLSH
T172253A2E22AC0154E2B6E63ECE9BCA09E6B1395A1311E6CF1058575DBF1BFE4467F310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\Qt5Core.dll
Size 5.9MB
SHA256 252c945d49b7d9ebd91ab3e165b401f89449b4f3913b8a79545a7dea1874be81
MD5 b4e2b1d422ee21ca12627d8edcb13e6f
SHA1 c97f39c986dba98a06f1f25fed9f13969bd45a82
SHA512 8065a9111759bc919227171fdc6036a88631a8a0d30d562f5d55bf4de8af994f27f465548ba4f6c92e18fb97919ee8f026ac28ff54a77ecb12b9cedc8b830486
SSDEEP 98304:3XfIUKgl2u2Jsv6tWKFdu9CDti+Z/zxqf1Hcezf:wUKc2VJsv6tWKFdu9ChzZ7xqf1Hd
TLSH
T11D568C87B2A60265D4B7C13886D7C12BE67278018B619ADF125CA3596F737F12E3F318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\Qt5Gui.dll
Size 7.0MB
SHA256 314ea6d4bf71f14d2e681cd45439513f081681c1985f5efc1e95ac473e9ee8fa
MD5 6e256336c1ece5a2ff98274c29c538d1
SHA1 0a7ec9ee755dd03552310b7b325fc86ec3cf534b
SHA512 a18471dcf9029da2c61719c68268d09b3185c026aec8307e868284019efa8d0cd45121eec6e3bc9105bf5860782880cf7976c6f00959b99cf25b264987a08322
SSDEEP 49152:XCMJSb8HTNLeZWP8cqj/rnsSCj+wcg6V5sAiC0m/YkHlRnkO6OZwKDLUWfEzffeJ:SMJDVKP1i8RrvnEoS5vAT+g5CU
TLSH
T1FC762886725A6261C977E17E874F052EE1F3B85283428BC748559B480F337EA1B7FE06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\Qt5Widgets.dll
Size 5.3MB
SHA256 fcacc8d450b370255ba685bd9aff4e4e22af101d93d084365f73114fdaf447ce
MD5 7bd962449eafb26a855db2b9765ec28c
SHA1 d4f916b559fef1018b6fde72e90b25fbcbce81df
SHA512 a16bfddfdc8ec4ec0097a3d29373670a117dbc225f407b5a2ee086b6ea916885b882c1cce661753a429ea0eab29b8168307a65df9139d304e154f62162eea85a
SSDEEP 49152:OU9WNkDGy2IMOVTaghDNuDziPWmQdmIKEzgKyn0pLLHkIzvPLr3qD7jbJAovXdfD:sShj4ltqnJAovXdfs6FLClJyWjK5ft
TLSH
T181466C5BB3A50185C16BC238CA8B8517E6B270044B639BCF256ACE5D2F737E12E7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.conf.dat

Path C:\Program Files\HoYoPlay\1.16.1.364\app.conf.dat
Size 2KB
SHA256 78402c2197357f0f83e5b32ea334d951363cba7534111603dbc082f4c0f737b3
MD5 344496a2409dccd779d0fd8a928325ab
SHA1 772806d50b0b68740e307e8f7dcaae86c1ec1cc7
SHA512 4b93dcc97d7379293b2a927f4553e4b6ef3c96faf378841b07290c96a11eeac2fa9b723859997f768d3309f69c3fa25a7b68ec6ffbc336be935a339ab296793c
TLSH
T1D0413B05E838CE2B355F5A1A89423F8A0323BC2D1CAF454F753F40C9DB12B52B686657
MD5 SHA1 SHA512 TLSH

Submit Download

icudt71l.dat

Path C:\Program Files\HoYoPlay\1.16.1.364\icudt71l.dat
Size 10.0MB
SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
MD5 76bef9b8bb32e1e54fe1054c97b84a10
SHA1 05dfea2a3afeda799ab01bb7fbce628cacd596f4
SHA512 7330df8129e7a0b7b3655498b2593321595ec29445ea193c8f473c593590f5701eb7125ff6e5cde970c54765f9565fa51c2c54af6e2127f582ab45efa7a3a0f6
SSDEEP 196608:p5zwSv9AAyse6liXUxCGZHa93Whlw6ZCXU0:pyKlysTliXUxCGZHa93Whlw6ZCX1
TLSH
T101B62807A2FB8DC2F9F76F30D9F452679567BD496E32805A11042F3B1C337A08661BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.exe

