hxxps://www[.]mediafire[.]com/file/p0gy18s2c2f29zf/sus_game_files_to_upkoad_to_virus_total[.]zip/file

Analysis

user interaction
yes
max time kernel
184s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/p0gy18s2c2f29zf/sus_game_files_to_upkoad_to_virus_total.zip/file
Sample260810-jwamlstgpf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1320	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308224515535140"	msedge.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{4A69F355-ECA3-4D77-BEC8-5D107AC909AA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{A451F385-9BFA-47F0-9613-52CAB44F1AFE}	Game.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	Game.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5860	msedge.exe
5860	msedge.exe
5380	Game.exe
5380	Game.exe
6120	Game.exe
6120	Game.exe
3328	Game.exe
3328	Game.exe
6120	Game.exe
6120	Game.exe
5960	Game.exe
5960	Game.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
6120	Game.exe
6120	Game.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5832	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2332	2592	msedge.exe	86
PID 2592 wrote to memory of 1320	2592	msedge.exe	87
PID 2592 wrote to memory of 3412	2592	msedge.exe	88
PID 2592 wrote to memory of 3412	2592	msedge.exe	88
PID 2592 wrote to memory of 3412	2592	msedge.exe	88
PID 2592 wrote to memory of 4024	2592	msedge.exe	89
PID 2592 wrote to memory of 4024	2592	msedge.exe	89
PID 2592 wrote to memory of 1688	2592	msedge.exe	91
PID 2592 wrote to memory of 4836	2592	msedge.exe	92
PID 2592 wrote to memory of 1688	2592	msedge.exe	91
PID 2592 wrote to memory of 1688	2592	msedge.exe	91
PID 2592 wrote to memory of 4836	2592	msedge.exe	92
PID 2592 wrote to memory of 4836	2592	msedge.exe	92
PID 2592 wrote to memory of 4948	2592	msedge.exe	93
PID 2592 wrote to memory of 4044	2592	msedge.exe	94
PID 2592 wrote to memory of 4948	2592	msedge.exe	93
PID 2592 wrote to memory of 4948	2592	msedge.exe	93
PID 2592 wrote to memory of 4044	2592	msedge.exe	94
PID 2592 wrote to memory of 4044	2592	msedge.exe	94
PID 2592 wrote to memory of 4536	2592	msedge.exe	97
PID 2592 wrote to memory of 4536	2592	msedge.exe	97
PID 2592 wrote to memory of 4536	2592	msedge.exe	97
PID 2592 wrote to memory of 2444	2592	msedge.exe	98
PID 2592 wrote to memory of 2444	2592	msedge.exe	98
PID 2592 wrote to memory of 2444	2592	msedge.exe	98
PID 2592 wrote to memory of 1900	2592	msedge.exe	100
PID 2592 wrote to memory of 1900	2592	msedge.exe	100
PID 2592 wrote to memory of 4540	2592	msedge.exe	101
PID 2592 wrote to memory of 4540	2592	msedge.exe	101
PID 2592 wrote to memory of 3272	2592	msedge.exe	102
PID 2592 wrote to memory of 3272	2592	msedge.exe	102
PID 2592 wrote to memory of 3272	2592	msedge.exe	102
PID 2592 wrote to memory of 896	2592	msedge.exe	104
PID 2592 wrote to memory of 4220	2592	msedge.exe	105
PID 2592 wrote to memory of 4220	2592	msedge.exe	105
PID 2592 wrote to memory of 4220	2592	msedge.exe	105
PID 2592 wrote to memory of 2348	2592	msedge.exe	106
PID 2592 wrote to memory of 4112	2592	msedge.exe	107
PID 2592 wrote to memory of 2348	2592	msedge.exe	106
PID 2592 wrote to memory of 4112	2592	msedge.exe	107
PID 2592 wrote to memory of 4112	2592	msedge.exe	107
PID 2592 wrote to memory of 4412	2592	msedge.exe	108
PID 2592 wrote to memory of 4412	2592	msedge.exe	108
PID 2592 wrote to memory of 4412	2592	msedge.exe	108
PID 2592 wrote to memory of 3064	2592	msedge.exe	109
PID 2592 wrote to memory of 3704	2592	msedge.exe	110
PID 2592 wrote to memory of 3048	2592	msedge.exe	111
PID 2592 wrote to memory of 2212	2592	msedge.exe	112
PID 2592 wrote to memory of 2212	2592	msedge.exe	112
PID 2592 wrote to memory of 2212	2592	msedge.exe	112
PID 2592 wrote to memory of 4976	2592	msedge.exe	113
PID 2592 wrote to memory of 4976	2592	msedge.exe	113
PID 2592 wrote to memory of 4188	2592	msedge.exe	115
PID 2592 wrote to memory of 4188	2592	msedge.exe	115
PID 2592 wrote to memory of 4188	2592	msedge.exe	115
PID 2592 wrote to memory of 3348	2592	msedge.exe	120
PID 2592 wrote to memory of 3348	2592	msedge.exe	120
PID 2592 wrote to memory of 2224	2592	msedge.exe	125
PID 2592 wrote to memory of 2224	2592	msedge.exe	125
PID 2592 wrote to memory of 2224	2592	msedge.exe	125
PID 2592 wrote to memory of 4248	2592	msedge.exe	126
