hxxps://userplatform-download[.]akamaized[.]net/official-website/pc-launcher-setup/Tiles[.]Survive[.]PC[.]V1[.]0[.]exe?clickcode=xgwbv44rke

Resubmissions

19/08/2026, 19:07

260819-xs3e4s1ejg8

19/08/2026, 19:06

19/08/2026, 19:03

19/08/2026, 18:56

19/08/2026, 15:42

19/08/2026, 04:21

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
899s
max time network
900s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/08/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://userplatform-download.akamaized.net/official-website/pc-launcher-setup/Tiles.Survive.PC.V1.0.exe?clickcode=xgwbv44rke
Sample260819-eyn6kaytax

Score

9^/10

bootkit defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	tspc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	tspc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	tspc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	tspc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	tspc.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	tspc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	tspc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	tspc.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	tspc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4724	powershell.exe
6208	Powershell.exe
6612	Powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
18	5472	msedge.exe
81	4660	Tiles.Survive.PC.V1.0_xgwbv44rke.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	tspc.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tspc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tspc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	tspc.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	TQMCenter_64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	PC-Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	tspc.exe

Executes dropped EXE 9 IoCs

pid	Process
4660	Tiles.Survive.PC.V1.0_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
7336	Launcher.exe
7356	PC-Launcher.exe
7312	UacLauncher.exe
7344	tspc.exe
7656	UnityCrashHandler64.exe
8384	TQMCenter_64.exe
8040	NEPKernel.sys

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\SOFTWARE\Wine	tspc.exe

Loads dropped DLL 59 IoCs

pid	Process
3756	ts_xgwbv44rke.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
8384	TQMCenter_64.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
5512	msedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ts_global = "\"F:\\FunPlus\\Tiles Survive\\Launcher.exe\""	ts_xgwbv44rke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ts_pc_global = "F:\\FunPlus\\Tiles Survive\\Launcher.exe"	PC-Launcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	ts_xgwbv44rke.exe
File opened (read-only)	\??\F:	PC-Launcher.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	tspc.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	tspc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	tspc.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1059199783\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Social	msedge.exe
File opened for modification	C:\Windows\NEPDriver.info	tspc.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1182842141\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_330567672\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_445389528\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1059199783\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1256260439\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1059199783\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1182842141\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_445389528\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1059199783\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1182842141\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_330567672\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1256260439\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_1182842141\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Cryptomining	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tiles.Survive.PC.V1.0_xgwbv44rke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ts_xgwbv44rke.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5472	msedge.exe
4624	msedge.exe
7568	chrome.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Tiles.Survive.PC.V1.0_xgwbv44rke.exe
Key opened	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tspc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	tspc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	tspc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Tiles.Survive.PC.V1.0_xgwbv44rke.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tspc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315868872670404"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx\shell\open\command\ = "F:\\FunPlus\\Tiles Survive\\Launcher.exe %1"	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx\DefaultIcon	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx\DefaultIcon\ = "F:\\FunPlus\\Tiles Survive\\Launcher.exe"	Launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{10344FDE-F872-4399-B176-6094E353386B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{BFCC6BDB-B02A-4265-99BD-523C4B3DB76E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx\ = "URL:worldx Protocol"	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx\shell\open\command	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx\shell	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx\shell\open	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\worldx\URL Protocol	Launcher.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	tspc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	tspc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54367e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1556200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c70161090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	tspc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3756	ts_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
940	wmic.exe
940	wmic.exe
940	wmic.exe
940	wmic.exe
3520	Powershell.exe
3520	Powershell.exe
4724	powershell.exe
4724	powershell.exe
3520	Powershell.exe
4724	powershell.exe
1588	Powershell.exe
1588	Powershell.exe
1588	Powershell.exe
6208	Powershell.exe
6208	Powershell.exe
6208	Powershell.exe
6612	Powershell.exe
6612	Powershell.exe
6612	Powershell.exe
6804	Powershell.exe
6804	Powershell.exe
6804	Powershell.exe
6964	wmic.exe
6964	wmic.exe
6964	wmic.exe
6964	wmic.exe
7032	wmic.exe
7032	wmic.exe
7032	wmic.exe
7032	wmic.exe
7108	wmic.exe
7108	wmic.exe
7108	wmic.exe
7108	wmic.exe
5512	msedge.exe
5512	msedge.exe
584	msedge.exe
584	msedge.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	940	wmic.exe
Token: SeSecurityPrivilege	940	wmic.exe
Token: SeTakeOwnershipPrivilege	940	wmic.exe
Token: SeLoadDriverPrivilege	940	wmic.exe
Token: SeSystemProfilePrivilege	940	wmic.exe
Token: SeSystemtimePrivilege	940	wmic.exe
Token: SeProfSingleProcessPrivilege	940	wmic.exe
Token: SeIncBasePriorityPrivilege	940	wmic.exe
Token: SeCreatePagefilePrivilege	940	wmic.exe
Token: SeBackupPrivilege	940	wmic.exe
Token: SeRestorePrivilege	940	wmic.exe
Token: SeShutdownPrivilege	940	wmic.exe
Token: SeDebugPrivilege	940	wmic.exe
Token: SeSystemEnvironmentPrivilege	940	wmic.exe
Token: SeRemoteShutdownPrivilege	940	wmic.exe
Token: SeUndockPrivilege	940	wmic.exe
Token: SeManageVolumePrivilege	940	wmic.exe
Token: 33	940	wmic.exe
Token: 34	940	wmic.exe
Token: 35	940	wmic.exe
Token: 36	940	wmic.exe
Token: SeIncreaseQuotaPrivilege	940	wmic.exe
Token: SeSecurityPrivilege	940	wmic.exe
Token: SeTakeOwnershipPrivilege	940	wmic.exe
Token: SeLoadDriverPrivilege	940	wmic.exe
Token: SeSystemProfilePrivilege	940	wmic.exe
Token: SeSystemtimePrivilege	940	wmic.exe
Token: SeProfSingleProcessPrivilege	940	wmic.exe
Token: SeIncBasePriorityPrivilege	940	wmic.exe
Token: SeCreatePagefilePrivilege	940	wmic.exe
Token: SeBackupPrivilege	940	wmic.exe
Token: SeRestorePrivilege	940	wmic.exe
Token: SeShutdownPrivilege	940	wmic.exe
Token: SeDebugPrivilege	940	wmic.exe
Token: SeSystemEnvironmentPrivilege	940	wmic.exe
Token: SeRemoteShutdownPrivilege	940	wmic.exe
Token: SeUndockPrivilege	940	wmic.exe
Token: SeManageVolumePrivilege	940	wmic.exe
Token: 33	940	wmic.exe
Token: 34	940	wmic.exe
Token: 35	940	wmic.exe
Token: 36	940	wmic.exe
Token: SeDebugPrivilege	3520	Powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	1588	Powershell.exe
Token: SeDebugPrivilege	6208	Powershell.exe
Token: SeIncreaseQuotaPrivilege	6208	Powershell.exe
Token: SeSecurityPrivilege	6208	Powershell.exe
Token: SeTakeOwnershipPrivilege	6208	Powershell.exe
Token: SeLoadDriverPrivilege	6208	Powershell.exe
Token: SeSystemProfilePrivilege	6208	Powershell.exe
Token: SeSystemtimePrivilege	6208	Powershell.exe
Token: SeProfSingleProcessPrivilege	6208	Powershell.exe
Token: SeIncBasePriorityPrivilege	6208	Powershell.exe
Token: SeCreatePagefilePrivilege	6208	Powershell.exe
Token: SeBackupPrivilege	6208	Powershell.exe
Token: SeRestorePrivilege	6208	Powershell.exe
Token: SeShutdownPrivilege	6208	Powershell.exe
Token: SeDebugPrivilege	6208	Powershell.exe
Token: SeSystemEnvironmentPrivilege	6208	Powershell.exe
Token: SeRemoteShutdownPrivilege	6208	Powershell.exe
Token: SeUndockPrivilege	6208	Powershell.exe
Token: SeManageVolumePrivilege	6208	Powershell.exe
Token: 33	6208	Powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
7356	PC-Launcher.exe
7344	tspc.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
7356	PC-Launcher.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe
1764	chrome.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4660	Tiles.Survive.PC.V1.0_xgwbv44rke.exe
3756	ts_xgwbv44rke.exe
7336	Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7356	PC-Launcher.exe
7312	UacLauncher.exe
7344	tspc.exe
7656	UnityCrashHandler64.exe
7344	tspc.exe
7344	tspc.exe
7344	tspc.exe
8384	TQMCenter_64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4936	5036	msedge.exe	82
PID 5036 wrote to memory of 5472	5036	msedge.exe	83
PID 5036 wrote to memory of 4964	5036	msedge.exe	84
PID 5036 wrote to memory of 4964	5036	msedge.exe	84
PID 5036 wrote to memory of 4964	5036	msedge.exe	84
PID 5036 wrote to memory of 5924	5036	msedge.exe	86
PID 5036 wrote to memory of 5924	5036	msedge.exe	86
PID 5036 wrote to memory of 1328	5036	msedge.exe	87
PID 5036 wrote to memory of 908	5036	msedge.exe	88
PID 5036 wrote to memory of 1328	5036	msedge.exe	87
PID 5036 wrote to memory of 1328	5036	msedge.exe	87
PID 5036 wrote to memory of 908	5036	msedge.exe	88
PID 5036 wrote to memory of 908	5036	msedge.exe	88
PID 5036 wrote to memory of 4720	5036	msedge.exe	91
PID 5036 wrote to memory of 952	5036	msedge.exe	92
PID 5036 wrote to memory of 4720	5036	msedge.exe	91
PID 5036 wrote to memory of 952	5036	msedge.exe	92
PID 5036 wrote to memory of 5624	5036	msedge.exe	93
PID 5036 wrote to memory of 3836	5036	msedge.exe	94
PID 5036 wrote to memory of 5624	5036	msedge.exe	93
PID 5036 wrote to memory of 3836	5036	msedge.exe	94
PID 5036 wrote to memory of 3836	5036	msedge.exe	94
PID 5036 wrote to memory of 5996	5036	msedge.exe	95
PID 5036 wrote to memory of 3392	5036	msedge.exe	99
PID 5036 wrote to memory of 3952	5036	msedge.exe	110
PID 5036 wrote to memory of 2164	5036	msedge.exe	111
PID 5036 wrote to memory of 1912	5036	msedge.exe	112
PID 5036 wrote to memory of 4948	5036	msedge.exe	113
PID 5036 wrote to memory of 4948	5036	msedge.exe	113
PID 5036 wrote to memory of 3252	5036	msedge.exe	114
PID 5036 wrote to memory of 5244	5036	msedge.exe	115
PID 5036 wrote to memory of 5244	5036	msedge.exe	115
PID 5036 wrote to memory of 5244	5036	msedge.exe	115
PID 5036 wrote to memory of 4112	5036	msedge.exe	117
PID 5036 wrote to memory of 5948	5036	msedge.exe	118
PID 5036 wrote to memory of 5948	5036	msedge.exe	118
PID 5036 wrote to memory of 4160	5036	msedge.exe	119
PID 5036 wrote to memory of 4160	5036	msedge.exe	119
PID 5036 wrote to memory of 4160	5036	msedge.exe	119
PID 5036 wrote to memory of 4660	5036	msedge.exe	120
PID 5036 wrote to memory of 5512	5036	msedge.exe	122
PID 5512 wrote to memory of 4560	5512	msedge.exe	123
PID 5512 wrote to memory of 4624	5512	msedge.exe	124
PID 5512 wrote to memory of 4664	5512	msedge.exe	125
PID 5512 wrote to memory of 4664	5512	msedge.exe	125
PID 5512 wrote to memory of 4664	5512	msedge.exe	125
PID 5512 wrote to memory of 5720	5512	msedge.exe	126
PID 5512 wrote to memory of 5720	5512	msedge.exe	126
PID 5512 wrote to memory of 5932	5512	msedge.exe	129
PID 5512 wrote to memory of 3572	5512	msedge.exe	132
PID 5512 wrote to memory of 3572	5512	msedge.exe	132
PID 5512 wrote to memory of 2820	5512	msedge.exe	133
PID 5512 wrote to memory of 2820	5512	msedge.exe	133
PID 5512 wrote to memory of 5864	5512	msedge.exe	134
PID 5512 wrote to memory of 5864	5512	msedge.exe	134
PID 5512 wrote to memory of 5008	5512	msedge.exe	135
PID 5512 wrote to memory of 5008	5512	msedge.exe	135
PID 5512 wrote to memory of 4368	5512	msedge.exe	136
PID 5512 wrote to memory of 4368	5512	msedge.exe	136
PID 5512 wrote to memory of 2644	5512	msedge.exe	137
PID 5512 wrote to memory of 3536	5512	msedge.exe	138
PID 5512 wrote to memory of 2644	5512	msedge.exe	137
PID 5512 wrote to memory of 3536	5512	msedge.exe	138
PID 4660 wrote to memory of 3756	4660	Tiles.Survive.PC.V1.0_xgwbv44rke.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://userplatform-download.akamaized.net/official-website/pc-launcher-setup/Tiles.Survive.PC.V1.0.exe?clickcode=xgwbv44rke
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff911abc188,0x7ff911abc194,0x7ff911abc1a0
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,17604288944634544346,1602422708709343144,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6251205628885970305,1503691185111705614,262144 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,14059708889736543839,7749209878768694521,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,342605459874123526,17722992715220995968,2097152 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,1988797516115425664,10673980761802786536,2097152 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,2667009823396888788,3464245155138616957,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,860277610488943487,5482707980408599419,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,7192309372736616102,13187568231836040557,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5720,i,3769670845858039822,1080864966692029937,2097152 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,14894418272707168585,840837981700521606,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,9620796354691217952,16961328264190648203,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,9620796354691217952,16961328264190648203,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,16649243389464754377,13550619080267661972,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,11862949404462920895,7058309626637103909,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,4509863767492772236,16118577027628477557,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,13834420301703016593,2802358971088470152,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6740,i,13231365994017911353,16307585720918653035,262144 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4796,i,1823053587819873323,222253674599319504,2097152 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,2787836804713902327,14509639563627690154,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,2787836804713902327,14509639563627690154,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,5879160779573350004,5267320386906462337,524288 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3352,i,13808887354757873564,16250707829242712846,2097152 --field-trial-handle=2136,i,5842102518557010518,17208277776346074336,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4160
- C:\Users\Admin\Downloads\Tiles.Survive.PC.V1.0_xgwbv44rke.exe
  "C:\Users\Admin\Downloads\Tiles.Survive.PC.V1.0_xgwbv44rke.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\ts_xgwbv44rke.exe
    C:\Users\Admin\AppData\Local\Temp\ts_xgwbv44rke.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3756
  - - F:\FunPlus\Tiles Survive\Launcher.exe
      "F:\FunPlus\Tiles Survive\Launcher.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:7336
    - - F:\FunPlus\Tiles Survive\1.0.0.1285\PC-Launcher.exe
        