Path C:\Program Files\HoYoPlay\1.16.1.364\launcher.exe
Size 5.9MB
SHA256 b8ff8c12a2feacefcf47cf55050fa5eb518244124af33862e68713fc81dc6a46
MD5 3c6e3bf61695656b7f7fa718ea1d5851
SHA1 4c087c848ebd8fa37aa42c8aa6760b82d910d78e
SHA512 7de04ac1f85682d7bdc609c3fa7402d10e3583e155a9a55ce19a6bf431c8b4ad7850e208a0f342e36f8811507aa67f88bc1aefc731174efa41084ce70461752e
SSDEEP 49152:1lWsk2alttLf9WlSdIPH/flFXI/qH4BdYXJ2ToKLCmfOGX8yv2TKjf6hpBmrRX4i:1lW7PG2VT6VeqpkvyOL1ZkAXnXK6jye
TLSH
T174565C16215A10DCDCFBD0FD8A86493AE5713C06133256EB06927A6D1F37AF5CEBE620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

telemetry.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\telemetry.dll
Size 9.0MB
SHA256 0759a59e7c015c65cc0ce34af885892aec3e8e8ff717a9c66a0b565116fc4bd3
MD5 27d03ea342c356a7b3cc06713cccdb5f
SHA1 9080cc1e66aff109e2f8a21f3e8e1c29edce6184
SHA512 2c364f13550ce6b51bac654d0fd954fca9fe29304753f612e5a0ba1d92f557430d2197accafd385ef7adbff1c72b77a02d64a6c7d4c8f969af286b1e72d29d95
SSDEEP 98304:JP65wqhTv0q21uF18Myg3j2VW7GP1WZtZWO1y0NqhmEzG3EYqzZTCLGNx+B+iLNP:16jjKBsd1yFm5qzZmW+B+iLZH
TLSH
T1E8967C03E29640E9D45EC2B987179632EA76BC890B35B5EF079067252F67FE06B3C710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\HoYoPlay\1.16.1.364\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Program Files\HoYoPlay\config.ini
Size 101B
SHA256 b889ac8df7919ff99dd202cc824bdccf81b6725a09488730641fe8131c85feb9
MD5 9aaf3ff310b57ad94ebb1e20c9626e4d
SHA1 cda169809d7f6050e9bd8e4d63061eeb1a7009a2
SHA512 69188190904f39e6a65d6c75edfe7506bf107d3e904dfd9a8617831d18d1b3f2f8f6ce3daf16b23344c3840b3b52b338764bd4de9c4829d66e5f1efcf49d5dab
TLSH
T1D2B0126D9C413B07943EB418D3A837212006165AEE6D4413FAECA0FF8C14905B05F630
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Program Files\HoYoPlay\config.ini
Size 289B
SHA256 0225091a768278d887ec898d1598f560af228e4229cbf0ca8512541ce7f94d26
MD5 0516d6e1947f9a3243dfe13b8d1ec612
SHA1 f448e10a1d5b197868aae8035b340b3f52409549
SHA512 0c6970065d7f92c6b60a252244d785bd54a765d3291f9f3ab1bc7c0941eef61211de390228d604e9ce74c9f2860c978a8367ac48b2bc7af0e5011593674cbe7d
TLSH
T19CD0C2B8BD04F6D4A49BB02CB1A0220B99582868FF2C0727B0C290AACD38E84141521B
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.exe

Path C:\Program Files\HoYoPlay\uninstall.exe
Size 32.1MB
SHA256 8e01a0fa01bff60f9fcc410616c22c7900f770abecc1146ca5c21545b22e8287
MD5 828830ba21165a561b64f2b4f75faaf1
SHA1 026985f240cdafc2864d2a403b5132c7b4bba803
SHA512 fd97bfadc33902b66cc0a7116184ecbb3cff1b89754148404becd4bbf2d069720c59eb685f4e6ab5ba62386da566e18c90d9048b13d62faadade7272fc183ee1
SSDEEP 393216:4O7eTYSgE8ahF8K9UpfUu5EHEv3XAiajVQhD/ZeprVhk5QpzJsv6tWKFdu9Cb0Pn:4k+9iB+iDorVhk5QppC
TLSH
T15A77BE4772A402D8E0B7C17CCAA7C617EBB2781A57319BDF11A4969A1F33BF0593A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000190

