976f99adbeb33b1a68f8a44e89226b69e7d98b15fbdf0fd60ea55e9cd4bcd70c

Analysis

user interaction
yes
max time kernel
330s
max time network
433s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gameclient.msi
Size 19.4MB
Sample260815-ml33ysvvgx
SHA256 976f99adbeb33b1a68f8a44e89226b69e7d98b15fbdf0fd60ea55e9cd4bcd70c
MD5 1b9dd7a862dec4777a76846d65260afb
SHA1 2a818f7a5d546ca66c27f85abfea9ec43614e7e2
SHA512 5476dc3813ce256464416f34ad0ebad0722cf2943b2a8b6a0a6f3a812ce7aceeac59d9437b129dc07a0732c49149077c40af111ef62492299f5658e31a254c9d
SSDEEP 393216:J9p+LgBCaXiolUGuwFL208NZNo+UhB0ln6VzeltqxTUk0CnbuE:J9jBCaSQUgFqh++Uh86VzCqPxnb
TLSH
T1462733577FC0C623D22B1E75D83D97A0895C3D242995588316A8372DEBF32D23A70BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6136	LibraryClient.exe
3472	ludusavi.exe
5892	ludusavi.exe

Loads dropped DLL 2 IoCs

pid	Process
2736	MsiExec.exe
2736	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LibraryClient.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3268	powershell.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF34A60A10E43E6C46.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2002987087\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_205785017\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_205785017\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2002987087\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2002987087\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_205785017\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DFEBFA01F5B64124A9.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{58F7EC15-42E0-4DA6-8166-B057B6B90182}	msiexec.exe
File created	C:\Windows\Installer\{58F7EC15-42E0-4DA6-8166-B057B6B90182}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_194254525\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1880328782\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-und-ethi.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e5a4557.msi	msiexec.exe
File created	C:\Windows\Installer\e5a4559.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\Installer\e5a4557.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1880328782\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_205785017\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-hr.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI4DA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{58F7EC15-42E0-4DA6-8166-B057B6B90182}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_2089373502\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1363331617\hyph-bn.hyb	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3268	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4400	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Family Model Stepping	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Meta Data	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	powershell.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Record Version	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Configuration Used	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	powershell.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Record Type	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Preferred Record Version	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Environment	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Source	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Firmware Record Version	powershell.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Colors	LibraryClient.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312639908961143"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	LibraryClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	LibraryClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\ProductIcon = "C:\\Windows\\Installer\\{58F7EC15-42E0-4DA6-8166-B057B6B90182}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\51CE7F850E246AD418660B756B9B1028	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\Language = "0"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\MRUListEx = 00000000ffffffff	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	LibraryClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	LibraryClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	LibraryClient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	LibraryClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	LibraryClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\MRUListEx = ffffffff	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	LibraryClient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\51CE7F850E246AD418660B756B9B1028\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	LibraryClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	LibraryClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	LibraryClient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\Version = "262145"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\NodeSlot = "3"	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\NodeSlot = "4"	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\SourceList	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0 = 72003100000000000f5dd6541000434153544e437e312e320000580009000400efbe0f5dcd540f5dd6542e00000089c7010000000f000000000000000000000000000000512f610043006100730074002e006e002e004300680069006c006c002e00760031002e0030002e00320000001a000000	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	LibraryClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\51CE7F850E246AD418660B756B9B1028\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EA3787087021A835291560985583B3C3	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1 = 50003100000000000f5dcd54100047616d6573003c0009000400efbe0f5dcd540f5dcd542e000000abc601000000130000000000000000000000000000008370ec00470061006d0065007300000014000000	LibraryClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	LibraryClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	LibraryClient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51CE7F850E246AD418660B756B9B1028\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	LibraryClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	LibraryClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0	LibraryClient.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2832	msiexec.exe
2832	msiexec.exe
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe
4132	msedgewebview2.exe
4132	msedgewebview2.exe
4092	chrome.exe
4092	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4400	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
6052	msedgewebview2.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4400	msiexec.exe
Token: SeSecurityPrivilege	2832	msiexec.exe
Token: SeCreateTokenPrivilege	4400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4400	msiexec.exe
Token: SeLockMemoryPrivilege	4400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4400	msiexec.exe
Token: SeMachineAccountPrivilege	4400	msiexec.exe
Token: SeTcbPrivilege	4400	msiexec.exe
Token: SeSecurityPrivilege	4400	msiexec.exe
Token: SeTakeOwnershipPrivilege	4400	msiexec.exe
Token: SeLoadDriverPrivilege	4400	msiexec.exe
Token: SeSystemProfilePrivilege	4400	msiexec.exe
Token: SeSystemtimePrivilege	4400	msiexec.exe
Token: SeProfSingleProcessPrivilege	4400	msiexec.exe
Token: SeIncBasePriorityPrivilege	4400	msiexec.exe
Token: SeCreatePagefilePrivilege	4400	msiexec.exe
Token: SeCreatePermanentPrivilege	4400	msiexec.exe
Token: SeBackupPrivilege	4400	msiexec.exe
Token: SeRestorePrivilege	4400	msiexec.exe
Token: SeShutdownPrivilege	4400	msiexec.exe
Token: SeDebugPrivilege	4400	msiexec.exe
Token: SeAuditPrivilege	4400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4400	msiexec.exe
Token: SeChangeNotifyPrivilege	4400	msiexec.exe
Token: SeRemoteShutdownPrivilege	4400	msiexec.exe
Token: SeUndockPrivilege	4400	msiexec.exe
Token: SeSyncAgentPrivilege	4400	msiexec.exe
Token: SeEnableDelegationPrivilege	4400	msiexec.exe
Token: SeManageVolumePrivilege	4400	msiexec.exe
Token: SeImpersonatePrivilege	4400	msiexec.exe
Token: SeCreateGlobalPrivilege	4400	msiexec.exe
Token: SeCreateTokenPrivilege	4400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4400	msiexec.exe
Token: SeLockMemoryPrivilege	4400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4400	msiexec.exe
Token: SeMachineAccountPrivilege	4400	msiexec.exe
Token: SeTcbPrivilege	4400	msiexec.exe
Token: SeSecurityPrivilege	4400	msiexec.exe
Token: SeTakeOwnershipPrivilege	4400	msiexec.exe