        "F:\FunPlus\Tiles Survive\1.0.0.1285\PC-Launcher.exe" --currentPath="F:\FunPlus\Tiles Survive" --configVersion=1.0.0.1285 --launchExe="F:\FunPlus\Tiles Survive\Launcher.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:7356
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic OS get Version /VALUE
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
      - C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
        
        Powershell.exe "Get-WmiObject win32_VideoController | fl *"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command get-wmiobject Win32_volume | select Name,Freespace,Capacity
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4724
      - C:\Windows\System32\net.exe
        
        C:\Windows\System32\net.exe use
        6⤵
        
        PID:3560
      - C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
        
        Powershell.exe "Get-WmiObject win32_desktopmonitor | fl *"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
      - C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
        
        Powershell.exe "Get-CimInstance -Namespace root\WMI -ClassName WmiMonitorBasicDisplayParams | fl"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6208
      - C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
        
        Powershell.exe "Get-CimInstance -Namespace root\WMI -ClassName WmiMonitorConnectionParams | fl"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6612
      - C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
        
        Powershell.exe "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6804
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic CPU get Architecture, DataWidth, Manufacturer, Name, NumberOfCores /VALUE
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6964
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic OS get FreePhysicalMemory /VALUE
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7032
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic ComputerSystem get TotalPhysicalMemory /VALUE
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7108
      - F:\FunPlus\Tiles Survive\1.0.0.1285\UacLauncher.exe
        
        "F:\FunPlus\Tiles Survive\1.0.0.1285\UacLauncher.exe" --cmd=addFireW --name=TilesSurvive! --param=RjpcRnVuUGx1c1xUaWxlcyBTdXJ2aXZlXG5nYW1lXDIuNS44MDAuMjA0XHRzcGMuZXhl
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7312
      - F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tspc.exe
        
        "F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tspc.exe" --index=0 --gameid=8612
        6⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Looks for VirtualBox Guest Additions in registry
        Looks for VMWare Tools registry key
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Checks system information in the registry
        Drops file in Windows directory
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:7344
        
        F:\FunPlus\Tiles Survive\ngame\2.5.800.204\UnityCrashHandler64.exe
        
        "F:\FunPlus\Tiles Survive\ngame\2.5.800.204\UnityCrashHandler64.exe" --attach 7344 3040250826752
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7656
        
        F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tqm64\TQMCenter_64.exe
        
        "F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tqm64\TQMCenter_64.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:8384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tqm64\stm\"
        8⤵
        
        PID:8900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tqm64\stm\"
        8⤵
        
        PID:4452
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic cpu get processorid
        7⤵
        
        PID:8960
        
        C:\Windows\SYSTEM32\nslookup.exe
        
        nslookup ir-sdk.guardease.com
        7⤵
        
        PID:8968
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic bios get serialnumber
        7⤵
        
        PID:8128
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic csproduct get UUID
        7⤵
        
        PID:6048
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic nicconfig where (IPEnabled=TRUE) get DefaultIPGateway
        7⤵
        
        PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff911abc188,0x7ff911abc194,0x7ff911abc1a0
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,18285971909547189484,4376029954271019606,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,12467689413638242992,16322101448038540414,262144 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,5994006689205216866,15757359439372524298,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,9743537706227956930,1711167444344272204,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,9743537706227956930,1711167444344272204,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,7670650777856061034,3362834138027404492,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,10201358485931699908,5374316556491900769,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,2168904913656075893,4517782888941975707,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,13970179077457641859,12733493095399157621,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1665874075536691628,14218526708299097089,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,12467613263097326356,10016278790920629850,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9471318740554124932,6975070401919276971,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,12318296642819884058,15691304842666680216,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,11752856561339614730,6284714005180218055,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,138529520992466035,14612339294609113246,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,17137302713821238500,6897636664968457038,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4624,i,18260303467370670600,4616448664900800536,262144 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,5438648533885031286,13315534489502783420,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
    3⤵
    PID:9736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,1152133349387018553,2068063025360064091,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,8288566232699751186,1660518630287866470,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1076,i,4168464165559693345,4404182325216546448,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8007548636561349523,136575585099426011,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,13811080208129191549,12024877991822787200,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
    3⤵
    PID:8968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,7805174357615789107,15700967818753251684,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
    3⤵
    PID:8604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,5917179371772662647,7288973776714093724,524288 --field-trial-handle=2272,i,2067536692744571232,16605433348985635032,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4132