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000190
Size 66KB
SHA256 f494c60962b366bc97b7127a662a31a37c88e23f9edbb94b7d22e0837bd5cfff
MD5 1c6859fdff9a0753194f16df3a13504a
SHA1 dfdb6f754407e3e0a3e0cf55c85d37e4c27e1d1e
SHA512 40b04d094de4148211083c20f1b490b0aa0683332a3064ea59888cb56fb754a5307f02ee6a5d7d0a7d9b3cbfd2656991e3451e61e1a82f42ef5b6f7f0f704dd1
SSDEEP 1536:OXsBqjhx3Rw/bxBmFaxefI3vdKjZxHEUaxky1ReAY0SMfIFV:DBqLhwlDYf4WHdaxky6H5uW
TLSH
T1456302D5C60D1DADFCD1D90BB78965C9BAF948780AFEF8440BC23ECAEAC548863D4214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ac585cd60954a361e70fe06202dcc69bb6d4883811af865c7d22ad1ddbb9cfef
MD5 660efb53ef78cfd21618168072d157f6
SHA1 5540a6528f11aa4a2b080aa18a74b67ef32c7c7e
SHA512 ee5ca6972be33dc0d1554537c782b4acf45fa1f50ea63a677d1d06db5b44c0f5092996e0376b92d2ce5c616a1f1e9e08887620ec50352e96429d26ee72ac0f1f
SSDEEP 96:TcNS7zxhFGIG4Hvvvqj1OEjf7TAfIXubsTD5:4NS708vvvqj1OYf7TAdQTD5
TLSH
T1AE91833002BA12A4D75059B2E0D36E02767749DA4EA7CF5F916F87FCE235BA24C2D468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5935db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5935db.TMP
Size 3KB
SHA256 2f4dc52afe021f132dce339d1b2480d92b3020e49bf683a3e0b3630b0c03046c
MD5 2cab5bfbecf8903f0533c0bd55da1a5f
SHA1 e573376a0eae1c56e07109434e2fecb1f0a08658
SHA512 a431bc4797759ad06e26e76c13a6dfe251caca9313a0e278875394b23541e25a5b860a07bf52b068b41f6969d0c8abce779425936f04def6781a5452523c5c4f
TLSH
T1FF613A3502A113A1E3900572D0E36E0539738DD94EA7CF2E527FA7FDE635BA28C2E048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 937694145e383c82ceda4f9995e6fae389836d5272eee870522dcd1dfbd9dd51
MD5 1b3f48efc982555a9a2bb96c1b71b22d
SHA1 fb71e47cecc76719ca48922738027553aa6ea918
SHA512 bfc0829623491753fa522c7abf07ceb9efeadd0673696cfe41e957718d4291e6482ede902be4fa9b5f41ebe65584dc86972f996d8767321973316cac8393abfb
TLSH
T1DD71AEFB43B1866E9E0999F4AA14EE1FCF1C0521835C3CA589D0BE1BD7B34A6E00560F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 74df50e57478a41d737d175cbb492589eebbe56660de2d34440ae6f98b25dab2
MD5 e69592ade88db458b7f090141851c522
SHA1 2db8a226f05d5b82d8d9a23d7a88170985c83cb3
SHA512 3697437308b003833abdf5725bc72ad059ac4ceb41b5c95ddaca37aec95446ad42beaadd714175bec475845d4338334cabf262ed04c9e551afc2e53ad9dd874a
TLSH
T110819DFB47B1866E9E0999F5AA14EE1FCF1C0521835C38A589D0BE1BD7B34A6E00560F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cbab1f1fe5c5388f552c38f3d59fb76fa3d7f212aada5d787e3340e038027b98
MD5 f50bc71cc7a4ccf722d18aeb21c8c0df
SHA1 3d762199c294b43722380bc52c3cbd95a3abde09
SHA512 a9bb744ace52bc6650215fafc8dd2a1132952114d6fc263c7fa6791a903b6ae50b729afe9020eb0a207422fd7dc44a16d34fbebd0c526530228813bb7c5282cc
SSDEEP 192:sxZzRXyM/jK1Ml8Mkj/fdsGE8pVAEdpjr+HW6+WNlk3V/YwT35bIgrJ:sxZztMj/fdsf8pVHmHb0/j9
TLSH
T12A52E802AB345A7BCCDBD209F945BF53D6F54562A2D00E44AAFCDA0C05E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 39139f9d00f5e4522442eefe23dd4fa84648b744fe6a7cf40827e2b23b739db9
MD5 74c58958390fbb31f5c6c9923172cda6
SHA1 584c0c4d8900fe5a69b9a8fd633eaacf41f1bf83
SHA512 b1614bd4031b7278aca0c5eeabf43cdc6443bfa0ce5d1621f207030d171e206b9b7f1b16c1e16693c32534663e681151f11bca4fa894d7795ca35945945937a5