PID 2592 wrote to memory of 4248	2592	msedge.exe	126
PID 2592 wrote to memory of 4248	2592	msedge.exe	126
PID 2592 wrote to memory of 2276	2592	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/p0gy18s2c2f29zf/sus_game_files_to_upkoad_to_virus_total.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa85a4c188,0x7ffa85a4c194,0x7ffa85a4c1a0
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,10765634820024162490,4593609631132835412,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,12411031573840442020,3879135145851252872,262144 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,17834227572033765160,12576108843698266584,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2781360597851897820,8092409493145635802,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,92417664950953903,8053392412231042291,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,2898217036633666387,6564972372391685266,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,18030324178059397169,7398250779374055332,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,17012171443270340074,10696582883080629988,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5352,i,9820771661805635205,7119331165382002653,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,9203096524617202209,4029662734923834614,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,5071187825262618818,7482392076475767483,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6284,i,6977918967983468504,12256215282307595102,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5243378051673868533,17512465515679904230,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5243378051673868533,17512465515679904230,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6696,i,15138365810481960650,12449443099004126060,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,14122968391469936261,388978933998966032,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6932,i,12702894214446808590,12623844392191481284,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5092,i,5477015209474749141,7680918814519163650,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,9309083303740019686,6389578249206147400,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,10020211479525801257,5311971963670375744,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,14439287379378073051,3806712222223563923,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4672,i,17227782526892912581,15310110965278699637,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,13351951640226106226,9015382360150711505,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5608,i,4939314333546353930,4508420227690420686,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,8898640652629141405,1830866588490081437,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3304,i,2912079431226550897,10226435782058039608,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7380,i,18083648397333726059,8952374297013310984,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,5166058281311341932,1289413159445950007,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5428,i,17510996931577188413,17204359603552342574,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7776,i,7918993360049837556,9749325442581775265,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7708,i,5836238990240671383,365168727585177057,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7724,i,16391562165891444548,9043255796848687920,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7896,i,7628553682517352844,2815628194111667452,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7800,i,12009952637980070156,14934573428049147364,2097152 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,4790797587414941392,10336765232753309698,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2784,i,15263437079296235417,7485582048943018649,262144 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,10272746520760295008,1242549522228075071,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,2211119266380820164,9013915879649754451,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8060,i,15473885626699821908,15178074369759964486,524288 --field-trial-handle=2228,i,6044555035296792458,16011147494765577091,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5576