F:\FunPlus\Tiles Survive\ngame\2.5.800.204\NEPKernel.sys
"F:\FunPlus\Tiles Survive\ngame\2.5.800.204\NEPKernel.sys"
1⤵
- Executes dropped EXE
PID:8040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff8ff3dc728,0x7ff8ff3dc734,0x7ff8ff3dc740
  2⤵
  PID:9732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,10464525309018213815,13110944271924673623,524288 --field-trial-handle=2040,i,8019627453465620757,10444444218091287559,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1688 /prefetch:3
  2⤵
  - System Time Discovery
  PID:7568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1784,i,8637160674781928036,4069827731992484626,262144 --field-trial-handle=2040,i,8019627453465620757,10444444218091287559,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,1813688557867867171,13947083701306349192,524288 --field-trial-handle=2040,i,8019627453465620757,10444444218091287559,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,6321380954729929754,2642372067919871696,2097152 --field-trial-handle=2040,i,8019627453465620757,10444444218091287559,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:7540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,3856180587949740747,5712474768152136970,2097152 --field-trial-handle=2040,i,8019627453465620757,10444444218091287559,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:6544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,17388211538923899350,17707128695992412916,2097152 --field-trial-handle=2040,i,8019627453465620757,10444444218091287559,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4624,i,12442262374566549725,5562231214797068182,2097152 --field-trial-handle=2040,i,8019627453465620757,10444444218091287559,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:7224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,12008884415116185485,2937899948928847710,524288 --field-trial-handle=2040,i,8019627453465620757,10444444218091287559,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:5976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