SSDEEP 192:sxZzRXyM/jK1Ml8MkQj/fdsTTE8zVAIdppRryHW6+WNlk3VEWdbYwoswbIg5hJ:sxZztNj/fdsU8zVByHb0/bGZ
TLSH
T14E62D656AA345A77CCDBD209B905BB53D6F55462A3D00E44AAFCCA0C05E6FED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c315f8ad74192ef34eac0f0b656e0a571830c54a3f326b12caf1446c50cfe730
MD5 8a08eaed520d3107810a8aee4b759f3b
SHA1 cbd594035a4de090dd3203c6fee5c697ce142d93
SHA512 4ee5688febb2300fba825923ce2ec0bb6e3e7cd4e090f5b99a552f0a27cab392784ca354eb16de411c223ced3e11b38c36a764df57b7f7ddf6aa8bf9a43af497
SSDEEP 192:sxZzRXyM/jK1Ml8UQJkQj/fdsTTE8zVAIdppRryHW6+WNlk3VEG56qLYwxkswbIg:sxZztqTj/fdsU8zVByHb0xLEZ
TLSH
T19362D756AA349A77CCDBD209B945BB53D6F55472A2D00E44AAFCCA0C05E6FED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d0a9c6ef3420d76d8d580b3841a0d728eeb2f6ce3b81be9934f20e62a2b63bbd
MD5 840c1dfa9352ef8dd23af1b4bd9f914a
SHA1 60ce8040f071c2b56a0213d7dd0281e8f7b8f840
SHA512 69e7d4d18caeafe51c2747d3eaf02ef29681187dcf5bf68debf5536432be537446e9aa9628a3bef17272286232868c3c948eda225f899c1a0a731e75bec45253
SSDEEP 192:sxZzRXyM/jK1Ml8M9j/fdsTTE8zVAIdppRryHW6+WNlk3VEFSlYwfsXbIg5hJ:sxZzt1j/fdsU8zVByHb0NlAZ
TLSH
T1C952D712AA349A77CCDBD209B945BF53D6F55472A2D00E44AAFCCA0C05E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 462552dd2317f1eb1f28b39f94b179368496aeb03e6bc4ec67e9a8d6f052f57e
MD5 f3f617475f9a966bbb52a15de7665653
SHA1 92daf14b1ac6d11181403ab4786e1deab62d67a1
SHA512 0525b3d4ecd10fba0f42516431a842d16ddd786d8e96958322160454497dbd436d1c6eb62d73896495ae11d5c17d171b78717d8c6ac7eb89a5880696b6a8a158
SSDEEP 768:d24jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dyrohBcIah:d24jeXmWvmKLEu1jacPLZQdp8N
TLSH
T119D20A3B284CCF7E4F844E5CED26AE976ED801CB6A984D5047FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1edd35520f3c95072f7ceb777ab0f6447366227b8317c2d89079d0661085e9db
MD5 198d903b1fced119a30033f0e38b27c9
SHA1 f505dd141654f0a2f8cd06a8b951f3278c608892
SHA512 810d100d16ed502745b6ad720444b7cfed72aa5fe620cfc4716ad0a11d2912de80ab0a942280fc8ed53b66eb1366c374c38057b07cde5edf5ea28316d916ad0f
SSDEEP 24:KdQf3kVaadCC+4SO+lIjY+Kitham+1EwuSmEMt8ofyXYiflO/aUdo0Q4gM+DIjK3:KAJIdKawQvy1bI1KYcgM0ITKBakzyf
TLSH
T1E991400230B727473DBD260DA2B586DA56417163704DA82B3BEA40F25E2BE650DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0de12ce5-bbe2-4975-9054-7308f2c007b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0de12ce5-bbe2-4975-9054-7308f2c007b7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 105454068d61c45299c00de6b2189cfce3cd16ad1281b389cfe1603978a7ce6c
MD5 8a5118b03806939774a7f9155fc5c5c6
SHA1 0269a0472e9b01926d111347fbf6bf46b2344585
SHA512 c0a7b19e940d73fdd975f5e54e01b2ea53fe460668a51591dc669ed69dcd9c2504b367d76f49252de837388553efa734a5f648c841eeed9d6e2f92d26a1b89ee
SSDEEP 384:ytNn/s3n9SfsN5oEYw0f+DO5YShxJrIFBGITGT0Iax9x:yj+9UKUWONTh2BGi+0Pvx
TLSH
T1D4928D325828AD3B4DE29586F44B36174EF411ABE6C63F95D9EC2F0D00CA7EC230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8b17c0175ebfa7e6b88df7e39cbbbaf3ad607d4f1c7a0e64c6636c5b537a1ac
MD5 a4528348557bf1e31e50e0b05308e444
SHA1 c47fef577bec92ab0a7adbe142240fdf1abcab95
SHA512 2cd1178b358a6a880719c4b73a51991fa6501a4b573fa5cc1e22bb7b578cfd071d826504d40c45e2ab34d1bdf20028755096a24f0bbaed658419bc9a72beb73e
SSDEEP 192:EONt6hZ0QmiUy/mapc/+jVlO1TY55wOZBznU6:EONt6okpu+DO5YA2BDU6