C:\Users\Admin\Desktop\Game Files\Game.exe
"C:\Users\Admin\Desktop\Game Files\Game.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:6120
- C:\Users\Admin\Desktop\Game Files\Game.exe
  "C:\Users\Admin\Desktop\Game Files\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data" --annotation=plat=Win32 "--annotation=prod=The Coffin of Andy and Leyley" --annotation=ver= --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x2fc,0x74d7d0e0,0x74d7d0f0,0x74d7d0fc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5240
- - C:\Users\Admin\Desktop\Game Files\Game.exe
    "C:\Users\Admin\Desktop\Game Files\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Crashpad" --annotation=plat=Win32 "--annotation=prod=The Coffin of Andy and Leyley" --annotation=ver= --initial-client-data=0x204,0x208,0x20c,0x1fc,0x210,0xccd820,0xccd830,0xccd83c
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
- C:\Users\Admin\Desktop\Game Files\Game.exe
  "C:\Users\Admin\Desktop\Game Files\Game.exe" --type=gpu-process --field-trial-handle=1672,5057693426582133554,2405200610821857317,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data" --nwapp-path="C:\Users\Admin\Desktop\Game Files" --gpu-preferences=KAAAAAAAAAAABwCAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.19041.868 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data" --nwapp-path="C:\Users\Admin\Desktop\Game Files" --service-request-channel-token=CC47BC1A666F898A493BF6E4B93FEB28 --mojo-platform-channel-handle=1660 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5380
- C:\Users\Admin\Desktop\Game Files\Game.exe
  "C:\Users\Admin\Desktop\Game Files\Game.exe" --type=renderer --js-flags=--expose-gc --no-sandbox --no-zygote --field-trial-handle=1672,5057693426582133554,2405200610821857317,131072 --service-pipe-token=0346FA302F38CCA9F5C65436689036E7 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data" --nwapp-path="C:\Users\Admin\Desktop\Game Files" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-checker-imaging --enable-compositor-image-animations --service-request-channel-token=0346FA302F38CCA9F5C65436689036E7 --renderer-client-id=3 --mojo-platform-channel-handle=2520 /prefetch:1
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Users\Admin\Desktop\Game Files\Game.exe
  "C:\Users\Admin\Desktop\Game Files\Game.exe" --type=utility --field-trial-handle=1672,5057693426582133554,2405200610821857317,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data" --nwapp-path="C:\Users\Admin\Desktop\Game Files" --service-request-channel-token=A1D7300818BB694EC9CB5CE8531BEBAF --mojo-platform-channel-handle=1692 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7ad7f78c6f81c115ce6f95362bd947e87a2faa4874d7babdfe4354a0599add4b
MD5 6a6270612689ba1ccb0c69a8b83c5721
SHA1 ddb31cbba66bea9dec20e3fea163a0c189330928
SHA512 df27d938dbc7afd89fc624fd3aaef3c205b826d53c523c7a9fbe5e9a99d70dab7e3ad6340400f95570c8e8bac2c615e178332a1a269db50465d3bd5a9c55f07f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7m:fwUQC5VwBIiElEd2K57P7m