isc.dat

Path C:\ProgramData\NeteaseWinDev\isc.dat
Size 216B
SHA256 ac0edf0fcb480b402cc574427bb90bdc876a944e92be6389f562a8ed847eae1a
MD5 795b45a2f6c23326ac98ff44ddc8ab93
SHA1 dab0cf2f5798c3eb698511b2d5ab7d621d5ef9cd
SHA512 4f32e1b987748ca1e20d231b64e713ff85cbcefb7c1b2f45e7fdab7eab06ed73f8cdb9ada65eb4c1f5b38eecb24b357495fcfa7e5bf34ab7ff99a4e81c589662
TLSH
T158D0236D15BD8915D1D17A33D7CB879414D1DC842B57D0573B1167D16C975574001111
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 744923011c12eeb3d6fce03da71f15385684bae0ce9b4ca0f2744d6b1734a2b6
MD5 7d007db157531a6cc5c146571051e142
SHA1 acc948c82a72504c812987cfe0f7863f4580565e
SHA512 03f611d76e32029e739a16cc7bf9e69136d97cd4ee00aea9d6aa9339e279819f7d7be3f643c5e57667f77fa921aabc316e26c0a647b304395472cd7351464d5d
TLSH
T187E022B9C821A93B18F80B2D51444286F70023AB2A90495F3A3DC20E8FB173A41C696C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bc600174bf8606f36020bb899903a0d1e147f735e6c78fe0afa15046e2e69646
MD5 54e5566a8eb3dd640fa620ff22d00a6f
SHA1 da97ff0c07ca6d95001f15b8b3aa6f2f3c032c78
SHA512 bacf85ab5dbef7880d2aae29b747678d7c8f7bd1b92a4ce19e564aea7ae3327c397258a34f3632ddab99a9bdc0651139ef83bb419fe7c145125ff98f76178fc8
TLSH
T1CA418FF7C3E8997DC90092F4EB196F1FCE690A14532C3C56C8D4AE1B53E28B1E24064E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f237f6cbfdd696e2e621485022058c9cf48d5e205f99442a10ef18e85d6d4488
MD5 eab229a500e4e6bd8441702436d273cc
SHA1 d147579435f840ce297303b4ed617d0d641b77b4
SHA512 97a51073831a379a7334f7b44760b61ba7e155e642927f503f6d3eed882df1177401b411240f81d8cbe5cc054a34b802f3b4dbafd19002b52b4d08aceab69735
TLSH
T1FEF05057976D746700B945AE1D0AB80928B5B431024058F4CEAB825CE1914E31B15833
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b32506a3bc5cff27055b42661322a392cbfa5d62acb30005114cdc385a94f4a9
MD5 303d6c0ff07ce04fefa0f1be31002a06
SHA1 2eec505557803ef1d4718503e27af5c6c50dd11d
SHA512 b7e7f32915d9a87779294aa8541b822ca93c98b81d0886928096b4fa64946d40f7054f62cb4183310df1a8de82b848408541d4865cbd3ffc7c0217ea5d8714d9
SSDEEP 192:rR2pnrVeKYrOv7dpAPRp2c97Hsb+WNnsS0sIkla2rbM964PyIsnAUgtaJ:rR2pshrq5UXDdwB0sxla2Py8
TLSH
T14C42C72EBD20753B9CDAD229FA267B53D7F5203121942E88E6FC892C25E75CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6646989bfcb5c97513acdde7bf1e6a934ad9e4a758723746e8ad756689192b52
MD5 a53b398127eef947fb45f97818cbc504
SHA1 feb83c16e01a91151075652e72c375abfdb60d64
SHA512 7d4597211aa3b5d84a9750798703e7119d689c2b5783eba16dc6b3a7fad248d1392de105073b4174c487374230945692a752279764d5846cd7995ff455d202cc
SSDEEP 384:UOjwL7KxkXqKf/pUZNCgVLH2Hfgsl5T7pLuLcSjGHXODwn+ErU3uZHG29t8OPHu:U+wL7KxkXqKf/pUZNCgVLH2Hfgs3T7pe
TLSH
T16772F8A76C4C9E370FD8C5CCD82A7B4FADB5024B65E9886482FA581903D5BDB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b78f3ea637a8d55e47870a8f64377383dab7168dce1420e0a2ac3659b0bbf21a
MD5 e0756c4d019ee830c3963085fe62b368
SHA1 160c7da751ada89a7fbb90eef9aac0e0e387b7e3
SHA512 daf1db4c2720f06cd262b37eccdc482d987335cec213d2e96b4d53e1c91c7e3e57f7009776a010f00eac50698de08a45caa4a60711d40fd47b2caa1492d9ffab
TLSH
T188B01200C4416101C00302B4221254ADB1049F10D50D173153E47E7788254618015091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe60a31a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe60a31a.TMP
Size 96B
SHA256 09b5f9bb76b739aceb7c841b43754a5829c73c1d30839194a15ef99e038fcf7c
MD5 649d67238350fb5ee11d807e09e64422
SHA1 7ac65c2ca26b017d2533fca1199adf7528e12cbb
SHA512 288facb6f3b46a969a2abd0eb3c2806d1aaa5d98f4e32697a50ecc009cb16dcee4c5f57c69245c3914aae511a0cfcc4820892fe0354de0cd16f35ae2de53c4e5
TLSH
T187B0025DC1037313C44203F029EDB5E971A4DF65C60B932BD2F11A7BEE66A604565561
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 09f90ccb7496058e74ff3561a56e6d110f26fa8e4447088a49f8bcbd8a4eda9b
MD5 54a0d47f5d2e15a3c8913be96cd6c884
SHA1 d847b2a2d439df1cfde95ddabf2b6949efbd1d25
SHA512 6939b92603a7b12980c4042b78e86457976df36b276b5e193045dca3d3817927920381d42200ecb5fd4e23fb73d1f8b7c33d41da96d0bc41ba3146143cbf2621
SSDEEP 192:epCKvRHCw95fiUDOLPN++8rSrM4kU0oUJtp:+CKZHCUfS1+hr14D6Jf
TLSH
T1B1E108B6E879AD2355B79789F4072B03CEB4A0EB96505E98DED64F0E12D71DC1303532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ef23249b409d4ee10cf29911b62f5c2e949579499c2ecaafb02845c640c12e59
MD5 95aa46ba24b0737de32b28d68439a789
SHA1 952c1ebe591022e78802ecc9a4601c5e04b69a61
SHA512 715c1516b5c8f16635e18cdd8dd22adc6877d51fafe78f5fb0cb94e35db8ef94a7d9f4a47c29c1d0518d708af002edb0b8fdfe0cbda5829fd080bffb1982a0bf
SSDEEP 96:eNC0d++nHQU0Ttfy95z4CRDotok5Ds0D1B6PJGyvyL9QNZHBC1Zwh11a:eNC0RHCw955DUDPLo0N9QNZHBC1q1s
TLSH
T1EFB1FAB6D8699C77167B85C9F5066B06CFB8F0EBE5609E889DDD0F0D11EB0E82302532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsSafeSeedV1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSafeSeedV1
Size 82KB
SHA256 3b2059d556586e1cffb5a141840a9b32862a0956256dbbb40d0824028902ebd1
MD5 dbca12af9873dd38d115ae011809721d
SHA1 01ffafb0bd12220083fe84b2f65e7b10eecf23b5
SHA512 f499698303c5205babe1e5e48a3792148f75b529797ba791136ede0314ccbeffddce3bd7d00fbc85fe74eb9b5678c38907a9d53946a270f0725a4861ed3d7bb0
SSDEEP 1536:5BzC3sTcZgFCIs80t11mKKujY8Y7p3XS9fVgk4HPOTYf:5BzqZVIotF1/Y7JC99juPl
TLSH
T19783120A77F40B99B10DAC9B36D1EA191EDB3C02B2DDE3D90E85196C41885C1FD87AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV1
Size 92KB
SHA256 9dd6b7a881cc6d4b17ee715a3853ac166bc1a0751fa3ac8291b12efdd9ce4669
MD5 49232949d4caf0b9c2419c868ef40b61
SHA1 3629e846ceb8f5e4577ceef40b34af191663cafa
SHA512 7356eb342aef474f32dca0b0a70a341a9acb8e6e4f6c4cbec99422345f4f6592a55dff340e804931aaeaa93c8b59b04b98d86d95060b77811d2841802d9cb760
SSDEEP 1536:xOwbb+uPpwXMg77EPJOAUKqDf5MskLelue4PmOoESAPhCqYGWIsTKn3E1UK3u3Dd:cwbb++p10AUKkhMskLeBbES/tTKn3se5
TLSH
T19693125A6CAE7BC7672AFAC3363A9EB500E7C0676F4DC1745828104AC47BE0B6811BD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ec696bb79c18c05aecd4e0e5330331bd3f3d23bbb125ceb0e60d41e9407669a
MD5 3ae0d2a3cea6db98c33674243956c594
SHA1 28d533ac9f6fe415ca54bb8b8b9fd19c5e0cfcf3
SHA512 b2b19a7b580d31253f0916de86ac6cb4dae2a0ced321b2affb1a8d395fe1cd7a4952a89825574854e5e34c20900bcab005c983205ba966cc1c67c849b7d93753
TLSH
T1CDD02376271BB415F33D5175D5038751179E44613E725313F118C40E8B791F643C21C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 efeb13e1ace754ec8198a0de807118ec4f48797168712e89e362ad4e56668d31
MD5 1c48228a2fb252eab6cee7a5bfbfaa4f
SHA1 23848ca0c6e9de779fc9db068d2dad9282d2f5ba
SHA512 61b691f255290bde04fe150583479b1e8c167677974238fb6920b0a54514b2f80268ca088739664ffc87928858a30bf2ea2d8ee96226e117699d5946db4e3cee
TLSH
T194D023F87657F521E72D003558101761235E84713AB79373D069940F9B75165C3DB1C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aeec2cf2f914dda22e50097bd568e10d7ad575752e6e3dc0cfa1b89db6af7e9
MD5 75906a46a4a5e1f124fb401229c1750d
SHA1 10f9c6e237a0d9c9187941afd068514fde56ff42
SHA512 c2ed553b8449e882e099bf8436c56b9e2670d1eef4380501527e62dab412dffe491e9ab694b0096819d64ff8821909de430b55771b7b06a9dbfe29325b67d1c9
TLSH
T1FCD023F87507E521C61D003148105772775585B037775773D0AC500DAB70706C6DD2F6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f270d18aa7e7e691b3b3eb9c8a03060772bd8c244b47364bfe6ef14fb916ce87
MD5 85f40e24d7b52ccf9f4e0febc2d90479
SHA1 b51a81b9b9d5e404192335172fb3a97d0f627035
SHA512 e40f838e6aa1612794ecb69510a41643324ce136302de2c02edbc2c4fc2240c597522cfbdc214d5bd5a9876a709e074678b323a8c09e4b4acb162d5efefaeb83
TLSH
T174E0268827CEC26E9B50784B91784B0CC2803B8ED6CCF9CA1B8489C8F101080ABCF9B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b467f70322d3e368c924e3b7b6f79fe936a0ef681ca3e745433d1b6f3d5ad7dc
MD5 b822dc87e0e666407e50954bab6d0a34
SHA1 78af1e861c1537d242c1b0b6dd3b3026e6b7326c
SHA512 5dfd52c564c27f2c194fc47dbe0e4fdb4e318dd77c8fff32c70127d1bbb33e15c233ce06d32a5649170a46ae6cf7532e2377f338d0f78c7b0b6a398bab113306
TLSH
T142E02BEDCA25AC3709FD175D64194746D70413172B80465F3A3D910DCFB163B1686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 2f099d1d64acd32dfeeff47e77c1799d535c8359ad3beec750129200629917ab
MD5 80315b9842eec8e414bfd73f3441ea4d
SHA1 019e7526d54a75fbeb523a20e6b86315099cc927
SHA512 f7e5b5c6d91415a7c692f3dc96262a61f7d809fb767f239dffa62d20086fa516b8d367016c064978f00315506a1e8169b59bb641a6f1365006634f2155d81228
SSDEEP 768:LJUtUUU5XEktGCDdAvzAicA1unK2d0xU:5XEkTdAEi6KhxU
TLSH
T14113D67DBE115CCACAD724BC694F1A72A37CC8FCD6D81397333A314676223AA491E941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4ef754b85acd247b6d30bea9ccbd21a644ec24c84c2bdb3a5667e68ccd7081e9
MD5 fd03d8851a01dc4e41f819f30f274b77
SHA1 a7258590bf0c105e9b9a199b6bab24492c55225f
SHA512 3673a0da030fdbb8d0fa5676c8007a65ddf56a00477449e59fef688443f7454f8cca0726d99a17461595281037dcf5d3ba029af2355d58cdf6494aa9577d8852
SSDEEP 3072:PL/IL/Y9YQLC3reSpvJ8L/iL/MGBmow9d3thvAkxf:PL/IL/Y9YQLgH8L/iL/c3/vJ
TLSH
T1BC445EF70D51A05BCFA802F5E2033A3DD177056D6CE1F9E9E67C0C952825B22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 6662acb72df23c65a674631a4ae1293308afe0d5b5c15f18ed7130ece56d1fb6
MD5 34dad478c7e4a4b591e4aaf20197e6ad
SHA1 056d48ea3993cf1fb3a7b85083dbadee017ea5f1
SHA512 81e2b1b5ed6a1da9bfda8b3264b6634ee6e4ecaafcf54e62d341cb7e368e10db5605d22e9e5cf9d9deda3c44ea2fcac353d23b314100cdce8a61bc23fb46b48b
SSDEEP 3072:eDfTkmBH7SuFqHljmkvV4lk0cUASifPjrZd5m01IEhrnUnkoO:yfYmN3KlUABfPpd59VRUn
TLSH
T1E62507EECB682C82CE6B8774B0E0D9077E712183B69DC0D39944C5D897D6B8175E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 faeb93b5282650103fdb99b2f49af11fb6b7a7589ab33e210adc59da4aa3a5ea
MD5 6e148160a7f67b3f0511a4e7397bba15
SHA1 5407907b11fb64137c0bb52ca597294e4dcc717f
SHA512 2b8eb1faf67bd368a106c9ffc2c47d393a689d4e2f9548d3eddabb5685956281176268109163047abc49b1654081447ac04ff79e9191133d903172a34e24407e
SSDEEP 49152:WYePm7HLIk8q6OWCak12PaiyiwUVLRHth37:W27HLIk8it2ywtVnZ
TLSH
T193867DEDCA6898C3CD639970B0F0E9877C7413C3F595C1D6889CC684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 994KB