TLSH
T1ED02E93568686C778EE2AE45F48777235FE4112BE9D56F84EAE82B1D00C779C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 9d2555fe00f73ea371fefc7f714e99bb54c2008e87b83a4316ddbd21670bb61e
MD5 01c7f89a05db88df853ec612428d629b
SHA1 bdacaf70034e4768fec23012e932546c05baf6fe
SHA512 96ee5dbc8e86220efae43e19e9bb1c7fdb75b5079be27845cd9292acc1a2a411b3ba963213022958a7370d935a1f9e57884f493e7cf7f1bba8e0e2965bb6793b
SSDEEP 384:aiF1tNn/s3n9SZzsNb8TUNTUlIllEYqwf+DO5YShxJr+FBGITGT0Iax9x:RF1j+9SqwgS4WONThwBGi+0Pvx
TLSH
T13EA27D334868DD3B9DE69A85F94B32178EF401ABD5C6BE95E6DC6F0C00CA6EC130AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f303094611ffacedff5831996db52d4568577bb29b73b274c1f5b62fa4035a16
MD5 8509a2c94b80ded58d6aaed0767d84aa
SHA1 ce7eec2103613b1d2a67c578639ec65658594ecc
SHA512 f824b18610dc408121c4451d1ffddd3bc85ebbf6915d94c6429f5fc5103a4833345c963ace0df01c1f04e86afbe70db141c14586f914cc97577fe0c50a326880
SSDEEP 384:3tNn/s3n9SfsN5lEYAl2f+DO5YShxJrIFBGITGT0Iax9x:3j+9UFlmWONTh2BGi+0Pvx
TLSH
T13A928E3258289D374DE29586F44B36174EF4116BE6C63F95D9EC2F0D04CA7EC231AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21f83d5bfab393bc948883d02468e609ab58565af6a3ad2f977ea80c9ed1de16
MD5 79df7511429f06c2d4852946a28d6df4
SHA1 ebeb3835856005312f657a954e6b372f45ebdf16
SHA512 5cc4f89d4d34252198b1934c60c29fde85f291f1756b67c70b119ef4f2d8401e31c5084665f483fc986426527aa2a0887f8eec9744af91ab431bfd4a1a0364b4
SSDEEP 192:GONs6hZ7QmiUyImaUc/+jVlO1TYSbFuSJrh5cOqB8qhqU6:GONs6JZUu+DO5YShxJrk9BGU6
TLSH
T11E120A3268689C774DE2A545F48736138EF4512BEAC97FD5D5DC2F1C00DBAAC230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f1a07c7126a02b1728edfaf8c0c4ddb5e0359d83dcede38c8b58e551e1e85a52
MD5 f9efc9c0c6e0d982389b1ef68a8c4687
SHA1 67e1e554fc6217fcfa5def54c2ec19a9d1acc6d2
SHA512 fb1ea361d50b18a6d482252caa36bbe81a05bfc935d054ce47bf2939c668ab5e0f2a157e0d00614b2d6c7c8b0ddd70d97a6f9fd605946b174991d8b460250b47
TLSH
T19BE00202970041C7C120033004C71F507FF2C110133303074731217C2CB33443D01240
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c60fa4fab7e33e9b086eaae8f0791185affa75ab8895990281e6b476e0f603d1
MD5 427bab77b626230a7085bcf7eb36d86f
SHA1 a6809c9f3ae47ef126b52ef074f3e045f1b4cf55
SHA512 2307df0055afb6e70cc924b7c7fac376bdda78b52d81efda24e6e6825caa338749e3359b4a2580969e860d8ee3a87410f4f4ae60c14145210093c06e9074e625
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bcf16e6f611587ea05df73a899cae329c21597b2cfe811c2de83f17cffe72ed4
MD5 bed075e226b3c45571bd6ae8bb54d53e
SHA1 3ca468eb4b487a33da6409770538eb8862a7a6c7
SHA512 094a638e0f40fcc39f121234da67d1c8d93c3cbf25eb43167d25ea14c28dee91684c4f9522f1e7b58a46757feccf512d4811d86fbfb0d00c99f085c060e71b5b
TLSH
T1C7E0010697004187C124033004D71F50BFB2C11013A303078631117C2CB33443D51540
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58fd28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58fd28.TMP
Size 392B
SHA256 d5caf4943f88f39e7307f66d529655dc17cd9890ffac5c617e3201d17015d78d
MD5 afde7e75303d4ed5549dcfaa561ff596
SHA1 78ad037632aea54090730bad35c7f699a9e7ee6f
SHA512 cdc5eee9e01717643d83657a3573f8650a0f131b373c9dea0e3c85d1877e2fb6d07e204bd2ff3a856ab26177ea997d42771b47725ea8852c21b3ea0de0fa00b1
MD5 SHA1 SHA512