Token: SeLoadDriverPrivilege	4400	msiexec.exe
Token: SeSystemProfilePrivilege	4400	msiexec.exe
Token: SeSystemtimePrivilege	4400	msiexec.exe
Token: SeProfSingleProcessPrivilege	4400	msiexec.exe
Token: SeIncBasePriorityPrivilege	4400	msiexec.exe
Token: SeCreatePagefilePrivilege	4400	msiexec.exe
Token: SeCreatePermanentPrivilege	4400	msiexec.exe
Token: SeBackupPrivilege	4400	msiexec.exe
Token: SeRestorePrivilege	4400	msiexec.exe
Token: SeShutdownPrivilege	4400	msiexec.exe
Token: SeDebugPrivilege	4400	msiexec.exe
Token: SeAuditPrivilege	4400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4400	msiexec.exe
Token: SeChangeNotifyPrivilege	4400	msiexec.exe
Token: SeRemoteShutdownPrivilege	4400	msiexec.exe
Token: SeUndockPrivilege	4400	msiexec.exe
Token: SeSyncAgentPrivilege	4400	msiexec.exe
Token: SeEnableDelegationPrivilege	4400	msiexec.exe
Token: SeManageVolumePrivilege	4400	msiexec.exe
Token: SeImpersonatePrivilege	4400	msiexec.exe
Token: SeCreateGlobalPrivilege	4400	msiexec.exe
Token: SeCreateTokenPrivilege	4400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4400	msiexec.exe
Token: SeLockMemoryPrivilege	4400	msiexec.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4400	msiexec.exe
4400	msiexec.exe
6136	LibraryClient.exe
6136	LibraryClient.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
6136	LibraryClient.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4400	msiexec.exe
2832	msiexec.exe
2736	MsiExec.exe
6136	LibraryClient.exe
6136	LibraryClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2736	2832	msiexec.exe	89
PID 2832 wrote to memory of 5224	2832	msiexec.exe	95
PID 4400 wrote to memory of 6136	4400	msiexec.exe	98
PID 6136 wrote to memory of 6052	6136	LibraryClient.exe	99
PID 6052 wrote to memory of 252	6052	msedgewebview2.exe	100
PID 6052 wrote to memory of 5676	6052	msedgewebview2.exe	101
PID 6052 wrote to memory of 5676	6052	msedgewebview2.exe	101
PID 6052 wrote to memory of 5676	6052	msedgewebview2.exe	101
PID 6052 wrote to memory of 5676	6052	msedgewebview2.exe	101
PID 6052 wrote to memory of 1480	6052	msedgewebview2.exe	102
PID 6052 wrote to memory of 2704	6052	msedgewebview2.exe	103
PID 6052 wrote to memory of 2704	6052	msedgewebview2.exe	103
PID 6052 wrote to memory of 2704	6052	msedgewebview2.exe	103
PID 6052 wrote to memory of 5268	6052	msedgewebview2.exe	104
PID 6052 wrote to memory of 5268	6052	msedgewebview2.exe	104
PID 6052 wrote to memory of 5268	6052	msedgewebview2.exe	104
PID 6052 wrote to memory of 5268	6052	msedgewebview2.exe	104
PID 6052 wrote to memory of 5268	6052	msedgewebview2.exe	104
PID 6052 wrote to memory of 2444	6052	msedgewebview2.exe	108
PID 6052 wrote to memory of 2444	6052	msedgewebview2.exe	108
PID 6052 wrote to memory of 2444	6052	msedgewebview2.exe	108
PID 6136 wrote to memory of 3268	6136	LibraryClient.exe	109
PID 6052 wrote to memory of 4684	6052	msedgewebview2.exe	112
PID 6052 wrote to memory of 4684	6052	msedgewebview2.exe	112
PID 6052 wrote to memory of 4684	6052	msedgewebview2.exe	112
PID 6052 wrote to memory of 4132	6052	msedgewebview2.exe	113
PID 6052 wrote to memory of 1136	6052	msedgewebview2.exe	114
PID 6052 wrote to memory of 1136	6052	msedgewebview2.exe	114
PID 6052 wrote to memory of 1136	6052	msedgewebview2.exe	114
PID 6052 wrote to memory of 5472	6052	msedgewebview2.exe	115
PID 6052 wrote to memory of 5472	6052	msedgewebview2.exe	115
PID 6052 wrote to memory of 5472	6052	msedgewebview2.exe	115
PID 6136 wrote to memory of 3472	6136	LibraryClient.exe	116
PID 6136 wrote to memory of 5892	6136	LibraryClient.exe	119
PID 6052 wrote to memory of 5552	6052	msedgewebview2.exe	121
PID 6052 wrote to memory of 5552	6052	msedgewebview2.exe	121
PID 6052 wrote to memory of 5552	6052	msedgewebview2.exe	121
PID 6052 wrote to memory of 2648	6052	msedgewebview2.exe	123
PID 6052 wrote to memory of 2648	6052	msedgewebview2.exe	123
PID 6052 wrote to memory of 2648	6052	msedgewebview2.exe	123
PID 4092 wrote to memory of 1192	4092	chrome.exe	126
PID 4092 wrote to memory of 5492	4092	chrome.exe	127
PID 4092 wrote to memory of 5492	4092	chrome.exe	127
PID 4092 wrote to memory of 4772	4092	chrome.exe	128
PID 4092 wrote to memory of 4428	4092	chrome.exe	130
PID 4092 wrote to memory of 4428	4092	chrome.exe	130
PID 4092 wrote to memory of 4044	4092	chrome.exe	131
PID 4092 wrote to memory of 4032	4092	chrome.exe	132
PID 4092 wrote to memory of 4044	4092	chrome.exe	131
PID 4092 wrote to memory of 4032	4092	chrome.exe	132
PID 4092 wrote to memory of 2584	4092	chrome.exe	133
PID 4092 wrote to memory of 2584	4092	chrome.exe	133
PID 4092 wrote to memory of 6048	4092	chrome.exe	134
PID 4092 wrote to memory of 6048	4092	chrome.exe	134
PID 4092 wrote to memory of 4984	4092	chrome.exe	135
PID 4092 wrote to memory of 4984	4092	chrome.exe	135
PID 4092 wrote to memory of 3344	4092	chrome.exe	136
PID 4092 wrote to memory of 4060	4092	chrome.exe	138
PID 4092 wrote to memory of 4060	4092	chrome.exe	138
PID 4092 wrote to memory of 3328	4092	chrome.exe	139
PID 4092 wrote to memory of 3328	4092	chrome.exe	139
PID 4092 wrote to memory of 1108	4092	chrome.exe	142
PID 4092 wrote to memory of 1976	4092	chrome.exe	144
PID 4092 wrote to memory of 1332	4092	chrome.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\gameclient.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\Desktop\LibraryClient.exe
  "C:\Users\Admin\Desktop\LibraryClient.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6136.2824.985382255812747396 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView /prefetch:4 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbd5a65fd8,0x7ffbd5a65fe4,0x7ffbd5a65ff0
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2032 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6 /prefetch:1
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4664 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4700 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4720 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4132
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4664 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4876 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4716 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4892 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView" --webview-exe-name=LibraryClient.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4920 --field-trial-handle=1788,i,7311534651218640237,16924021638912533488,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17d6e6aadb9dd3812c6407fa0af1fadf62456ee6
      4⤵
      PID:5464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -Command " $uuid = (Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue).UUID; $serial = (Get-CimInstance Win32_DiskDrive -ErrorAction SilentlyContinue | Select-Object -First 1).SerialNumber; $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue).ProcessorId; $microcode = (Get-ItemProperty -Path 'HKLM:\HARDWARE\DESCRIPTION\System\CentralProcessor\0' -ErrorAction SilentlyContinue).'Update Signature'; $raw = '' + $uuid + '_' + $serial + '_' + $cpu + '_' + $microcode; $bytes = [System.Text.Encoding]::UTF8.GetBytes($raw); $hash = [System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes); [System.BitConverter]::ToString($hash).Replace('-', '').ToLower(); "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3268
- - C:\Users\Admin\Desktop\ludusavi.exe
    "\\?\C:\Users\Admin\Desktop\ludusavi.exe" --config C:\Users\Admin\AppData\Local\com.max.gameclient\ludusavi_config --no-manifest-update find --steam-id 3483740 --api
    3⤵
    - Executes dropped EXE
    PID:3472
- - C:\Users\Admin\Desktop\ludusavi.exe
    "\\?\C:\Users\Admin\Desktop\ludusavi.exe" --config C:\Users\Admin\AppData\Local\com.max.gameclient\ludusavi_config --no-manifest-update find --steam-id 3483740 --api
    3⤵
    - Executes dropped EXE
    PID:5892
- - C:\Users\Admin\Desktop\ludusavi.exe
    "\\?\C:\Users\Admin\Desktop\ludusavi.exe" --config C:\Users\Admin\AppData\Local\com.max.gameclient\ludusavi_config --no-manifest-update find --steam-id 3483740 --api
    3⤵
    PID:4164
- - C:\Games\Cast.n.Chill.v1.0.2\Cast n Chill v1.0.2 [Build 19492699]\Cast n Chill\castnchill.exe
    "C:\Games\Cast.n.Chill.v1.0.2\Cast n Chill v1.0.2 [Build 19492699]\Cast n Chill\castnchill.exe"
    3⤵
    PID:2908
- - C:\Users\Admin\Desktop\ludusavi.exe
    "\\?\C:\Users\Admin\Desktop\ludusavi.exe" --config C:\Users\Admin\AppData\Local\com.max.gameclient\ludusavi_config --no-manifest-update find --steam-id 3483740 --api
    3⤵
    PID:1252