SHA256 9291efc73f2934976ca8e2dba4f55f64dfd2a4bc0fd4d40e7a503f08566fd205
MD5 71bd4945f607a6458399361a8f9c39d3
SHA1 abada923c8bb6ac67763054f2240ad37799564a4
SHA512 dcd446a8673f3d397917f1a57c400114e62d95b0f3b8c9a676614384d4e3faf1bbf8c7b87438502b05e37bd1d9c489a5999181e9d3c24e6ea93a10223c75b45c
SSDEEP 24576:bT1Y2wIC2+6/JAGpzLy82/qYFEfp1kspqzir:bTm2NCP6/JAS3AfS1kiqz
TLSH
T10E25F122B990D073C5B320715355C7619EBDF93106169AC7A3D889A49F306E0EB3A7BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e822965c77f5c5e57955c82e5510696ad9d333995e798fa3cb5ea7c12eeecd26
MD5 31d10f7a853e9f0e8307fa224c424a87
SHA1 8bfce1cdf4ebe2a33abae8c0745a3546f4895b7f
SHA512 23476f7172fd8837f2ec6d6a35261772d1fc92da835aa45c24dbacbcaeef20a47f654c6b54bd919420859c28b48d326b7b1b7d57a31b31158d6c706c6031de6f
TLSH
T1A3714DD62DC644E0E379E13D21C6950838F986FE7E272E6176A0B835FAFD3215D1844A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 9a5e06d894e8f753cd5235293b747d16d3395be3337950cab71d663bbf260719
MD5 a101cf66a11ef09632e56bf0f075ef8b
SHA1 8335033b4b1dd634a223d7c589a00e157c38c354
SHA512 24958c8414948e1d38e5f55b6cabfa404399592184a18818cbb234f073eb347fc7b91f23fa97868272149c4ca0f29a005220aba3ae7c45f98b858a41d42989db
SSDEEP 3:MsEllllkEthXllkl2zELyH+llll:/M/xT02zJHa/l
TLSH
T1154404047FD00405CD0015354013D3700373D4500511D7C335515C375CC5D440C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 c43ea899ad5244a6805b34a9746a2ab8cf14f8c5c9b190bc1f85f5314a31f1b1
MD5 f77c571c9f77cdb517e164311349ea0b
SHA1 0510079ee3992c437d9cee474b54adbeef844969
SHA512 df66db26c94748936c4b5e6f1185a6b3378cb01b3b895a05e9624c359e0915002d455c9bfbd2056bfb685f4e1b88b252b481e77535a67d9b7e386630ffbd7558
TLSH
T1F2E0DF9CA5DAC52E6D60388762345B08C2903AAADA89FD8317808CD8B642101B28BE96
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 98a14710447f72fa0744774234312574a574392b055d7d784fa8e0ce8c5f78dc
MD5 e558ba840d5ee0f855b5d4567efe4d23
SHA1 4e3d800febdf72a91e35475db819b90ff7202cd4
SHA512 b34807b99519077c7265f1d9e3e9e2958104407d49cc3f5c107900bb0e85006734b8dbe29a1112f4d279b7e2a4d5917100bedbed21840a282a80ea762fe9b54a
TLSH
T1E7E07D0814ECC1699D54A893937D4308C7D0399EF38CBD4637889884B141241B2CFB90
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 d4f653a94b14493b62560f1d7af6827497f232da1f315ad775753cb7ab192012
MD5 e609d07be0d757a82c5f01dd868f62f6
SHA1 49625ab939101f777fc7f4d30423cd9c86c38a10
SHA512 212cb0edc61518c95b4237439040c03c8b9ba4b5d4ac58527dcc574974d2df5cd51fce29c421d4c909b86eb980edc4802dc4206ea3349fac8efa579c3730439e
SSDEEP 96:oX8qd9IU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+H:oXDf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T1DD14221F4F242721CDBD517669E744A35D7CF03F8B5366CA686114B4CEE2A52A02C8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 133B
SHA256 3c9b04c37907ce34d683996e5ef4106d0357c0130cbdd298188a160a6032e1c4
MD5 16fd67d91540483c7c1d029d3aa39ae6
SHA1 ec308c605b5b7accdc12201ee426dd1d00524924
SHA512 c56efdd14350241d20f1700930cca786c2db8e6195e03b32c6b17a178cf9f27e6d33dbadb38c68ec05ae26960dbf59311a5826d04ebea3fcf1e19d60bc660e36
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 dd4798de105504a20f51b54a1072f10aefb4f37e3cdaf677ce53f3ab789b8244
MD5 b4c2ac7994ca33b1883f3a9149c60b7c
SHA1 ff63728db776c74457a1bfcadf09f2b9fc94d126
SHA512 ab03eae9643b368d8881d58ad8e76b0d070ffa11b4e48d738f98b0ff2210293f2749b537daa97403a00aace6f591a5555d997cc5d0880a2bd4784a6337c41889
TLSH
T15EE0D86445EEC529594439C75334B748C3A0398FDB8CBA411B44E894F443404B6CEDD1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 098c2ce9c49df8e64569754bacda40a766e636237d1818ee3b71bdd087e444aa
MD5 db609f70f9904bfbaa030b4b18580132
SHA1 78bf427147a4a7487c0162d7a98f1bcc70bfbe8b
SHA512 07f6e97f3598341184ec7706d5633f609f1235235879388344dc73478a9155d380ff7a6b2e32fa31bcbd17b7d536c441de34def26c388253363002e899478f28
TLSH
T11541E2F783F4856E9A1196F0AA18BE1FCE1D0511432C7D9A85E0AF27D3F3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0f2f390905f0f3bcd74a6e7c9a6f2a1de1d7d39c2a0e80f7fa865f8c8ede3f52
MD5 f2054062b7d94ab2ec99faf49dc67209
SHA1 885e81d5853fc767694de36581756dd9e0ce94d1
SHA512 ab7f0a1c21e24da6f2a8212e68e1d0630f53542ace98fff618072d1d20a3902ae2e60df870e4d578b0b5e46a704bc6a7918374339cb19c093c82323f7f6cccc5
TLSH
T1DD41E2F783F4856E9A1196F0AA18BE1FCE1D0511432C7D9A85E0AF27D3F3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8c59b509926a8350b9a20a1661f7a931fb78215e049c25b4e4a9fea30137862c
MD5 463c32317d9a123db0e4362cbc2674b5
SHA1 9feec4e5f69fb51d21d5c598aa4580f454fdbb60
SHA512 2266fff0d09b6eefb9d42ca00649b268d16e56339a1883d488c36514c052c8c8645bbb449d4760694dffdb5e52b9197d4a4b0567adef5026d9c6c61ad717b6c3
TLSH
T1FB41EDF7C3E8856EC90156F0AA187E1BCE2D0954432C3D5AC9E4EF6B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 bab655a54bcc5e58bf58fd2f0afdbedf83bc3ff344823f8ca2178c4b68556641
MD5 66281b86dbc00a6b797627932771245a
SHA1 91a64fbfd82b3180b6afe98ad97523a82cc21d2d
SHA512 d6030225ce5f7f182a332744d4fd1dd415f3a8f34af5fcfc34669f6c315d64d3095ddf0c2acf8f8af25bd15eb69b277f05cec1d7f474328f3a1dfbb18c1f9812
TLSH
T127C0223680BAE0720038843D0D84E8806A34C430004048E8CDA8833CB0800FB6E11029
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e6cdc799b3a713c4b1fe4e97392d51b5fc401d5ec30d6a064bfd9dbc129695eb
MD5 cbe060ebcbc98bb4672e722ed6fb3812
SHA1 f31b17c6a062174ef60e60e92a374e542c27da96
SHA512 2059f9d62919bbfc9abeb6e4d46fb3a48f711926333ec6a13d55c268dc9feb1d187abdffa7e3d54141fd9ee589e9e8a085adfe378b9f2a24f8e90069a2926452
SSDEEP 192:sxZSRCLyMqZjK1Ml8UQQ9l/fMsjN3uo4+gnzodpLHW6+WNGYXEAqNIg5A8J:sxZSNqml/fMsxeQLHbGz2g
TLSH
T17D62E7156A389977CCDBD309FA457B93D7F94563A1904E48A9FCCA1C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 da97524314a4a2b46db8846efcfba003b9d42994d147d666c526f948672e98c5
MD5 6c830fecc41d4991c4fc0bea145add61
SHA1 bc90030faf5a73c30923aa9b55c8d6c0de9ce32b
SHA512 e928b81db25dcf90ecdab77ad3c88c8e0d4a8f48207e8b8a6d8dc368143cd17488dd767f8f60e8bbdd8c9287d73e0b98d045ee2a505d5a74c28caf0d40fdeef5
SSDEEP 192:sxZHRCLyMqZjK1Ml8UQQ9l/fMsjNpuo4+gnzodpLHW6+WNGYXEAqNIg5A8J:sxZHNqml/fMsx4QLHbGz2g
TLSH
T11F62F7156A389977CCDBD309FA457B93D7F9452391904E48A9FCCA1C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a67e74a5193fe6ae92d486e527a75d0798a29dbfb1d0fba1433a6d35a9763074
MD5 4f97e80db3febcdbafff4a289f52f677
SHA1 bda06f470962786ddc8c0a4ec78c20eb01b8a742
SHA512 ed963ede4ef07a2e02f5cc90d0335ad05776992822a3cf3d85198e2686c391b6d8d8406bab8c44e18199ac53555ad5c2bede7d64ba1239c9df2c336a36e94022
SSDEEP 192:sxZSRCLyMqZjK1Ml8M9l/fMspNkuo4+gnzodpLHW6+WNGYXDrAHNIgj8J:sxZSN1l/fMsrzQLHbGCWjg
TLSH
T18F62E8156A389977CDDBD209FA457F93D7F9456392904E48A9FCCA0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7c05b5b09a94ffafe6bc1c7768a507af22df2d4a45f0c4cc535d4d5286dc23c0
MD5 150d36962a675f9e2438b54f942b3b3b
SHA1 8e4711175b80f41a1dbd3dc12a53b3488a2612c1
SHA512 9b321fd9076448119a6aed0750b95409e02f9ca9310a0311df34b440616fe162f0321918e89e27999b51639a33b6ae4da3c0330e8f715fabd3503c84b7833f98
SSDEEP 192:sxZHRCLyMqZjK1Ml8UQf9l/fMsTWpVMpuo4+gnzodpLHW6+WNGYXOpSrjIgbA8J:sxZHNq1l/fMsTWvM4QLHbGUHsg
TLSH
T12272F8156A38997BCDDBD209FA457F93D7F94423A1904E4899FCCA1C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33a391965bb825fae1d2497f21874e02decd5b8ff9cdf8aebc5e72f48bfeb07a
MD5 f507ff5bd5c06654fcd9e4a6ca28d6b2
SHA1 a6187c5652047c7037e91a584b1ca96d7dade399
SHA512 3e724b626826c7c781641fa2a424bc9a18388d5a8173091a2139547486c15caa5137487bd38922f981006881decfd8ac7a5b0db4c5c85de6a406a6263478b5dd
SSDEEP 768:/Zk4PXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OViiLl42vJ4roWpN1Z4STU:/Zk4PXDWvXt4hu1jaHiL+QJDWpah
TLSH
T1D0D21B3F680CCB7E4F844E5CEC26AF966ED801CB66988D4447FA494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 60de02ea52745265864f33d3788fcd748e8eaf7e5ae9596781034ccf325c7da7
MD5 f7d0374c26961f1fcbfcc6e8b8267f21
SHA1 3315e574cb035dcfb03c68b6fea4261f14c2793e
SHA512 8f052037242941ba803bb583fa0acd2da365f0e07355b306b0be69e97654b89dc2554147e72e55a42b60a33d022eb83d7fe058c03e8fdc096c4fff3f19af6cbf
TLSH
T1DBE0265405CAC97D789A20830334830CC2E5B9AFD2CCBD426FC8C988A142A08B1DB9D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 957762dcb348119080e863806673391d168813d2cc0bd8c6c7573fc50de9d8c7
MD5 52330408ee08c203b252ae6c9ee8be65
SHA1 0e73d3cdbf20fcda3e494a607c0405680226eece
SHA512 c978f186d500195f9426a3e79ca9d2d5d5f23cfedd52d1cafdd6cdc3556de7727f2fc38c7c4daa34c7ca3fbbd089d826ca5b7b26554282a45438d5bf5bf5fb0f
TLSH
T10DE0D82425CACA2A65852587D325D34CC2F2798BD7CCB9516B4898C4A206540728B950
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 1552c3537d3c7ce7ecb4301c6f2403233f00af93dd9ec0962e8f808be08c7311
MD5 a9385bf291d733b5443f3f86d7756212
SHA1 a95719fab02529b956bc0c4312d72d936242b338
SHA512 e54c3b904805c304159ba1539db8ec33126d8d6e9fe07700a586a4acf39c75eeb692f05edcbba09633edc5be43b2e16613a65e52f464f14dfb92783440a38e01
TLSH
T196E04FB455D9CB3958496487837CDB18C2B0BD8F9788BE86A74C4494A101944B2AE9A1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bf5ddfaaa01829748c1e18ab4aa0a93e558df902e5878618676786a2cc03a660
MD5 7fc4940305f740410ac1a2792391d835
SHA1 f59c1e18ec8df5380f6636e9b75bb7eaab93e59a
SHA512 ad27f403b0e3dc2e6449de2de0bc24aa78601d963fa56a2aa25e8ce25d8d05877df0009691116634033c2d2b914aa9235a79f852ff1038c909be17936e8b1253
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1UH9L:EJGnYNSv9PpHV/qj+dL
TLSH
T13CB24E13313A03423CBE2518A2A686779E4231B33059EA7F77A944764E67E224DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 2d32d1dc9917587131783427548fe48ab4cfc5482e3e87532a1e8f31ad8e76d0
MD5 0f9718a3e823576299370bbb563ee9bf
SHA1 746fea5d013a430d445e302e3aa336f68e006abe
SHA512 65fa575c7ae7547e635e0321a6f6c017b8a3d02d2ec78a4eb0f6b36bbbcb3f77e6b3fb1861fdd0d80af50de3c4593c02ef9b254c8eb0f06295387b440a5dcbf2
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1UH931H/ng:EJGnYNSv9PpHV/qj+d3F/g