TLSH
T1AEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1eb928baf62d9d3edb56781123f07ccf5066265e6929b13c81bc7ef47e3bc8bc
MD5 394ea2bba6e1346b55ccc3e244ec56d4
SHA1 56ad232c8e9794d7e637f188ab250e917f981569
SHA512 7f5efc48e4c7e25f8edc2f1c84f3e4513b0e02869e043de615acf0b95be3e113d4197d4381f2d09ada054623da7aebfa33f6e5bcf423a31397ea624dd55eb992
TLSH
T103E026A416CFC66EDA40B5875264A31CC2803A4F92C8F96A3740C588B502840FB83590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 9d29566a3fe0761d0d1d1c7636aec19979a8eccf961b7575d4ed516eb2a3d784
MD5 3fcb0b29d44422353ce7fb7358c4fa83
SHA1 50bc813230e0428a4e6521c3f6c25b85b2e17f03
SHA512 26a1df274a58399ee9b23a6df2ae91407f55c9a8c510ded55e8f2d75fc66a03aab585ea42c756978e060d3cba58ff0fd513877d6d62af2ee8c86e3bb4d99bb59
TLSH
T189E068640BBCC5A1CD42A347901A678E0810F586D64DEECA36CA61CC1E00800C72E092
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f8414fc9cbc62ebf9e713754b35a9f8f427e3e3539f070f189ddf25f1566e9c5
MD5 1401de2f0f78cff3bdb6f9c5fd84deaf
SHA1 58b7e5a8473c81124c633bba5301558bbd161c0f
SHA512 51d91026d3f5a2b73a6dad40027c64c015dbc513ad38baa88dd8d2002046395e06ff3901189da662ec6c7e45f624bef8828a67182a253f241291d6f4b3afb4ef
SSDEEP 96:gO1OnrRc4Oit9y2xiAcLIhcqjC1/OPBGgvYOPPz8Frp4:gO1arRyit9y2x5qPCLAOXAFl4
TLSH
T10CB1E900819911A6FB210F33D5D01918B570827B9DE75EE737BAFC7CF96AF16451A08A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 62dd2e09bd0cf2e513e8f14efcd03a08dc3556c5ebefc6295b88e92afc4df900
MD5 bc4cd6557b2626d6860574e9665de347
SHA1 97dd6f1214f8c75bbf0b7ec4bd980418fa72d41d
SHA512 c1b5111923c0427c427ab91d0634b34e4446f33a6aa6a5c7b7a06f1114d0163b1030089d93cc9ecdb39af9e1d17fdd5083d4b5de432351438fe11e3cb3064b1c
SSDEEP 96:a33npimOit9y2xiAcC0qcqjC1/OJ8SgvYOP+zASU+:a3XpKit9y2x+vP4iAOGsn+
TLSH
T108918300006A15E2F7611F33DAE10A14B471537B6EE71EE722F2FC7CF94AF12442948A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590064.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590064.TMP
Size 3KB
SHA256 ba306b752720211b1a5b72833647ed6982af4f1662c683024115667eebbaf915
MD5 d00c3f8ec0c8f3889dfeb31d6329cb05
SHA1 fad69a98cb79707b057d2bbd48291311766cc922
SHA512 0d8c1be83b95a9dc1dc48e70194f9d2a8627f57bde993bc9eeef14218ea15c9f703e1b324dad9a1f9e570b27897fb442701169a4107d661965e60d6c2343d5e1
TLSH
T12F71C40402AE05B2F7A20F72E9D00650B47183B92E771DE732F6E87CF91EF23412908A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 2a346ed4ef370a627cd5465fc682b67f3f373b4f32832145f73e7e0c753f6f8b
MD5 1b12cc5767bb9923b7a1ef54ccb86b57
SHA1 4d3d7dec4c733cc99541bd3f2784852f5ee99fab
SHA512 7c29c571854b11f6fb06e3a8d80547ff979c7a294f092629ff5e014b4c7eae537103a0c94019293f238f54f1416aa96d22f927d3b505487d7632267baae97cec
SSDEEP 384:DeXMsoo52v82dxeWn0H5UBep4Ky4IYNoYs4qBsaAvY+qgTWu4g14VQjloQ5p27Rs:twjBvAF1LCB
TLSH