Submit Download

ed048e2d-7833-4713-b216-0550433e9acf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ed048e2d-7833-4713-b216-0550433e9acf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37e6b627586f7c2a522e3187af5616dce4fd1b67e1acca150b45b562acad0f8a
MD5 8b1aed70a3176bebebfce21fb441c47f
SHA1 d908b5f9098ec0c8f18ec142065988eaff545478
SHA512 bd79652275c5b35fea46254838ed6703e4677e25a42d9dbdddabde72c7410fcb6a0e9c847fa883f2b7ca14866c9c2db44b52071a0aab40a8745f828f69710e26
TLSH
T102412A48BAF91108B3767E1AABF6A46D447EB9732F16D45E00110D4E0A33B40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\HYP-uvbXBA\7z.dll
Size 1.8MB
SHA256 882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863
MD5 c4aabd70dc28c9516809b775a30fdd3f
SHA1 43804fa264bf00ece1ee23468c309bc1be7c66de
SHA512 5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51
SSDEEP 24576:tL9NgP+4hcdTDeM1EF7Jx2meoI4Tzp7iyeNgzd6Nv7:x9NgPjM1E7JPx+ye5
TLSH
T1DE953C5AF6748270D0B6C079C5E2AB9AEE7134868730A6CB12859B3D3F17BF5C539321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\HYP-uvbXBA\7z.exe
Size 551KB
SHA256 e2ca3ec168ae9c0b4115cd4fe220145ea9b2dc4b6fc79d765e91f415b34d00de
MD5 b6d5860f368b28caa9dd14a51666a5cd
SHA1 db96d4b476005a684f4a10480c722b3d89dde8a5
SHA512 d2bb1d4f194091fc9f3a2dd27d56105e72c46db19af24b91af84e223ffcc7fec44b064bf94b63876ee7c20d40c45730b61aa6b1e327947d6fb1633f482daa529
SSDEEP 12288:jrx//c1kmegKVcvbYAgZ+ml1PUEynhwNblha:5s1DetKMT7yV
TLSH
T14FC4F925F6748731D073C0B9C5D2AA9AEE7230861B3089CB4286C77C6F677E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\fedata\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e10d1b0e47e3a22bc389e5f9b1d68a9aca18e4046142e5f325c57aa3b2b98066
MD5 a4ad4b8a1d0a32fd2d9f761eab826ff5
SHA1 e905015794b671245ac98262c212bdf36269832d
SHA512 430a1b786aeccfcc048cd78c3b596ad97a921254017e7a4e52bebab031d91a30518a0753604a404c1c277f072e690802bc227f01c2f68462f734ae8b56be36d1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\fedata\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 ed256c712c6a01e231bf929e129d8aada38173e21ed4ee2feec5adbf625aa377
MD5 45b8a5a5dc0365c54cfd83d808b35015
SHA1 30b023c07c4c9d974af5f3fe826448f59a90d2e9
SHA512 97ebb3a7d4b5deee13d35c49561138646798e8699052e776ed3f1c0443277f990521afa77176f3487003a847738304be83dc8b3acc2a9eb5c6c517680f015cd1
TLSH
T146B00215C5431847C349A7FC30DA0161BBB56E931A534E95F4A2247CA851783B775076
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\fedata\Service Worker\CacheStorage\a9003ad68819352906c147d14ced7acb89c66d78\729588d4-1393-4ca8-9b27-bd20d8868701\index-dir\the-real-index
Size 192B
SHA256 9b0f32c6c023761740d736dfa2c7c38f86b763cc819c96a2f8482387aab11473
MD5 3f2d0b4fef47afe68cbff2ee3200f93d
SHA1 1df4c7775b967e364049e55f224da7420498cad6
SHA512 eaaa3c178dee1f031670e598b1623895db561dd79848f7ee17a3dd8008d07a12f2f9891671a4c1988bcf73305e4031ecc2dce84d8a36367c6a139ce9e24bd573
TLSH
T1CDC02B02C8C1FA20CC6E157DBFE19560323C26EE0310071691CD9577DCC99701094314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a87b0.TMP

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\fedata\Service Worker\CacheStorage\a9003ad68819352906c147d14ced7acb89c66d78\729588d4-1393-4ca8-9b27-bd20d8868701\index-dir\the-real-index~RFe5a87b0.TMP
Size 48B
SHA256 6bb9a2980e8d6d40c4fa8ded646bb0cd067387fbd5856c77016cf7b97a52a7c5
MD5 f04da37c60eaea4a970c880f1177ef46
SHA1 db731a492c7b82e33b977055d730534c69edaab6
SHA512 5d334071433d4c9fa60047bc48df3f963fb62b1f862f5191826113b55db11f258176b84b95fe3984b521596c8045c0d11692b92d77275006ebfe76fa8959cb9d
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\fedata\Service Worker\CacheStorage\a9003ad68819352906c147d14ced7acb89c66d78\index.txt
Size 137B
SHA256 e30dc1b3792b7e8432e64ad2116507d8be90ace28f5ba29320c2acc9b087b90f
MD5 44613b36e17f28e4cdd3969d3107c6c8
SHA1 b1cc77b092e450705ae6f98bd8ffb5177395e431
SHA512 e46cd55a7824e49d93948184c6b01e9d293b917be9c72cd60fb0a007d218a16c6032f67208e236ad19345d56d94da2e1f1db967cbb70344ff3f73c0bf58c7990
TLSH
T123C08CCA176008162F8407F20001223E828A4380CCC9D04B440F3816C8545D22602F14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a87de.TMP