TLSH
T1E9C23813353A02423CBE290CA3A686779E4231B33059E97F77A944A64E67E124DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 3299dfc68367c2bb0590c6eda693b46cf08dd166dcbce863b49af8c3fe114d54
MD5 bdbd12606d750e986da48b419a4a1be0
SHA1 f6001d2ae0793351f935197549a39e70b6b8d6c3
SHA512 a8fbd8d01030146fb0373148228dcd6dca2e491b7121eca75b3e8c9a6b2d1b2259998e3478963e6145a5e8a26b13b823b468c79db8151ae0afa7b3348def1963
SSDEEP 384:7z4sTWsnZlHDQtFIIIibSMIMiBKzcH/qS9:X9TXnbQa
TLSH
T15A72B65A23871F37C55E1FBA42AA874517D1E8C2067B231E3271284E9CF3A6786D02F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 c3db6b07a0536cb994fff2d45fc9f049087be866cd2f663ea630ecf3d38de5ad
MD5 cad9ae220e0196ebf42f9234344e18f3
SHA1 67d79789d1d958f7c202e212e10c5e7f8e15424c
SHA512 3b320cf88dcf2e76bb6ba11e4f3752ff44a2225ee8f8883806afada03c610586b4feb64236287524fe5758085b4a3925f9f37e15c50a52512812bef8ad9c8fee
TLSH
T1FCE08658A9EDC6AEA85460C75376434CD3913E4FEB8DB9873F44D4C8E101144B2DF991
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c0064b5e9bfb5f1d99b35684e1f3202106a67f98b8c4c9eff3a12a53cd0438d3
MD5 e462b064ab15142e96c2b0846fb5f9a2
SHA1 a67aecdb1781b24c2b4070b2b47de61142d552c0
SHA512 7551b66cc009c7dc9a4c54167b7ad7f0bf4d716fde08053d745ede26df19e30b909ff173130fa43f365f11beb031c6e419976b9cdbfba4f5b051f54c9b0f3df6
TLSH
T12F219D5AF321C258E18A863AA02B97261338E9129FBCEC0F517924252DB5B001E8B6F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 e70d93be91f0e3fdc337087cff0f4599673c4a649fac7e84135f23f623f8ce54
MD5 e5d5336e06bdb7aa66c0612f917a824d
SHA1 8375ac3d6cb4c235dde1bf4b6f0908b5e7542401
SHA512 67249eaf4842025c5039f7a3237e80cc15cf16497f21680e46b7aaa754f0b88abf2548fd2984c120905dbd1478435e7b10978a0562eeb9af66af3224897caef5
TLSH
T152E0DF94A8E8C1AF985060C30B758388C2913D8EEB88BF423F8888CCA101141F2AF991
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 7f57f5a4b357bda7b83c270b53237676ff90e19e2b453d6fb376d1ff51ea083f
MD5 46492eeff9fbe3beddb6cb0f513f59d3
SHA1 5e99777e7fe36d4f00da66e913192e899942c790
SHA512 c258dca6dc975ea05c751f8a567595eefe25425720d59ddecf1d3bff51a1560fb2bc0ff1b7640d6edb1616382842c6e389b20b05d95722f8f1b8d2e2bf012152
SSDEEP 3:MsEllllkEthXllkl2zEFllapllll:/M/xT02zvpl/l
TLSH
T15A4404057FC10455CD041C31C011C3503370F4500571D74334714D735CC5D401D14400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f38ae66ffdd0bd9da0ff0615fa5f274d52183c2f2c04d528562228770e938f2e
MD5 cee07e17944845ab9487f17ab364ca5d
SHA1 ea969dfa30696b3cd56312beb6e33162cf591cf8
SHA512 6f189455d53389ab195d95d466bdb3fd0bb567f5660f13171220e97c12713805f54f7a8a4887b4a6438d19edba61bfcb0b8df626f18c76d3bff9d22cdf8a0572
SSDEEP 768:+iFS8gWwgMtLVVIsOJEM/L1KWI4kAFeMZBuY:K8g9J4JFD1KWN1FDZB1
TLSH
T165F21779DCA5DD7F98EE7B48674E2A22ADE40173C5B88988D7D80F0D807249DF70B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8a2410bdbaa768781d329ea7cf65c7095ce475489c5ae24210b422aa2c96baa3
MD5 623c76afd89a2bb8cc4524bd3e6eacac
SHA1 b39ddf1cb88213c12b923c449cdd837affe27781
SHA512 ba032a11458c64ede671803f6a05ebcba02a6b4badd7995f1b7646d5ab094d33e4351ccba8d74ad8e73baaa4e36e45106c9657af9c460b8bc1c3fd67f4c76e37
SSDEEP 384:noLiFiZcIpsNp8TUNTUlI4k2zoNm55hwBfgVPtIsOJMXuxQuVasAkMNaeHy/7Igw:omFQp6wgMxLVVIsOJECQuVaeMZBuY
TLSH
T17DC24B72D8A4D9BBEDE68B89B74A3A03AEF44163C5CC9AD4DADC5D1C00975AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dc9fa62d2e4814955af7b1856366718cdf7ccf5bfc6ca26e9bcdf4bf677d57e8
MD5 0592b43330a7edac390b5f397d906fbc
SHA1 f73d091b30fe1f3cc45aeb4f75b09b9f29c8359b
SHA512 3c717d97333340260fd84f3d5e84f33f65d6ef02e83b972ceda4e130ede9b4ad5d445a380815e182e1f518e2d85f9dddb180f581afe0aea187a6a5e6d7184238
SSDEEP 384:n+LiFiZcIpsNp8TUNTUlI4k2zoNm55hwBfgVPtIsOJMXuxQuVasAkMNaeHy/7Igw:+mFQp6wgMxLVVIsOJECQuVaeMZBuY
TLSH
T145C24B72D8A4C9BBEDE68B89B74A3A03AEF44163C5CC9AD4DADC5D1C00975AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e7d55c732085418b79cb58dc1d941a034df76ffc1f69eed166e768a10237263f
MD5 eb0a62b09c146303eb7475b90ba04ab6
SHA1 97464ed0040fd6f6b536eea144e65e650aaa8699
SHA512 1c25c5bc5e8435c50763feab9b0dc0e6024612e66c8ab579d40fdd1341b00a2379be36f341c0fa3ba777c6037f8b2b754598d5fca4f46b96f8453b045598d903
SSDEEP 768:+iFS8gWwgMcLVVIsOJEM/L1KWI4kAFeMZBuY:K8g9g4JFD1KWN1FDZB1
TLSH
T1D1E21779DCA5DD7F98EE7B48674E2A22ADE40173C5B88988D7D80F0D807249DF70B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1d57817b4aa7a8892832dc05ce4db62ce1567e201559f07dd019d808e8563333
MD5 1c803352d4f2a545493721e709a06ed3
SHA1 018d161fb161c2b0e2419286f522fe5db6fafce8
SHA512 ea5d5967f0a5cf313928f1fffaafa3b0290a1f0f38a7d58b36c0e81bd4dd94142ad3b3c06004774622788fd6bd927ee96944e23d322c5017434293c7fd1b8249
SSDEEP 384:noLiF9CcmyWCJ3sNp8TUNTUlI4kkzoNm95hwBfgVPtIsOJMXuxQuVasAkMNaeHyt:omFccpJ36wguRLVVIsOJECQuVaeMO
TLSH
T128C23B32D8A8DEBBEDD65B99B74A3643EEE04193C5CC9AD4DADC1D1C019B1AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7883dd6ef8fe13fe0175bdb7eb9e44a5fb1972b1bec684a0aa4531bfbb657f86
MD5 34e6952efbd0e0757c1675cc43b1a3b6
SHA1 05b04e9b03f762e995fa9b8b5fb31699b8d59a03
SHA512 4713f603e2e60235f4346d611e9ba4f8d196739e9d914523dfd00fdd8ffa74ab1dce11cdefe954e1520d197d7000f0287ac93679b1fc5b54070b1924d422a8a1
SSDEEP 384:nmgiF9CcmyWCs3sNr8TUNTUlImkrzoNmfYvwBfgVPtIsOMQPxsEhkP+lFYS/71lQ:m7Fccps3kwgl6NVVIsOMQPHhkoFYS/vQ
TLSH
T14AB25B32EC98CABBECE64F89E74E7A47EEE001A7C59859D4DAD81D1D00D719D130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e708af51207a2d07e443d1d4f34271bfd84ae5c8066d6eedf4fb311ec604f90e
MD5 0ddfa57ba2f8dd2a0cfa423c061348ef
SHA1 c8565d32d2c2f4fd1e4aed30626bccca67ed1609
SHA512 c6a8657627b81b9f08cffd6a2f692c0fb7dcf80e6017beb64650ec26d0499c5324d2d088d3d702bbe215f6491fef82d5d0c2cb7df072676888c25ccff9aff610
SSDEEP 768:qFccps3KwgljSVVIsOJECQUVahkoFYS/vQ:+s3a64JdQWahkoaZ
TLSH
T114C25C32E898DE7BECE64B99A74E3643EEE042A3C58C99D4DAD81D1D00DB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 9a8e3e5d8bad553d7ec657b0f58924a82c11b6011450781f82100ae192b825f6
MD5 fe016879b051c335a3b0b6ea851ada79
SHA1 a477cfb7e77685cb489f44154793efdcfc440357
SHA512 89908aa4ee565b8e14757683bdccb64f25ac6923719633c7b13b3790eb17b9d1a6c717b561dc8a154394e241712736893c53623f26b69e3e5cbdb7fc3e43a7e8
SSDEEP 384:n+liFUZcI8sNLm8TUNTUlI4k2zoNmD+hwBfgVPtIsOxB7dFKuAotAkMNaeJ8sIzs:+sFS8gmwgMsLVVIsOxlPKuAopMzBuU
TLSH
T16CD24A76DCA4DD7FA8EE6B48674E3A139EE441B3C5E89AD8D7D80E1C00A309D570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c4514c94a3dfec72e2e74214edff79ab9a1357d75e42e78fdc01c9b756882faa
MD5 b34a74e717f38ab0ad1f1f980b59e551
SHA1 f3aac3d6f911961419d3c81e5d6d4627007f287a
SHA512 d00c3af8d69354dc4fb56f2e6ed64126b992a861bed947d49e26f0c873564907cc5fbeec7adcaf90c7493e4e354e38b764e5cf58a9c8793957e9bbe380e34a18
SSDEEP 384:n+niFiZcItsNp8TUNTUlI4k2zoNm55hwBfgVPtIsOJMXuQVasAkMNaeHy/7IgsbP:+iFQt6wgMxLVVIsOJEbVaeMZBuY
TLSH
T154C24A72D8A4DDBBEDE69B89B74A3A03AEF44163C5CC9AC4DADC5D1D00875AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0f1b90a58c4162be01ec2b0ce884fdd9821932ce4f223828ba1f144a96098a13
MD5 e6684783f0bd20376b0559d4568d7f6b
SHA1 d2963c1cb2b4a5aa2b8572da209e65bcfdf978cb
SHA512 7e028109167caf31f2ac9ee85c0a7c8eff7007900e235d434bb113ce5cea6b329c0de943cc7ec49fd272144f56664575b6c2b34f39d71e560217c4ad7284c886
SSDEEP 3:MsEllllkEthXllkl2zEFllfhjOll:/M/xT02zajKl
TLSH
T12D4404047FC00C15C50C31314111C3500770D4704551D74334530C337CC5D401D10500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 166450838019a5c0e83ab1a6f5b09bc5f9aec87b27270f7a8b17762c7900ed61
MD5 5b96e19740b998213f449ca80e655279
SHA1 b0df5bf38dbb7f698532db6495cfc57de06045e6
SHA512 826c287c983f24e082fb586ace61c024530c79fa27a048a7ec9010380d5805903e7d6eb6f08a8bc9f0112632c41293ac5c97aff5f2a931e032d432b3d8e3f50e
TLSH
T1583122D058380AE1C5BC0EBFB4D739FC45E8D636B1A4347868C8E8684B2E50D745183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 715b029fd737235be40d28b22221e0ca644682cfbaefcf3924d10b8f6ae72290
MD5 a7cb01ffee830b93f6f25363f88db253
SHA1 375427ad5238f0981887d55f3fe757d449a39cee
SHA512 9430499c740b5de3b18879381568eb034ba61ecb57e583887196cbf20a9d285d3a7eef27f9d2b98b35b40b8e4ed7083f96071e5256a40edc1460648cad7b7197
TLSH
T1583120E058795AE5C4BC0EAFB4D739FC84E8E635B4A4347D6888ECA84B6E50D705083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 31e695d5fddb353be5c3309ba41ae30a01da41cbbccc60fd9d30842a194c5082
MD5 fde54cd684bdd60135da0c0480d9bad5
SHA1 bd6d4c7dba1838cb9d17f2a90e73cac47c74417a
SHA512 e343952f6f44c488155dfc099a37b93c686ff7dd0e3022bfd30c2f5782ec6f1d2af075c8566ccfb255dbe38f529c9a13f82699a7794d3882873e59a16e2846e5
TLSH
T1B3311ED058380ED1C4BC0AAFB49739FC84E8D73AB1A434786888E8A80B2E64D705183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e6090c16ac95b779e11e58d909b4a0694d3f170f7dc2d4a07b41bc55184ce92d
MD5 66b10b46d692bfd42358780c62bc4363
SHA1 64624e9f542677bbc36feff86e987d8cfaac3cd5
SHA512 6e3af9423f79da00882f6822f9dbb5fab84690b2491f3158220e5a61e39dbbadbbcf9bfcd3e5d9f9946cfc7786450902ad077310578c06e96b7f67d232c24cbb
TLSH
T13D3122E058381AD5C4BC0EBFB4D339FC84E8E636B5A4307868C8E8684A6E60D705183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fdf839a21eece6e8eb5ec4440372c02757b3b4c75152e0f6ca07fa8ee2cdaae0
MD5 236d5762563020a038e3d973b56ec12b
SHA1 683d107a0d58c3a08c7d7416a13a9e4b1cccb956
SHA512 aff0fd5eaa6bf394ec97f755b53590ee818b8c814249746cc671d5d81092ce518939075750340e50cb05b3eb736f27aa065e27788d3f13bf2fec325aff1d9f30
TLSH
T1F73122D058380AD5C5BC0EAFB49739FC85E8E736B0A4307868C8E9A80B2E50D745183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 49264ff541f3cb66e46a19b1c5d0861f7d6bf97df528f7792aee91ab6d0b6893
MD5 6ec1b46e8a1532066cedf94ee6eb9383
SHA1 60ed446d82b58f4d4db87610f191a596e3fa0797
SHA512 2f6ccb1214da09cd03b1bd091c314de162daae08c4510a2a6edc7240cac01d9cbc7652beb276d401d9a30570eb33f732608f4c8f75bd53ebdb437c8743086f1c
TLSH
T1CE3110D058380ED1C4BC0AAF749738FC85E8D72AB1A4707C5894E9A80B2D54D744583F
MD5 SHA1 SHA512 TLSH