T12A7259F382E5D52E89115BF89A146E2BCF1C0719432C3C2589D5EE87E3E2072E16E65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 9beba396360fe210ac9eae6c96b480866ec378a042dce9d466bd0afbc73745d3
MD5 4d96dcd11ff888d1d810c23563b28208
SHA1 7436a94b727b9f51af914b84ea48ba78e2f1d6d9
SHA512 650f276b22206655e277ed17f6f7b02e00b376eb4faf857735043d603324f0c86cb89c0d2938d8fc385ba86a84ae112ae8dcdb6a956169a802e514f34369da70
SSDEEP 384:DeXMsox52v82dxeWn0H5UBepsSpexq91jBeE7hJsJ5eM6A0CKy4IYNoYs4qBsaAd:6SNCmjBvASiUXkTIIoSRIX
TLSH
T199D268F383E5D56E89111BF85A146E1BCF1C075A432C3C2589D5EE8BE3E2072E16A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ad977f5051824ae4829c93405ffabda84762f72a6849c76528b01cedff42846c
MD5 92df7c8e049e2097a994be6f6dc0a3ae
SHA1 97cf72098d2428cdd5dda2d63aafd4924e222766
SHA512 e0e6ef2466c7627407d1d71d02a9a13dd0ecd748ec0efa7b3ee1b3a34d00073a1249a44fd4a16e30916213ea380da6c4bd8dc443194a6d9d3d2aef6f66a134f0
SSDEEP 192:sxZZRUyM/jK1Ml8Mf6Q/fLsq2DoEdpV88OHW6+WNmvl/YLnyZG+XIgrJ:sxZZO36Q/fLsq2D/iHbY/Ifm9
TLSH
T16D52F8126A3469778CCBD209F941BF53D6F90573A2901E94AAFCDA1C04E6AED2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 78e73a99475d2dc9a37b8a4efc968f43a4e0e7af6c39cfee3ffdc6b5353476a4
MD5 d73081f4f557b70fd7c8664f89cf937b
SHA1 f49c5ab780ee89343d974c36a427fd41e5cffb57
SHA512 331c199a78148025d3b97928066cc0cd221598990b3b5da5595a20a5493351952979a6e033354e8f54e19d36886e22ead0776d604abb0bde9bc36f63af6382ce
SSDEEP 192:sxZZRUyM/jK1Ml8MdQ/fLst2DoIdpV88OHW6+WNRXvl/YLnyZL+XIg5MJ:sxZZO1Q/fLst2DZiHb//IUmO
TLSH
T17452F812AA346977CCDBD309F941BB53D6F9057292901E94AAFCD91C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c1b8f17f03c6a88b72ad66786d61d5a88ec8f7243e6aef839267166906c3b48d
MD5 047f249deaadf4528bc89fa8f665d778
SHA1 e5f634b1fef0aba4222aa90612bd1c24dc72e523
SHA512 2a5242bff476ac841b1846cfaa6a2375c6dc3dabd6cc4b8a30124deba2ca6517a24be434437f974d2887a77e9b0c8354214e462398e0410c08a3244fb24acf0b
SSDEEP 192:sxZZRUyM/jK1Ml8UQzlQ/fLst21oIdpb88OHW6+WNRXtiXYLjy9+XIg5+J:sxZZOqhQ/fLst21Z0HbGXNm8
TLSH
T14062F812AA345D77CCDBD209F941BF53E6F9047292901E94AAFCDA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7623719bcea6ece356c10cef90988f921432ab5a17fb64813a3a6e5d116662ea
MD5 14e263d22e53c3fc3457236098d7637e
SHA1 f8133d88ab21973b157bb5b335b12cabb9e5e919
SHA512 67f065cb5adb7fac0dab067c43762f786b6f2678ab3b9701fe420a9494bb05c42867acb81a9a91877d30c43a8c51c3c46c49a0ea22f1e53ac9a35ee433f4c46e
SSDEEP 192:sxZZRUyM/jK1Ml8MlQ/fLst21oIdpb88OHW6+WNRXtiXYLjy9+XIg5+J:sxZZO9Q/fLst21Z0HbGXNm8
TLSH
T1AA62E812AA346D77CCDBD209F945BF53D6F9047292901E94AAFCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8d64c894a4d09d2a5a42a1091cbd6f981bcee3b418ab37dc7a0c7beddab8434c
MD5 444f11c6e66cc38a81452b6d51fb984d
SHA1 5b6aa26831064a1969f2b3fc82bbe2ba1e0a3d9e
SHA512 0a80a6c8d17fa3e31eefcf1c055f222d44604fdfd862756ce2a1755b4d625d8fabf10708812391d71a2a01dfe45adb32a9e97fb436fb5dde66a6b72b90ee97be
SSDEEP 768:oqs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNqroVD:oqs6pD1WvxzUju1jahILIsNBVD
TLSH