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A9A6783F370EE264DBE0DDA339A29CF8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2736
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbe6cec728,0x7ffbe6cec734,0x7ffbe6cec740
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,17970163946795568122,16674714994106307701,262144 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,15939130990028489672,17847838272979867784,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2840,i,9200409782032166242,5227710603636287200,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,10391909361725336223,16778705646134129414,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2820,i,3650305451025596808,11795360560641292744,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,4379438300657338353,13235761848591387930,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,4144558401082886976,2844775652535016196,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4932,i,5399332837168032377,1458447784434800120,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,17367100278901606477,12001566638783215213,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5332,i,1967892946719631212,12854354188394762095,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5380,i,12683980487387068621,16791689112270079484,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5768,i,579466111995562504,15652598626755452989,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,10561440093825958964,940636393069788239,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,3218850574319783055,5637102027235852814,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5364,i,14043551911087945814,7336359803320512285,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5744,i,5004802222207907984,729411936007547077,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,10564344710402670292,8372624506761952718,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6460,i,11987692989541056894,5429240051327286405,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6588,i,1514314242447733439,5081947201029811864,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,6932168249384900235,8598419399264726876,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6224,i,2435750906289015798,16682231811271401542,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5024,i,4958235051645177708,10421873123402659467,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6588,i,5844912509252834393,6094880351365829558,2097152 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:9
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6588,i,12860954014170247056,15475237201169800443,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6660,i,13855540820541926967,7011581771137593821,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,2632694102064788932,8970718614368276322,524288 --field-trial-handle=1848,i,1110846862282022084,4636410279874432558,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6068

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004FC
1⤵
PID:472

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2164
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:4644

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3284

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a4558.rbs

Path C:\Config.Msi\e5a4558.rbs
Size 9KB
SHA256 8a2a4375978231860f0a24ac54b6cf84dd2ca7bbb6618e15393b134228a8f627
MD5 5612f7fcf421af2628d8be3ab6d0e8e8
SHA1 27ffbee02cbf8fff0697811c8908b6a40e7cccf4
SHA512 d86cac54d98567a7275f965fb4afb09be70af043037c9e149b4d350b5a78e9f32524af40204744a5de47f0b1b2df93e310fb606f94ddd8b50692ec6067f4d397
SSDEEP 192:oPqLZNHVN6CXmMXGPMXb27WjNWJiE/TpI1:oPqLZNHVNoMSML5T1
TLSH
T1502220452601B2E2FE931770C70317763BB2D2F5834BA75B0ACD48244EA67989B976CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gameclient.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\gameclient\gameclient.lnk
Size 2KB
SHA256 80528743ccf70fd06a196fdaaaee6155cab6d92ebcd11fbcfa6a213dbb8583eb
MD5 0df828c2af4ff0792ea78b8c18554bf7
SHA1 8fd236ce6c90ca426b49436db2d9d2e89c0146bd
SHA512 672802a7ff184a63399ce2fa8639eef869f3410fee76cb93e6ca73fc2b53a96aceab459622a6beb92026239a0f1115ae11823a7795c13a750f6c3b943f85be62
TLSH
T19541020456E93B25F3E64B369DF29223E631BC00BF54DF1E0198428C0561A44AD68F3E
MD5 SHA1 SHA512 TLSH