Submit Download

2650c97c-431e-4b28-9785-2bb2e906668f.tmp

Path C:\Users\Admin\AppData\Local\Temp\2650c97c-431e-4b28-9785-2bb2e906668f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_htfolwmf.qvx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_htfolwmf.qvx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5512_98556337\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5512_664053780\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

7z.dll

Path F:\FunPlus\Tiles Survive\1.0.0.1285\7z.dll
Size 1.7MB
SHA256 e41651ac06477b203028160ca60142d95936fdc34e5674e2257832491751c806
MD5 8b99961588ae70fef7c9518469e60e71
SHA1 99cbc23808d3a531ee0e474dea49936005f158c1
SHA512 38de06b2cdfcc76659b183cd768a004a6d4aaf34d7a5dbb9451e25abdfa0231abe49b98d05d4326d29d12f4c684fc422aec6dbaa97e37d974df2f16cb6d262ad
SSDEEP 24576:1znngr4eig/HxkaoDFITvg9iLXYgIcjWBzb139EOapmYpA57:1z64gxnoRGI9MXFrjWLNEOapmYpq
TLSH
T1AF854B67F6788260D0B7C075C5E2ABA6EE7134864B3096C712859B3D2F17AF6C939370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PC-Launcher.exe

Path F:\FunPlus\Tiles Survive\1.0.0.1285\PC-Launcher.exe
Size 484KB
SHA256 19e9c443cbe185b5d058ae415deca35f0cefe70816c3d7b1feaa7fce9a764f16
MD5 62891070397ae624dc727e9998ce60a0
SHA1 0ed6db76618819e7ebb535d94ed7353fa2b1be34
SHA512 6781d3e79f49b20ebdde28acaaa1dcac17c75383143911757f5b1fe4f15f25bd9be93d0748a1bf6be71d2ad55f915e6443762a3485b1d2ff777846d9ecaa07f5
SSDEEP 6144:jRvD9KvmiEjGGh75sfQXsPqvAyAH8mCUc2uc4VJ5GlvG9+ZlpuysQloY0Wr2TKOr:yvmiAB75sfjCvy82gQBqYmys3fpcaGhm
TLSH
T1DCB4F127E72810E9D16BE13CEA8B8A16D7B278950725C3CF03E486171F677E16D7E221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SourceHanSansCN-Bold.otf

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\assets\fonts\SourceHanSansCN-Bold.otf
Size 8.1MB
SHA256 997dd673efde3a7cc7410da3ccde2a729f26dc9e1a81ad659a2d6666d36b7974
MD5 9a5d91c590b9a0dbe62490e1819f7dab
SHA1 b59fc60d95321a669d116d55c72959fc1882caeb
SHA512 4471cd9cb279a40e9e440247547b9c42b6ee1e5a582befddd6b34a6ca83b7a25decd4d2083f049e40d8b047a23978e641a1071cfe142f39cb56f6ae34a31df53
SSDEEP 196608:7MTwh0cCHekOWXnfRP/XzmSxLJBr8xw71qoiXVVWWKt3psPyP:7MTwh0cCHrfF/zmS9JN8xa1CVWvMq
TLSH
T1398612EF252AF860C245E5727DA7104B367880188D9EE5F8FA374E343DF83294DA9D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SourceHanSansCN-Regular.otf

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\assets\fonts\SourceHanSansCN-Regular.otf
Size 7.9MB
SHA256 c0aa89a70f92a820ff95490fea6d472cd19621a71c9a748a4950eb2eafe6438e
MD5 8ca54f3d874ec6b3a92cecc459686261
SHA1 a3fba1908c940e50eb1c5ff56227db34bd865bc7
SHA512 5b7f200603acdbdb07379a12a33a39f3de6adf8bb233cba78fab902cb250fe5b9ce248af8cb403e028c8ac03859c76390f93149396705a4b8ff22d3f1913f6aa
SSDEEP 196608:bxPpUbexfGhXGW/272ywoN8VvS+ivEjQXJMiMs6dn+Rj6iuSBjt/:bxBmekhXu72ywSkavEj82lFd+shQ/
TLSH
T19C86021F71A9B824D621E0703A52E46A7AEA545C485FF1F4E9176E3378F62303BEC781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dialog_close.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\assets\images\dialog_close.png
Size 3KB
SHA256 d5faa4cf9c753fefb61dcd2b9b24aa50d91420eeea53d71140c1fe4d7729a5ba
MD5 edfdaeb3b04f0a8d75c41f93986fc283
SHA1 d1c4acdb3eb02046850073b6a566d0aeff41d147
SHA512 51a9f3a78a1c2078405033ee6aa018a17b29d7845e73ab46d10480e0909709307d88d0d0a88186b91a0736e65810b4c5937433b091838e6bbc10f5c70cb96c1b
TLSH
T14D815ED664F65300DF479745E37C00B7667D4D232B2E20345049DF9E0DE79E58BA2946
MD5 SHA1 SHA512 TLSH