T162E2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB94895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dea9147a5066da6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\5dea9147a5066da6_0
Size 63KB
SHA256 6ce7f7023eba76e515a15764d67ec15cf6d55b72bfec0e0aa8f6f2a50406e9c5
MD5 67490cfba6b3108f3ffc20fc1cf691ca
SHA1 092402b197d8b47c74569c68ad9eba59223658f8
SHA512 8d4795c93a4d7f38c2e7fc96164fb1ff4e2249a7f532f71ac773661af8e123fe03c061d71322ebbe79fd0df4dedc4491b5d9fe7778e51b01474909508b357a75
SSDEEP 1536:o8k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkv:o8k3vFpxh4Y473qW
TLSH
T149536BA6373178B3427BA1B1906F130B713EE5A7F40484F8A198EDF45E54A960267F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 89300826f1fb16e4d72751ea09942cc02792261c33c3949be9146ad8b1628578
MD5 a5617d214a84839cb10188d3da35d7f3
SHA1 92ba976638ba60b5f4f3c891e5af0a92cd1202d4
SHA512 75cd8c7d5cf53f0ce84f74720d8afe3f0aed7ed3cbab9164ffb5be8377de380cf66f195477b76b2c6cbe9be25000db59b5e256f4b44f16979e51ef0384f43350
TLSH
T116A00220C2602403D90147757A8126813B16A86107114E1288D41054C999653555760A
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 31c7a1fe5ac3f9173a38ef447fce9a371a531ccc39b44dbd909a663d81da288e
MD5 2534d94bfda0ff4afd7d31d7a121dadd
SHA1 00722df83499f80b2ee864f11fabb05a39e4ca39
SHA512 59bd2c70d421a30896938cc36a4554d66dd68ddfe0822a842292a8a81e67f366de1ce42fe0d7dd3699ac6c162fa819458c141a91d68b2f659febcfc583715ece
SSDEEP 96:KUAAKtePOrqKgAXe12KeASBCBuC0UEC2MzxgyCKYngICcSabgWEjg0SWj:iitMlh9xEjg0SWj
TLSH
T10BC1070271BB02223D3E291CA29997664F42B6533819F52B3BAD04B15DA7F344DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca09471b7730e8d2eef8db78b2579bd50979828376a76db9dbd41d5dff505e5d
MD5 7f4d6466f8b40ab74e163747a5052ecc
SHA1 d85166c2fd852eee89e29d2369ea0cdc51336258
SHA512 72d23a73ebfdb1d175a5cff9fd18fb57e28a5dbf666c3f875be3b219e59db11ba33487c4fb151b10080dde9d70c4d4c14483b83d6add22b2acd0843bb795099d
SSDEEP 192:AONC6O7+33QmiUy3Q1cttb0zO2bHTQ+2gcN/qUCU6:AONC6bJCt9yO+TQ+2h8U6
TLSH
T14C120B35A8689C775EE2B540F98736179EB90127EACA6F80D1DC6E1C01DF66C234AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6e43359f9eb0aa645ac6a6edd281e8a51215e17ecf21e44e8249cec9f9013b1d
MD5 6cf95a62505d84bace710acb2dc02350
SHA1 a2645721c8c2e046a585892b28d934dd761968e4
SHA512 c8cf2da125a94c6af6b034292469db59d4340356a21a340589dd7ec217b5bd60ce5fe118100e1cdbd632196752e3f98bbdc6fe7f7cc0606880e6466d3de33085
SSDEEP 384:XIZcIgisNNU+cKpPC++Msa9yO+TQ+2f86HlytEDq1xCUx:mB8c++M1IOuQlf8oy6DqDx
TLSH
T13EC22AF058E75832D9AE6343E77E2D135EBCC02776851A80B3D89A1CCC8A57FD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ceeb16bc5194c1ce022a9c5fe911bbc56f0943611939dafb4815923c7897ae17
MD5 9d146f93c73d4a8806ea3031a3b95e83
SHA1 ca05d275787daea34d2d44225072a18afcc27c49
SHA512 534a08700ecee180f66558e7b00dd6cda833276bee45827bea258a2d3258861c64290bf1b155859f9e0b7c7b3ed991e88a0dcdb5aa7f1a193aae4d45118fac9c
SSDEEP 192:qONT6O7+3hQmiUyTQGttb0zO2bH3gGDxU6:qONT61DGt9yO+LtU6