Submit Download

gameclient.lnk~RFe5a4ff6.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\gameclient\gameclient.lnk~RFe5a4ff6.TMP
Size 2KB
SHA256 3b1ae9d25243eb65422481b0a3f9c834d840b3fdcfdd7c04be3a61b246809c72
MD5 9522eafb06c4a4598721c7af6bf6179f
SHA1 7c43396757ec07ee5038d7c2f07c0b8e85570e3b
SHA512 abe2f206d7a603096f467c9b13c6d15ff9a6fe8d31be8ca1fd7ad1d513d87e119f017bdaf6d5f5d8563435df806452e16c14de0f89562a9cb24e80c2556973f7
TLSH
T1B941E10457E53B25F3E58B76DDF69222E631BC00BF55DF1B0199428C0561A44E868F3E
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 922089e0c0b436b65e74814e9a93cd3e437bd13402ee25821b2057acd6dd7c1d
MD5 143e327c25493ceabcf1dd834c616891
SHA1 bdac4719a78c161206bd325d3af078b6e51175e3
SHA512 02f1729e3e4a62f529ac37b23310246f5ce9177c8ef06bfdaed57931d4b774c3f5365aeeb2e8165cfda61b830ff668ef9407743791bf1d85471ebb794e99ec64
TLSH
T11E4148B7C3E4857D891556E4EA216F2FCD6E0A14131C3C66C9D8AE6B53F28B2D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 840d60080441575d3d354e604e3a67e51925f02da739e10d4b127aa6c1bec64b
MD5 f17e9776ec1d7c67fcefb4caaa6b363c
SHA1 25d45abc3dd3471cd6ced04a671df01752119c90
SHA512 b859ecee03a3472d58b371bb0cb1d70fcc61c2e4ae4145197e438ebde7acb474a6503f2b4d4b6a58837eb16cf44d9453c4a893611c6212d9da5e2767aa4dd7b6
TLSH
T158F059A7A67D70A710B984FFDD04B8096872E831424158F8CF9B42FDE0A28F71B12863
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 eca9f0eca62796fa6a99c4a7f2f9161993fc467d5e3e636ab6a853cd86c301e5
MD5 9bfb2bf9863d9d4913fed42ad01ed8eb
SHA1 4c3fb02532d0e6e1fe6df0e296ef13d33c019171
SHA512 3dbc9fe9ba8848b2a0dfe6fe41929f1d30c439a3d3024e1914c1dc007b920b30192ffa8df05ce4ac888ea55c77ec80dd1c52bd4f863e677c7d4b8510b58c81e1
SSDEEP 192:QRWXPTzv77APRp2sm9ZHsb+WNns70ceu2ts0kwK1VyIsnAUge:QRWXbLyX4bw00ct2t7qje
TLSH
T1AB42A52DBE15693B6DCAD21AF921BB53D7F5102235942E84EAFC8A2C14E79CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 71c6187c7bd0bfbd5b1cbc9e68c756f0f1fe40987373b0ef88a4651879d59807
MD5 8e5fa4a72cdd2dda28cdea6154ab950c
SHA1 7b4c502c490a14380306cac07a173764e5d0e782
SHA512 951847a07dc956f9733ce749f50d8f3e6de4debc0121b2b33d74ba3d5dcdd6b050c55648d3e317911099ed235572969ab6c6e19808d73778d0b4ea482602737a
SSDEEP 384:ZvjNE7KxkXqKf/pUZNCgVLH2HfgslGWXODNs+ErU3kSHGSepSr7oh1FnGzL:ZbNE7KxkXqKf/pUZNCgVLH2HfgsA8OBV
TLSH
T11752E767684D9A3B0FD8D64CDC26BF8BADB202977664092493FA5C0803A57DF114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 958c1b8b45571ea214e32ffb5e72c9f3f187342ad2da85cd30f961b8bde67dd9
MD5 deb39cfb0b72cc107b81d801bd21f0db
SHA1 1c2194eb21f3cc10bf5e88372f2d2792a295189b
SHA512 fa05e40920816aae68d04165684fa971fa2c74798f4449a05093c771f5015f20f2a23f2de42833a168370cab66df882fe2c0c9a097fcb80f3a154344c0b75193
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 6c9e333f83ba9b4d6746b29781721e048e63bf0ac424491b6e495266d8e149ab
MD5 62f0d42fe831a8b715b080470741223a
SHA1 8c9176e02defc3db6801adce6c454678af168a59
SHA512 3f2141cdf146bfee39a6f30940a8a07de0516249236b1e802e988084f440ead31f1ebc591eaa66b21249b56aacb54907ba3d06c8e931853cd64c6fe4f6a7499a
TLSH
T179A0022442D41D13CE58527061691A61B2518C361551A307E89F4954C95B1C44311550
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 8a7092f4373edd6af498d3c7e3223f337e333dcd4afe55067e544df082c0747e
MD5 d49d3f6dc6be31721a01a8beac1be730
SHA1 d47708fee90e85d92a65c68440e2636bdd913fdb
SHA512 f093acb05495e78fb2c222ede188776ad4ee06ec327a756495b73158e0407230eeabf44e7408d955ca32b88c60886da60251072d0796956c17391e25bf769181
SSDEEP 3072:W8Dh6BwY6XftxQNKGOnlmZnVMOhoi2nFmUgeXWYXCts:WXYftxQNKxKeFmUgeJCy
TLSH
T122D313717D716E2176BC9075A904205F8FEC9827180627BD88BB2B8D21C7DADD723E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 333d43efb25d97db9347cf9d0423e45a1f4e951bca7a13f175fba63b575f7c8d
MD5 387842d26bfab50a2fbbeecba28167d2
SHA1 7ceaf723a2fc5dc3a4f0f3c9f2c51841ef192d03
SHA512 1a1b3a1c7ecbbd4af78023da3d3d4abd94a530aa1a3aa0b4488c1d12b6deadabc21d8ec1c88370798b0daebd18688103278a2da2e1b713a43bcb3b0bbea718db
SSDEEP 3072:p8Dh6BwY6XftxQNKGOnlmZnVMOhoi2nFmUgeXWYXCts:pXYftxQNKxKeFmUgeJCy
TLSH
T18FD313717D726E2176BC9075A904205F8FEC9827180627BD88BB2B8D21C7DADD723E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5ad4685104c895a4473e2a8359dc4d1498cf43b357d0450e222821ebd93992ba
MD5 6772db982db32906d5fc0962881e1fec
SHA1 a26bcde4d557281216b5df26c1c8db938def0797
SHA512 d2ea13ab73b8b8ec175cdd4f7a98106ad8db623606e1920f0c562f8be262bfd9fed341163f0c2576efc8368ed25d217ccee210cf265f077115f72089bb7c597c
SSDEEP 96:0C0d+x7oIU1fXfBVMLHRDotok58dDMB6nGyvLlAlZbdOv4a:0C0G7/qffEDUDGAvcAlZbe
TLSH
T1C0A10A31A42D4C3759B2D489FA426A53DFB570A76920AF84EDDE1F0801FB5EC1383923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 0f29051c5276fd4ee7933e54e0acab14f05aa886b34e11f487ec7c6ff3c2d50a
MD5 79d8d9919eb5a6cb2267976f14679bb5
SHA1 cb59553318e5efd933a057c4d4b1dce3bd061dab
SHA512 968c71f455e5e52d3a2c0ce6c812a04a78b46e81c2ffb0137a406ba54815e1538ea427b18065770141121ae256a7e3cf3b61b27ede6893eab69826a3c2355b87
SSDEEP 3072:IeDh6BwY6XftxQNKGOnlmZnVMOhoi2nFmUgeXWYXCts:IJYftxQNKxKeFmUgeJCy
TLSH
T17FD313717D726E2176BC9075A904205F8FEC9827180617BD88BB2B8D21C7DAED723E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF90C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF90C.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4092_1224865121\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c5b073776ce57d73cbd6e19cd0aa9b54ec8eecbcdf76541d9daeb6f90251ff09
MD5 99024e06b45a7f9db1c0704e6d1cca3c
SHA1 c2a8853ac708c718d75aa56e7f1663ef8ab5b7fb
SHA512 0631b7835ff211928ffea303515dc1cb96257e2ff3a3c219de4c2f1aa5f6a3bb938bc3848cb2e396f19e902c351434b5fbdf037b1de1ea4ab0520bb69680c564
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f1256d0b2cb7fbbdaa5f4412e5ea8feb39ee768c8626ed272456990c2c28d361
MD5 c2d2944e86cb5362e3f55e235788d5de
SHA1 0f818d99c1c227a63611dcebec3ec46f53f65cad
SHA512 7005f56a81699a6498be19d793f5c52663aa27dc0f41bd6c6de12dd89cb43484d1e1bd180798b20bddfb300b67e32885f108abd0b6cd5d6e8ae8545dd8150c3a
TLSH
T1D3D01233321201B5C010343300D275091501C10F41064014A83D892E1F144D01902441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1c37b58f-7acd-4221-99f6-a54b3cf1d321.tmp