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\fedata\Service Worker\CacheStorage\a9003ad68819352906c147d14ced7acb89c66d78\index.txt~RFe5a87de.TMP
Size 142B
SHA256 66bb73731d923b1bf4f83af7300d9080ef71b248a3dad075759da79c9cb92884
MD5 6f57f6f1eca2e032fbb06f2ca3e1d272
SHA1 dd237360a62e272fdd2749af3a4fd8dd87610f80
SHA512 76cdd959ad8e0a4e93ac4700bb356cf46c8bbb0375b9f2403145d8fd99d9566f1c8983caa7bebc0121e7af1bf8df107fcccf0f83e11edc33c418af442fa355bd
TLSH
T11CC08CCA27500C162F8406F34000223A418A4A80CCCAD04A440F3846D8745D22642F14
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\fedata\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\sophon\Preferences
Size 136B
SHA256 5d94594db55a6637e7ca57b7bf1f7e7f65a692f940de9161aa65bebe97f1ac49
MD5 8fcd6b48e84165a963df5d217de84f70
SHA1 b084e1a26f2278384a51da33f8af14443a20e276
SHA512 b5075c1367f6fdbc84ee1c053d53a350f6be631acf87af9efdbd7b104fe47f037373ea493326c71ba16804940f48a088035eb2e96e6dc622fb18e064b2973439
TLSH
T1E3C09B8D5405DA5CD55F4555CD893D1B54476564B3091F8E09E4204904ED5BCC581017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\sophon\Preferences
Size 747B
SHA256 c6f41f2ab840c38a09dde90ad72515ad1639c41abec9d336031ace65947285aa
MD5 4e3fa4cdf8e6931ece6861eef0296650
SHA1 1ec21ab56106eb1b49429d1a2e1290773dbe53dd
SHA512 e85f3aa4791aca302a2c797be2fd226c235dd71e23b41cdf599a1298b4c1b04a2bcf346267d874ecf1dbc8feddecf6fb460106f8f37ca626aa7a1a0e57d49d4a
TLSH
T15801C5055C286DDCEDD3594AC25B75172067BD2D3C056FD6D17440BC649EF64E342513
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe5a25b9.TMP

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\sophon\Preferences~RFe5a25b9.TMP
Size 76B
SHA256 d7eb6ca8c16ff417b18eeb8ef7c380d644efc7d5e432e6096ea76b367e16b9fd
MD5 ffc66aac2614360ce804e873b7268c0f
SHA1 e2ce8793ac69bf4a063503d9cafc97e1ffb8785a
SHA512 aae9756d3cd2e2962a33d4d7596ee8b83725ab06e96d8e933416875f0688eb38c28f80c357bd3b53cff2210ecafe7192c9c8c7f5da9f56ed1c0dfadd8abb4f34
TLSH
T17AA0240D5405CD5CC4074550CD043C070007555453040D4F00F0100D00FC57CC1C0013
MD5 SHA1 SHA512 TLSH

Submit Download

a486763ce0e943e3628f5ecb67fcd9bc

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\sophon\manifest\a486763ce0e943e3628f5ecb67fcd9bc
Size 3.9MB
SHA256 a67364966d46e5f404c92d01fbd3b77a544406cd6dd8641a07b63365eee8d2aa
MD5 a486763ce0e943e3628f5ecb67fcd9bc
SHA1 2c9001a35b98785e7eb21704e407030d3176f2fe
SHA512 bf12ab2b8166686d6eb9bb7122bb46100d6e0d80132f73fbcfd9cbe16a39b2b8c7558b7eb4ab148531875c15221504a8997d4738b505c09cf4dab5d49559bb3a
SSDEEP 24576:T2M9xAIyD2vgvK15IHlLbLsfSbdfwzCfgpFii01r465srh4ekaVUqDSwdzwxj1+d:6MMko/JYU8iB6
TLSH
T19616BFBCE50C2DC5213B5AFAD9AA69C663752B6F5A97D889403CB6C334B3275ED03C04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest_1c224e24582b8c67_072313800dc8d3ace28c86a11ab2a1a2