TLSH
T10002F8356C686CB75BF2AE45FA8727279FA5103BE9962F80D6E81E0C00D765C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1ced9949ae19e0f50461352edbfd7a25a7cf1bdf73be5b3b9bbe5a001741d24d
MD5 907e932627a402010b2e87ee512615c0
SHA1 b0831d6f5626e987e00162f402c9ed197500572b
SHA512 1343a39b2c60cce642ea5325a5df2899b5efedf10589092684b4f634cd0bc7523ab25bc549096e63bacb3140e8fe699c0f8e18e6252ba1e5038f11216f068d40
SSDEEP 384:XHZcIgisNNU+cKpPC++Msa9yO+TQ+2f86HlytEDq1xCUx:fB8c++M1IOuQlf8oy6DqDx
TLSH
T134C229F058E75832D9AE6343E77E2D175EBCC02776851A80B3D89A1CCC8A57FD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4d8f3bd805b98621a4661a3b43dd2e476145dabda19b9516168ae417d6ffe6af
MD5 559228b246ca17ccd73257abc90b6957
SHA1 0f9c320a33f6a7c5453248b8081bb389d780773a
SHA512 54c22c962ad26c63439a696d0d66e82775942622bb240d0d6d9848296b443487888c0a512afd2c766ac300ef4539290fb29fa88f71534cad77cae08dff2248e9
SSDEEP 384:X5ZcIggsN4UScKpDksa9yO+TQ+2w86HlytEDq1xCUx:BDl61IOuQlw8oy6DqDx
TLSH
T17C927D3198785C3359FBB145F98636179EFD4027A6D96EC4E1EC9F1C01DB6A8230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a7935b120c53f8088bf78a6f621ff7c78b0cb76fa9ffbb7b17d48793c0793c5e
MD5 24ca0e45b6e3f1bbe0b5d1d4f9827398
SHA1 bb0b14ca2107ecfd442ec631f99ba7cafb509b44
SHA512 90f1fef45ae896db32299d8fd6d5c76b7780fc7e290a4aed191b68b6d99d0ae82956ad4e65bc2531741548c510a6ded1292e49c9983401d08e0fd6ce6f7de80f
SSDEEP 384:lZcI4sN4URcKpIksa9yO+TQ+2m86HlytEDq1xCUx:d4mX1IOuQlm8oy6DqDx
TLSH
T148928D3198785C735AFBB145F8863A175EF94037A6D96FC4E1ECAF1C01DB6A8230B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0dbc20d45b637b417715ebe2be68304262b71202e90ebdc9e37dded536beadf1
MD5 5bec4614bb2378ad7bb790cce5487ded
SHA1 d2e3e2d28e36db288ba0fbec6f6b4134fdadc8cd
SHA512 73c58d6e74f32b59350016f54d60a4d4d08432ca5828c4caccb217baf033ebb57ba611cb7161118c46671301daa8674071588b804b754a57171e33ebcaa50944
SSDEEP 384:lZcIqsN4URcKpuzsa9yO+TQ+2m86HlytEDq1xCUx:dqmK1IOuQlm8oy6DqDx
TLSH
T1EC927D3198785C735AFBB145F88636175EF94037A6D95FC4E1ECAF1C01DB6A8230B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ac89d0ca30838419e68b453da17dbc377e17e295e4d6bebdd43b0e7d54468330
MD5 65621b8d6d547a1f58f82fd192c9d3a9
SHA1 5067bb49e9d56d0855f599f093a82da9574d906a
SHA512 97552d3da1a1cb1db570c70f7e901ee49a2ece8d76d9e70ebc352c08def1730251e29b22ddc523a0339fd3c87568e3e629f8d5be58c342da0f853538f4bb4eda
SSDEEP 384:NZcIWsN4UScKpDksa9yO+TQ+2m86HlytEDq1xCUx:VWl61IOuQlm8oy6DqDx
TLSH
T140928D3158785C735AFBB145F8863A179EF94037A6D96FC4E1EC9F1C01DB6A8230B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2b8d35f53a2ef2ef2ea2a9dbb271fa00f06014194e9fc9e8ce04228fb8654cfb
MD5 2d42236a04c381b6d5e45f089ef14e08
SHA1 4d3afa2c9ce624bc78a0e2861723d6a24a5b2d01
SHA512 aeca450d48c6b295b460dd811e7fdb3f6934448ded56d4fe7ca7dd1543727b9e8a9d2e0a56be8ef601453ed1c8147d0ee98ddcca28753703b3783a9b802941f6
TLSH
T147412B58AAE91108B3B76F56ABF6A86D547FBC373E06D45D10010D0E0967A40C8B2777
MD5 SHA1 SHA512 TLSH