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\1c37b58f-7acd-4221-99f6-a54b3cf1d321.tmp
Size 6KB
SHA256 1cf1fd1ac5580dbea3d37154f722b4c2f6e76ac171d23270da5a3c2cfd4f4c29
MD5 5c51fafeb84fbf32fcff51da4358995d
SHA1 f9de5e111276f5572a92248d57acf09e9fe83843
SHA512 2b66d27334fe7218446a73400c7a2faaa7dedaf6c5f72d64e905b3d05aa3be826fe9f749de9d921f4397054dd9467b46bf60d1b219bb317c78d234f6b6e405f4
SSDEEP 96:stz/dkV1Kb91kLo5h16Z09Ls7/x+6MhmuecJ9mpv1ejebK+gd3v328XM1C7K:strCKcon9LsV+Fd9mpvQjx7f3G6K
TLSH
T132D1A7025E24797B4CCBF609BA35BA16E3F9607130D11E58EBFC862C08D69DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 69264b1c50cc047c16c452d6ea429deee028c7d5d0187143c8ad3a824bb92780
MD5 8d267b4f894df9608ba3c596e8907acf
SHA1 c4b20a581b39c6ef78fd44c008b8caf807087e90
SHA512 0ad0b875a4a7dbe9aa0ff76d4b607d2e80f73c5d1167607953508710596660b5c4d08b86d8324e6b23ef6d22dde787a545c247912247c2354ba46f68ab8bd7f4
TLSH
T1F8A0021D63562807EA1647B470C1058473B0B811C2434B1B85EC28B49D903458155485
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5abc6c.TMP

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5abc6c.TMP
Size 48B
SHA256 3a7ce56f25b740beb9f3d01acd86643a2d6cf7bcaf3c34b2b955f0b41738eb2a
MD5 67b7611fe6a1201bb4fccc1ffc546e56
SHA1 8b82fd7c54187b096d60e25e6774b3cf20584bf2
SHA512 5f60418ca6073aaf820fc3d7df5c9575286cb56ebe54c6d78efde423d8c92346852273a41e4bf1726d07a912f9e51bd6bfe712c69430fee0766b35847fc6c617
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 39850cc74cb1aca7ba45268b4d138f24a5ef8a4afc8829e308f2688cef88949b
MD5 73b032c6b0359d1991043c6d2da81cd0
SHA1 e7931b4da5e057a4ffbe4ee33854464e21e96f3b
SHA512 07f079f1cb48011a3bf3955b00d62f62e9a71dcd104d069fb404d28c0430b00dd8e0cb3df2a37af68afa8e77dc584284b39fa5185d3c9219b8d1218a787e99f2
TLSH
T118018EA2C3E4C67D8A5117F426347813CD2E051992282E27CDEDEBEA57E20B5D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 cb40d308d460719a218c31bcc6ba1759f2e3f00980f0990dea3f4ce8ea0b4c9c
MD5 5f8dabb4186c6041091479532b1e3660
SHA1 a55b3d6df67d1dbb772d175894b9b8d273cb2063
SHA512 e0e8fdc60adec1a617a4650534bbbbe3dfdf0d2f504bc7c7a39627025d2fa799f6593213f540ef3951aa07eb206bf1456493f33f50dbe683fd956ed30d44a62d
TLSH
T102018EA2C3E4C67D8A5117F427347813CD2E051992282E27CDEDEBEA57E2075D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 e58f012ea26caf6ba43f18335118220558479e53ea2da475e19faa6c0491a593
MD5 f559a6fbe49d69d6e4f29398951a2312
SHA1 274f4b631b834e5d1dafcbcb4dd30528ed11a164
SHA512 b465a4c2d767eba1aeea3fb92401e749b0291cd36a9755c60715a1c5a742b2e1fa0669825b432ef50e312b4cec4885c087de3e980c88dbc43fd2f82c38abcd73
TLSH
T1BC4180A2C3E4C67D8A1166F427346917CD2E091D92282D27CDDBEBDA67E2071D22154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b7f6d.TMP