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\sophon\manifest\manifest_1c224e24582b8c67_072313800dc8d3ace28c86a11ab2a1a2
Size 252KB
SHA256 e49038abf49f342d87aa10075b1bf735a2365bbe599143509b6948d36d39a87d
MD5 8b5b4d3f860a506d1253de7436fe263d
SHA1 900da430c587607d2c0334dbde45c4a87efa0616
SHA512 09872c4027a8ce7e5e75a6054af8c5c3c8c0d88bf26d8bac5e135128176fe3be888f0a57e43e6d7a8617c00fd7bf31b904356c5416e30a5a3e851e01dae1e9bb
SSDEEP 6144:LdP2k2Lg/T44eY/3akDg6FFkfiU4PwW6fdy/O:RR2L0T44ZyktFkfZqod+O
TLSH
T12E4423610B13C5A0E4AC3C909BFB5F8C5234E48CB7D4233E4466D6B756D9E1B1D82F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest_3051332ba8b40844_4ca58ac9d1e8c3d6edcb23079f43d904

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\sophon\manifest\manifest_3051332ba8b40844_4ca58ac9d1e8c3d6edcb23079f43d904
Size 259KB
SHA256 288efdb8d2a05453686ae58d050d275302a9c4ef56ca686db9e49b5aa20faac4
MD5 405b959b1fc05f868aa094a984adfd99
SHA1 4c4f11847a122d0fffecbcf2076ed3d0e5ef9939
SHA512 abb2ad01f047a8f9ab549e9deae87eb5ce28c86328be30b4ab315b546cc3880a84dd9a566a7f7814464b4a0beaf3ad58bc905d4208b3a7870f0616626ce36c70
SSDEEP 6144:VBNMzkzCKstUoHCl+lBWcS1dqX9Mzix9x59qtZD:VPzCkhl+mdqX9MWX9KR
TLSH
T1FE4423AC7E36363EDC6F2D10103937C45C266C9B81E7E817996E86BD2082BD1EDF1856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest_95b6368c3a6e16eb_44db0305fd0c0a05f743013c76a892b7

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\sophon\manifest\manifest_95b6368c3a6e16eb_44db0305fd0c0a05f743013c76a892b7
Size 271KB
SHA256 e66e8f3fc22bc654aa767d4c6075877c88f0469262f5f4697294b9da8a26fda1
MD5 d93aa931320355938c8e510d91edca56
SHA1 8177e5d64eabb62c5b0acb58c030900691e0c761
SHA512 12adc6eef60881da53d949c96046406e279aa44d8cf79f59427bc7be170069f5a4daeba9d2fe06461fa745ea7448198fe58365093e631950a7bbfdbe12c4cd06
SSDEEP 3072:Fd7ApzqnJSCdvjEC0J6YnzF9QDRGcaocO4DqR/WQlaW+GyOpfoljpRcEshzv0omk:zkpOWRouoCOyyQr2/mSOf3W
TLSH
T1834423260EAB4C31682C14588FBBD991BC1005CC51DD19B1BFDFB5362E61B6DE8E05AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest_95b78198ac92b80d_314cf091088980fc0265da49b463af17

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\sophon\manifest\manifest_95b78198ac92b80d_314cf091088980fc0265da49b463af17
Size 293KB
SHA256 81df3eb1fb63cd8afd8b25b6144c957948c23d119375d85b9ded532a055672e2
MD5 d2da8757abd9f3111d0547c895da5ce8
SHA1 fa89987f31b15d1dc026390797d8639f081be379
SHA512 9d1afb2afdbb08470a7b58983ba70b7db8a531df1255227500699270930377030db8a1963648f74433444b40cc9c9969f55e1b76de11886fb4dd4ff9a1ce5c1d
SSDEEP 6144:Th/1SYJKIsFHvfQH5DaifihLXk6TSgRK/6fyWezqMVqX7ycxYTrRKe:TkpvfQZvfihDsIKcyWe7wLxArRKe
TLSH
T177542334DC96D306181D0871D7AF7901F0A621C427F85A78B9EABECD2C88FD6A63C657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Cognosphere\HYP\1_0\modules\telemetry\Preferences
Size 82B
SHA256 1f4e3303a0111331bda2640648d6605d185a888c86f23b990c4f3ae3890cde16
MD5 997d60e6d436f563de934e272dd8d90d
SHA1 3d7e333d47d0aff18e3931d20ae4b9b06a674f65
SHA512 0184c681642c6832cabd4001894695688269b4f8ba0afaf3087764c49610e84a2478316aec9c566498f3a3054b10aa4e7241e105a0915d96d6735580e2119fdf
TLSH
T167A012829C0A0949940216026C012441D04A127040144E808094842004BD18C7406221
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2200-1389-0x00007FF889FC0000-0x00007FF88A50A000-memory.dmp

Download

memory/2200-1390-0x00007FF86B5B0000-0x00007FF86B5C0000-memory.dmp

Download

memory/2200-1607-0x0000020242D50000-0x0000020242EC2000-memory.dmp

Download

memory/3176-1402-0x00007FF86B5B0000-0x00007FF86B5C0000-memory.dmp

Download

memory/3176-1401-0x00007FF86B5B0000-0x00007FF86B5C0000-memory.dmp

Download