Submit Download

305c38d7-1bcf-41ce-90a6-7cc861e5af53.tmp

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\305c38d7-1bcf-41ce-90a6-7cc861e5af53.tmp
Size 1KB
SHA256 3c26b9b234b0cad5d5e1e4b0cfaa3da63098c271fcf03dbf3b966625b5ab3d82
MD5 6233776c17266ed6591589e647c473bb
SHA1 dd68072722915853f04a29cfad0377bfd7d68bfa
SHA512 ce857b33a884d7322e29812c62d699fe841eda75505ae9db4a80f7aac565cabadf681742a9baf3bf3a171eca3cfc8942ce86c26bdf701f9d8197cf18b73c6a7b
TLSH
T101310159295DCC3BBEDBD106F8472B239B6E10562B596F40C3F84F3C16A9B9C2316507
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Crashpad\settings.dat
Size 40B
SHA256 ecf0e2a6a58002b0158128070358104680a5e1c8b0536b4d98b6eef06896236f
MD5 2b04416fe5f8a22c2d1962c321012b9e
SHA1 62382002c21c7ae38db0ac1ba61437d177d33e67
SHA512 23277cac30ce4f442b1d80e7c9ec6a9e5d21feb5acb3a3f8830724e9b8b8d971e0da3ec4fc26492a0c6c31572a7d2874637c7f97172a007a39f7f6bd02e41c1e
MD5 SHA1 SHA512

Submit Download

Preferences~RFe5af713.TMP

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Default\Preferences~RFe5af713.TMP
Size 1KB
SHA256 afa81a8032364d456997bc860f919bfa6501525806cd3fbf6f10a2b9286c1a8d
MD5 9b3d50184fc27740d1fab5c63761a677
SHA1 2149c3cbdf1bea206a20962fe9d969b726c7dc61
SHA512 a558845f196fa2341977417b0bbfeb6378c0bfca9b9f32ad5981e5ae80576f679d07766b30e99003bc6d1889a8aa334bea814d5d43e1acd5a2ab7755d6cdf874
TLSH
T1DF3153068D24EE779CCDD7187E2C7993D1F60492A6801D589AF85A5C0C7E6DD220B90A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Default\Thumbnails\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Default\Thumbnails\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

f70fa4c4-7ae1-44d3-9f68-f098591e28ed.tmp

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Default\f70fa4c4-7ae1-44d3-9f68-f098591e28ed.tmp
Size 1KB
SHA256 81460aabbf4067d57f9f21630e2b31d71d740557f0a113ebeccf113847d76fd6
MD5 ab7d2588a25523c948dcba582358c575
SHA1 ab0dc796dc3e87dfb3d2fca4dd4f69ea28fdc107
SHA512 3be58b827146143a335c753eba88814fe70d577b958f334b540289c23817cfda923844f76b26cf1ee9b08af27b4b5800461d2488327ddc4ca52166bc208306d5
TLSH
T1683175158D34EE779CC9D3187E2D7D93D1F61452A6801D4CDAF85A5C0C7E6ED220B90B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a95f8.TMP

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\Local State~RFe5a95f8.TMP
Size 1KB
SHA256 7f621890266a87daa7b5c1ad4f81c9988b9694d0cab1603a6d704db26c9170d7
MD5 7ec90d965c9dc0a58de9bb2542f37568
SHA1 3355dcd6c60cf70938539248740d8772e55825c0
SHA512 d816b46f0b884f2e157c5e2aae0d42000c4af971d374c45cb2a8172018a554b5fd6694d39f5859e670347874ca4a198d81216fef418c4bcc8ede527928a850e2
TLSH
T10431F059395DCC3BBE9BD105F8872B278B6A105526595F44C3F40F3C06A979C2316107
MD5 SHA1 SHA512 TLSH

Submit Download

b31118ed-3cdc-4654-801b-442919f7f76e.tmp

Path C:\Users\Admin\AppData\Local\The Coffin of Andy and Leyley\User Data\b31118ed-3cdc-4654-801b-442919f7f76e.tmp
Size 1KB
SHA256 72cbab1a0ba2c3c70adb71c5e276dfd7f2efbd1689198ea01f0e0bb9ad6fdd63
MD5 b4f1f5936083ac13810efe141aff6877
SHA1 13e064fdf1e543d0a2686bb723e92b50017ee5c3
SHA512 8188fa27dbed8bc70faf46fce600a5f4e2c6957ada5cc6ca3ee8a7c8aafc22e3cc489f39e516b370fe7451b5fbf04481ade77de073ad1a2864fcb83a8bff10bf
TLSH
T1E7311059395DCC3BBE9BD106F8872B238B6E10552B496F44C3F40F3C06A979C2316107
MD5 SHA1 SHA512 TLSH

Submit Download