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Network\Network Persistent State~RFe5b7f6d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 2245bf912516882b6f2c4c5d18012431a55cafcc4667e22701ed608842e7acdd
MD5 abe5d03b92fdab8497083cff7d8330e5
SHA1 d695c2d6768dccb9b77113587078ef9eac5f3418
SHA512 cb030f46b0dcccb10293358923642dd2c63588343c817dc83befe3b34c0688977261b7c814b0936c8e454d7958fcf0455b064cd3c860c1ac47b4bd6d4a9bbd6d
TLSH
T1ED017B97817FE43B10BC587E09457C096A3AF43661D2ACF8EA62C16CB0B0AF75683051
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 74b25546e28109a8cbc1b3a55b30acf30c51c2b209452a6fe96fbccffb9282c3
MD5 3396ab230fbfa37bc75b5b988982d04a
SHA1 917e31f8b3a785b02fbd67fb43607e242a0307d6
SHA512 91ab02365fb37f625c1a500b0118c4f1950e0383381bdd1e52df15f3c1de50fd12258bcc447f619978e2669390f411acb4ddf6678e1c4b9f4b985d54297fd9ac
TLSH
T11A014797817FA43B1068597E094578096A3AF43661D2A8F8DA52816CB0A06F75613091
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5c2d51.TMP

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Network\TransportSecurity~RFe5c2d51.TMP
Size 352B
SHA256 d96f5085413e95449ba9202fbecf21b56bfcdf853262795b88feff8e925e324e
MD5 465fd3796741c9cd8b65e91dd4faece0
SHA1 e3b19aa34c9b702cf5055462aaefdb837935eaba
SHA512 e6ee9fcc7048c7d16514529f138c9feeb488ab4fc85fe3874183ead14cbf342572a965825fbfa925ca87cd7b471a5d99501084a7778e63401c45abccb848fa5c
TLSH
T176E0D8D3807EA077107C997E09407C515A35B63411929CF8EA53857CB0B11E79557461
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Preferences
Size 6KB
SHA256 44a98de2a9eaeb590ec4982105180e5b62421a3fae346234081054a7cf037fdb
MD5 afffdb7bb03f659b928cf6891e778c50
SHA1 4433671836b93bcf437299b8866def512c0b9717
SHA512 5a7d5e3d86c291e0261186100ea6024204b535968052eadbb0778bb405fd1c098cb8a4a820d219053acb676d5dadb4673f466eec36f3b4ffd6024152276e00b1
SSDEEP 96:stz/drVcGKb91kLo5h16Z09Ls7/x+6MhmuecJiLfL0jebK+gNDm28XM7C7K:strBUcon9LsV+FdiLojxvmG0K
TLSH
T1FAD197025E64797B8CC7F51DBA35BB17E2F9607221901E58EBFC861C08E7ADC221790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Local State
Size 17KB
SHA256 75c7c5ed418f5ba73302e87f70ddebf281d37c1f11ae3e76ffefb0b77454a236
MD5 c61ab10c8dc95bcf5fc0214f6420f832
SHA1 97834273f73008d7038878d759d43e87dd1ebd24
SHA512 400dc4365a0637a2445fe0ffb02c5d0770ea8c35affdf87aaed9273dfdeae79b1718ed569f84474dc9fec706e9ef8f1222539762c7894383453e90fa169274a6
SSDEEP 384:p+aQikB+z/xvxjg/qhEBNliU0yi5nI2mtF/sAVdpy1+79zx:U/UxvxjgC+IAiyPD/sUyA7Fx
TLSH
T11B829E36D875AE23E8FBEA05264AA7CBCBF4447250C12ED88DE85F0D46C76ED1302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Local State
Size 17KB
SHA256 f76f9678436ef1be252a330b9e684e5e2ff5cf325aeb009a040688eddd37a0ea
MD5 7a54322d21b3242cce065969e43f4720
SHA1 f58cdaf8f67f0ad997d91af6b37a5d07f26a29d6
SHA512 48f9e2a67c566f45868926d927564d830fcb6db4c1a1385b0d54686853def06da55392fba9abf2b36d2ccb51202f9ab63a1d49a2a0a1f94fd37642124b420a52
SSDEEP 384:5+aQikB+z/xvxjg/qhEPNlip0yi5nR1F3sAVdpy1+79zx:k/UxvxjgC+O7ibr3sUyA7Fx
TLSH
T1A8729E36D865AE37A8F7E6452A4AAB8BCFF444B250C16ED48DE85F0C46C76DD1302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Local State
Size 2KB
SHA256 15cd52a2db18bd77dda79bdf508ee49ea67c3fa54d0a18468461d3c75141ae07
MD5 3c0b212aa3f698d4c51dd61c3c909b78
SHA1 9ba17142c977971b95e0d08d8d2990c06ec1d3ef
SHA512 d18d76c043f9c12040424b37e76d2f6443b2bc8c2d2856a6d573afb34064dda3f16f2eda9468d1ace80467de332dbb2c0bf3ec2fa02acccaca0872de828c1fc3
TLSH
T13151B4336960AA37D9E7964479466B138F3260A1AA622F109ADC4B0C81D7ADC3302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Local State
Size 3KB
SHA256 cce88a363e167bb31c13b29b50373921a69aa2abfa536e4b11a34a447fa5a353
MD5 3625794f99d4af5aff4a05b231a98f22
SHA1 79baa6a10a8c4dee80c09954f887756ba5f84265
SHA512 8c26ddaf5f5e65250d124df340e3f6a9d021168842bd1a6f2c74d73d6aa9029b3985302d4cfd87bae609496026570c822dd50f61e773b14d2827fcde469eae27
TLSH
T10461A73369B0A93B8DF7DA0579862B06ABA15073E5927F54DAEC0F0C41D77D82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Local State
Size 15KB
SHA256 ad452a77cfec3d8ce62b94e3175b9115142797066b23f040c96883c842cce7a0
MD5 ff2ebfffa2a2ae7fd7603c0cb23327b1
SHA1 914f098fa886caff9803b83b68e4e501fcf6d4a4
SHA512 30aa6c298e2d812f2f47211330d052f46da6c06149ef4f741df3b9f59d9d6f67c13c7a78258d4fba9238e9d337784c7410c73a0beca6569a15d452c936e89dfa
SSDEEP 384:4+aQikB+z/xvxjg/qhE7NBSifVi5GsAVdpy1+79zx:3/UxvxjgC+h9iUsUyA7Fx
TLSH
T14972AE2795793E33A5F7FA0539594B8BCFB594B290C26EA84EF89F0D06C72D81302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Local State
Size 15KB
SHA256 866e2e8c6003120e5a2502539b200670497a1afa8ad507ce2347a11d5d6add74
MD5 d9b0e0952f45233afc097611e8243899
SHA1 056eb44ff8c6857c6039ab443042fbd7add90ca6
SHA512 3fc351380aa10cf22dd1018137f92eb37eb071f62b002148cbeba677e7fa1525e895632a2f2ed00495473177359c2e69e11ab1bd4a6fb730b06aa9f9a02781b2
SSDEEP 384:N+aQikB+z/xvxjg/qhEdNBSifVi5GsAVdpy1+79zx:Y/UxvxjgC+79iUsUyA7Fx
TLSH
T1F972AE2799793E33A5F7EA1539594B8BCFB594B290C16EA84EF89F0D06C73D81302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Local State
Size 17KB
SHA256 91ccb182109e73a2c7b917c7780bfb39b516c008fa3d13ca17d751cdc5ad9c71
MD5 4b08f28194898dd71811472310ba0983
SHA1 57d526d48d233a7e379d1d616334a5d9f485bf94
SHA512 12ef4db6fe8d377759f931ae712accebf8145928e528676565f107c56614867353e65f2755814aa57d042df5f49a417f55b13b998f6fb6fec2c1c88031018b7d
SSDEEP 384:L+aQikB+z/xvxjg/qhE+Nlic0yi5nI2mtf/sAVdpy1+79zx:q/UxvxjgC+1YiyP5/sUyA7Fx
TLSH
T126829E36D865AE23E8F7EA05265AA7CBCBF4447250C12ED88DE85F0D46C76ED1302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a665c.TMP

Path C:\Users\Admin\AppData\Local\com.max.gameclient\EBWebView\Local State~RFe5a665c.TMP
Size 1KB
SHA256 fb95fdf5ef2024c99c88ccf11dc7027b1621a4762be116201d00bf2c55c728b7
MD5 ca6d28e90b5e2d9af947f5c6b8b06ac7
SHA1 7591e5dda60f5d982a4d90b11006659b5928ae58
SHA512 8ed20e536091475b7b92b1cd4a28d19f286555e398d082676955f66432fe32b611fc4e4e3f833faa6591e77516b56bdcd0227fbf1d0f6c7f5956312f9fd3eca4
TLSH
T1292142B399A02B33ECD6A2862103AA571F2120B691128F0464DD8B2D86EB5DDB517836
MD5 SHA1 SHA512 TLSH

Submit Download

cache.yaml

Path C:\Users\Admin\AppData\Local\com.max.gameclient\ludusavi_config\cache.yaml
Size 305B
SHA256 baa2f9fe28fa209c562ca412a94a7df4d987c54561d9f66f97da6c5e717cb498
MD5 c130a2b7d6eaaa09a3ffc0ca914d34b4
SHA1 4b0f14486827784456c1e3eaa0d0a7f0514a027f
SHA512 77b963ad6b5f871541e13b2f8d753d66794ba2b154aff4691ef4fdc8ee26dbe9de87f2a8dca37dd5b363127e6416a9320bc1676e61c3458b15a6d81b3ff3ac63
TLSH
T1ADE07220A4B9B573CABA0A812122B6874270CD658372A8353E5C561A33C0224D1D2620
MD5 SHA1 SHA512 TLSH

Submit Download

config.yaml

Path C:\Users\Admin\AppData\Local\com.max.gameclient\ludusavi_config\config.yaml
Size 153B
SHA256 7fd055c224783651413e78ced591b13beb042fb6ce7d56b205754ec46d40775a
MD5 c1055c67078d22c68ed8103983d8e8cf
SHA1 2ac5559321f17d3a10530fe79779121d4b95f014
SHA512 611fb8e3b50ef978b3a92aa2c1c9ea3a960db6a61d8bbf4ff3818fd33afcfe4c3d38fa18fe4ff0b5707338be229ac935386bc6147d6eb756c966d0cde5244abf
TLSH
T124C08C86086E64E1AFD522C65026309F533EA9915106C40AAAF0618B36D66736130A34
MD5 SHA1 SHA512 TLSH

Submit Download

config.yaml

Path C:\Users\Admin\AppData\Local\com.max.gameclient\ludusavi_config\config.yaml
Size 1KB
SHA256 a0fdab7570beb120620e9b95a9c69f253af924eafbdb0fdfa98a52bc6c1a94e0
MD5 b9936bd1794c3627ce6c5d6bc0e5d383
SHA1 9ee53048345ccdf741f48dd2ca9d92cc0032ed5d
SHA512 202aea76612a3fa1c08dca436709324ec0e0af036cc91341ab699501d631e90f9d8ea2198018e358857c91daa5d2a0ecf0c7e43fceea95437d05c9e07af9ce66
TLSH
T14E219B035139117AE545923FAD27E55BB722EC43051A293CFF0E83A13F0262D95DAFD9
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

LibraryClient.exe

Path C:\Users\Admin\Desktop\LibraryClient.exe
Size 18.7MB
SHA256 d7d83edabe7b395153ea02c20920dca5538e7d8885ebb99ddb211f19521bb329
MD5 221fb0ecc53abbdf857d2f94a14960e7
SHA1 a098cfe8ad17a871d0e4620387d1b01942af57da
SHA512 d655ceb7dde5da4db3d817941ddba20b42c1844e28eddb3ed6d4bb8563f8277d6cacfe578d2cfe45aaa3b510876a69b404ad4984731654ffd874984c1623b9e5
SSDEEP 196608:rB7l5TCtWlSUKGgvFC9Ri+DPBUEr2pphgGvwQugZlqIvR:lHTCtWlSUKGgvFC9RikBjrggGIQugGI
TLSH
T1FB17F7217B5A99ACD05BC47483878AB24A3130DB0B35B9FF449492392F79BF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ludusavi.exe

Path C:\Users\Admin\Desktop\ludusavi.exe
Size 33.3MB
SHA256 5192fd1ef31b5718cdb787d3f41abdcca8682ba4cbad31812d44ca6630ec2c0c
MD5 9441df703eb3f77ba46b6e19710c9ac7
SHA1 e5ec1ccff6ea342a53c438fd873b587d0a3b3131
SHA512 bbabddc6397ee5403a3e7f8cf3b0d29593c0455ef6349aa670b034a95c68db12b803055ea2ece93efc362304acb3b53921b3bd88af549afb11ad609e532d587c
SSDEEP 196608:aa1arK96nUpdx4VuuJcCkU0DPJr1QWwVgubCODCJhEFbts8K:aa8rK9iUpGuuK+I9ubhDuEb
TLSH
T129773911BA9B99ADD06AC87083468A736F2134DB0B35B9FB44D446353F7EAF41B38718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall gameclient.lnk

Path C:\Users\Public\Desktop\Uninstall gameclient.lnk
Size 966B
SHA256 3e1533f78450d10ba9a428314bcd69dba3f79c542613054e2a5b567c01812227
MD5 a541ef2bcf9426b07cf109c562f0a5e5
SHA1 1d32821c75b1c1b9b6349a0f2c70c20a53d9f360
SHA512 f31683ff9e81666ad41aad23810cc15cd5a037b18184dc4bbb46de5eeac383251e268c78825db958a186f19f76a258fea98cd7a6ab8b8e7a345d45557b4dc057
TLSH
T12511F1050AE30BA1E2F14E7948BB97218771FC419E67CF2F12C8639A5911880FC2CD3E
MD5 SHA1 SHA512 TLSH

Submit Download

gameclient.lnk

Path C:\Users\Public\Desktop\gameclient.lnk
Size 1KB
SHA256 304c48c48b7aac72f19b31f51a7ce1adefff4b7b3c9444522b7dc0343e3afc81
MD5 18499cffa7195e0b5f309cd07fa14989
SHA1 637a680e894b64e17a34019eb0770bbfa2e3a87b
SHA512 ef1f6acb4616bfc62d0b9cdf1ccd0150b9ecc6e082408d47aece650212f4ca6959b197c1f62909e90b5f384aa076d0afc4d71b04e7b70ec23dbecf41894c6d2f
TLSH
T10B11DC0017EA3F12E2E58B73DDB2A3429631BD016F15DF1E4094924C0450B88AC68A3E
MD5 SHA1 SHA512 TLSH

Submit Download

e5a4557.msi

Path C:\Windows\Installer\e5a4557.msi
Size 19.4MB
SHA256 976f99adbeb33b1a68f8a44e89226b69e7d98b15fbdf0fd60ea55e9cd4bcd70c
MD5 1b9dd7a862dec4777a76846d65260afb
SHA1 2a818f7a5d546ca66c27f85abfea9ec43614e7e2
SHA512 5476dc3813ce256464416f34ad0ebad0722cf2943b2a8b6a0a6f3a812ce7aceeac59d9437b129dc07a0732c49149077c40af111ef62492299f5658e31a254c9d
SSDEEP 393216:J9p+LgBCaXiolUGuwFL208NZNo+UhB0ln6VzeltqxTUk0CnbuE:J9jBCaSQUgFqh++Uh86VzCqPxnb
TLSH
T1462733577FC0C623D22B1E75D83D97A0895C3D242995588316A8372DEBF32D23A70BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 deefb0fea54a99d1866af5a4e6ac98631fea6cb031a55593c4e362ce89ef5892
MD5 72edc7628070e2d409245de995ec0dc6
SHA1 318af975c9a33a95d35be2f41cef41caf79633d6
SHA512 0b945f0eae767b5fdea69e6bda3468360d09a1b615ac21bedc9e2063879847425bc6df0b23436c7537c966f45b7dc662de08f352fdfe431fcc8ef2aa3e8306ce
SSDEEP 24576:pFo3DMPgdoO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+0:sHg
TLSH
T19657E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{fbb212d8-37f7-4df0-98fa-e2e4bae53acf}_OnDiskSnapshotProp

Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{fbb212d8-37f7-4df0-98fa-e2e4bae53acf}_OnDiskSnapshotProp
Size 6KB
SHA256 22e4af8fd2f578f649736664a1ae7768c6a22429edb847cdb0fbc36a3fb03cd3
MD5 f58915427250a940f46281d357881283
SHA1 47570ef08e7ad1c8b6b47028a52ca8c5c9aff48f
SHA512 d86340e377a91cc8d6fd2aa2b283c7f5336a36b8fdd62e042f0bc2178a9541c16e53cdf73a83ca2f032fd54e592823053b6e9f025707595ecc87c52c26a1d668
SSDEEP 96:F+kSQmOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Ykvb++uVm
TLSH
T155D188181AF54711E2B3AB3128F18557A877B911FF33CB8E0198238E6631910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-328-0x00007FFBF97C0000-0x00007FFBF97C1000-memory.dmp

Download

memory/2444-327-0x00007FFBF8840000-0x00007FFBF8841000-memory.dmp

Download

memory/2832-1532-0x000001F224A60000-0x000001F225404000-memory.dmp

Download

memory/2832-45-0x000001F224A60000-0x000001F225404000-memory.dmp

Download

memory/3268-377-0x0000029BEC860000-0x0000029BEC882000-memory.dmp

Download

memory/3268-381-0x0000029BEC8F0000-0x0000029BEC9A2000-memory.dmp

Download

memory/3268-384-0x0000029BECE70000-0x0000029BECE94000-memory.dmp

Download

memory/3268-383-0x0000029BECE70000-0x0000029BECE9A000-memory.dmp

Download

memory/3268-380-0x0000029BEC8D0000-0x0000029BEC8EE000-memory.dmp

Download

memory/3268-382-0x0000029BECBC0000-0x0000029BECBCA000-memory.dmp

Download

memory/4132-773-0x0000022DD41F0000-0x0000022DD41F1000-memory.dmp

Download

memory/4132-771-0x0000022DD41F0000-0x0000022DD41F1000-memory.dmp

Download

memory/4132-770-0x0000022DD41F0000-0x0000022DD41F1000-memory.dmp

Download

memory/4132-775-0x0000022DD41F0000-0x0000022DD41F1000-memory.dmp

Download

memory/4132-774-0x0000022DD41F0000-0x0000022DD41F1000-memory.dmp

Download

memory/4132-766-0x0000022DD41F0000-0x0000022DD41F1000-memory.dmp

Download

memory/4132-764-0x0000022DD41F0000-0x0000022DD41F1000-memory.dmp

Download

memory/4132-772-0x0000022DD41F0000-0x0000022DD41F1000-memory.dmp

Download

memory/4772-1766-0x000001D0EF560000-0x000001D0EF580000-memory.dmp

Download

memory/4772-1789-0x000001D0FFFE0000-0x000001D100000000-memory.dmp

Download

memory/4772-1756-0x000001D0FF760000-0x000001D0FF860000-memory.dmp

Download

memory/4772-1755-0x000001D0EF300000-0x000001D0EF320000-memory.dmp

Download

memory/4772-1743-0x000001C8EAB60000-0x000001C8EAC60000-memory.dmp

Download

memory/4772-1744-0x000001C8EAB60000-0x000001C8EAC60000-memory.dmp

Download

memory/4772-1745-0x000001C8EAB60000-0x000001C8EAC60000-memory.dmp

Download

memory/5268-92-0x00007FFBF8110000-0x00007FFBF8111000-memory.dmp

Download

memory/5676-73-0x00007FFBF8110000-0x00007FFBF8111000-memory.dmp

Download