Submit Download

ic_logo.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\assets\images\ic_logo.png
Size 2KB
SHA256 eead26426d1b810e08f61fe8a0f09a8bbe9bb9e8458bc760e676ad2f8182647e
MD5 46dccb83a4d97b655378627a5849208b
SHA1 f7d5c9df403de445564b58fe88b2dcd89ece9e85
SHA512 ab89dccb6662fd8e2f081d97f51f3380d51b513103a872825963b4b73d708966a2c07435f95e882ae19849920cc897aa453e6ebd0ca0b4991a08f54b9996b2f7
TLSH
T1E2514D8AA10C637045BC4C41AA15A06E8DA9FF839F69E97E0360CF1B26E9E445F1753D
MD5 SHA1 SHA512 TLSH

Submit Download

strong_bg.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\assets\images\strong_bg.png
Size 2KB
SHA256 5173d054a02d0877187e85d4dbe3494bc86c189b0bdab82c48538447a5604fc5
MD5 269475d91b0d5fcecd9581f0169c033d
SHA1 b349a278bfc91633e23d134ba5b0365038c8f5a1
SHA512 8807a1f196d54118cb465e19d9d6a946b84fb679516cee5b1e1fa02f4c1839a36b7e0ee2dfbb174890e46e0fd3e08078def00fbe6b0f2fa04b0ded0e5c61ee6f
TLSH
T1E7414DD3697CF981860B12038C10DDE9D37902221993BE29C082E89CCA537B69436774
MD5 SHA1 SHA512 TLSH

Submit Download

weak_bg.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\assets\images\weak_bg.png
Size 2KB
SHA256 1af69c09be126af2f75c65b984e6608b21e1e83db3e097c76ee0b7e4b14ce835
MD5 2f4dd3c540f23aae19d0522c0a84759d
SHA1 5b4080ece511a9f5ffb0043ad6e768d78335b894
SHA512 4046319e9ba906420643adb9d3948f8b08585f68549813c3ad235e7ade447a1e0869c42eba74d6975984906b0296033b0988b68e699ef5351aa2b2825eee83e0
TLSH
T17F413A4975C190D8EE8F15E4042EA815E8B23BB5C12B4710B39D098BDAA1C438EF1959
MD5 SHA1 SHA512 TLSH

Submit Download

wide_dialog_bg.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\assets\images\wide_dialog_bg.png
Size 31KB
SHA256 80e819a7517db452d93e96a1ac386fa7d9c795be2fbbf3ef884565c292e74c03
MD5 6d201b77e94be82abc33e533901bd505
SHA1 1f4c2e0f2becf289a0e79787c0f289076e28a1e7
SHA512 89172f4395876b3425cac623bb746317813bc647f479ac7ce7d7a177aaf5694e3ac285af1d7adabc225ddb9b5e0bbaa1d8bd6008a68f31c50c8f8e73c517ee21
SSDEEP 768:p21EPs9RB5NRGSN25oLTbSYGqaFlqv93wL:A11vNrLPNG5avQ
TLSH
T172E2B495C3968033F6020C18F4672A2328915E773528EE2569DB785FA747FF82CBADD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

codes.json

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\assets\language_helper\codes.json
Size 189B
SHA256 1ccccabe25529143bffa2c2b435a2990f36945461798aa1b3997877fd55768e0
MD5 e943e97b460a36a084aa92d66f2ce54d
SHA1 f494466c105cb62aced0521122c2f1a6c813de6d
SHA512 80b0cbdca14ee486bd204e188311b17f8c3f8c4b6bfbb634f0d20d353fe68b4254e89d58e3d4331194807f58aed213952eea5259522475f2d277318992122ab0
TLSH
T13CC09273C98BD5946738C50695A0065A39135FCFA37E1D1739777D822E426208BC37B2
MD5 SHA1 SHA512 TLSH

Submit Download

ic_user_def.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\packages\fpx_login\assets\images\ic_user_def.png
Size 234KB
SHA256 c060fd53174991ee8aae3a69314fc11a84d438a7b9433bee04887e8a33a72747
MD5 d87906beba79b2d03a8e6922e02d51ea
SHA1 eaf1019afbcb019f737190827e097cb287ab4646
SHA512 631dca0a0d5e541308b2d4dbcb8fac54f93b2235d59871d93f26fca0b6ee7d3ac60d0f196379184d17b7786d7161caa0fb4811de1c95b2926c0e9249988e0c21
SSDEEP 6144:GVJ5GlvG9+ZlpuysQloY0Wr2TKOWQU8qSkLAigiom:GQBqYmys3fo
TLSH
T17C3423490C72E38BD8E55160F3829CB5EA623E81050FE9559948FEB316BE35AECDC13D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ic_chrome_close.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\packages\window_manager\images\ic_chrome_close.png
Size 298B
SHA256 70fe0130bbbd928d04cd33a49ecde422ec54fd748b7a4e983f4e31be6e73f5f5
MD5 75f4b8ab3608a05461a31fc18d6b47c2
SHA1 d54d970bf54be147f45230d5adf4265d8e6be381
SHA512 3dfd36c0b364f954377b2c8c84a6d77d5b6045f4bd3fcd7e73f6ea2f3555bcead39227348700be16ec6be08c7ca62d49cd9251190aa4ddd4680afaa8b38055c0
TLSH
T14DE0E7DFFA485DBF5D5C043F08579510587B47B7E1134D004717B11A5325D64B8473C0
MD5 SHA1 SHA512 TLSH

Submit Download

ic_chrome_maximize.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\packages\window_manager\images\ic_chrome_maximize.png
Size 271B
SHA256 93f2ed012ec01288b78ad4816ef254261e9ff25e8a9858359b45431c9a5de5f4
MD5 af7499d7657c8b69d23b85156b60298c
SHA1 ca38312a38bfc6acceed24961ca4b7f83177eeb3
SHA512 3ef964d7d017088d1227409e74b98b21df381a7db558e868aed7a34780f38b329775c11b8dd77ea8d5e1089ccd6b78fe3ea4397bd54e0c0a19f64ca7119843b3
TLSH
T1F3D0EBC76A0444A7CC0CBC22032A04C2E09B012ADA08B94AB4F2D20C1C484446A41F01
MD5 SHA1 SHA512 TLSH

Submit Download

ic_chrome_minimize.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\packages\window_manager\images\ic_chrome_minimize.png
Size 166B
SHA256 0976edbb9977136544af17de125f345a41065694de92036d9365817ea6d8f05a
MD5 4282cd84cb36edf2efb950ad9269ca62
SHA1 28255b717348279c856cb77c632281a47e7896d1
SHA512 3b1fa86fbe4780b9864a3c5f4bc4a456139246d8950ebf6d1ff7ad77349e9be700d57bb7a28b3bb61a9fb76d68e3a9771058ddf45b202c14dd79bafa4fd75e3f
TLSH
T1DBC0C0E1AB080C37C94E442310A11500F0B7147D44102E08AFA1E01403B409C0245690
MD5 SHA1 SHA512 TLSH

Submit Download

ic_chrome_unmaximize.png

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\packages\window_manager\images\ic_chrome_unmaximize.png
Size 366B
SHA256 3d375930c514ec2ebc0603ad1e1398b4daf458951042a97232d16f17e1c9603b
MD5 4a90c1909cb74e8f0d35794e2f61d8bf
SHA1 24323430f35371e1a32fee930d2b7c075f714bce
SHA512 1a3f91a056cbf8d89102a2790c70b61b5f0d3ff4017340ccd63145abbd5abf05af12700c105100a4684d7bdf44d955cdb6b6d1dc58f2d99b9f1658de6aa34996
TLSH
T183E068D9367C14B4659D8DF5EB9A4254EA1F26341078490A2852E0B6F62E6844D5B2C1
MD5 SHA1 SHA512 TLSH

Submit Download

ink_sparkle.frag

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\flutter_assets\shaders\ink_sparkle.frag
Size 7KB
SHA256 0ef9d9012e179ffbeb8e89f45da87066c7dac81f715b77f700b7a9c6f64b1466
MD5 9942377cb3334be0cc96e4c5f581d87e
SHA1 64e9fd0da76b0dac46b63e5fc87031ad0c7daaab
SHA512 55bb79eb1f5f19cb038cbe9460d88bd425ea57e81107e9473ffdaa28a922e3e503e2842019f1c2f2167744ba56e2a7a9395427456d46ad5b1b9d6b709ddc0c5a
SSDEEP 192:6lklKMJhM+65GuDzgIbMRyUKwCnPBtITdH:6lkf/M+c3Vp3PB6l
TLSH
T174E1DB548A0B1950FD11ABB80A1E1558AE2E30D3369AE10373CC6F996FCF31B929A5D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path F:\FunPlus\Tiles Survive\1.0.0.1285\data\icudtl.dat
Size 798KB
SHA256 65ea729083128dfce1c00726ba932b91aaaf5e48736b5644dd37478e5f2875ac
MD5 da48e432fe61f451154f0715b2a7b174
SHA1 51b6add0bbc4e0b5200b01deca5d009f1daf9f39
SHA512 5af9c1e43b52536272a575ca400a9eee830a8fcecb83bb1a490515851bef48957d8de669b9f77b8614eb586838af23385e1afce622edb82a90ec7549f882d381
SSDEEP 12288:lMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtZdPHz982VRL8QM1q:8hw3zVtjsbGu4RjlPHzlL8Vq
TLSH
T1BA055B1774CBAD8FF0D25A31C640E7BE5A3397CE1A3365E97AA4228C7D0E1C18650BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path F:\FunPlus\Tiles Survive\1.0.0.1285\fpxgame\vcruntime140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path F:\FunPlus\Tiles Survive\1.0.0.1285\fpxgame\vcruntime140_1.dll
Size 48KB
SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
MD5 bba9680bc310d8d25e97b12463196c92
SHA1 9a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA512 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739
SSDEEP 768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
TLSH
T1AC235BE157784086D4ABA9B18593DE17BE3CFAA25B40528F07A1D15C2F637D0B73C22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4982aec4017c944a975a66eb5cf40bc3

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\4982aec4017c944a975a66eb5cf40bc3
Size 87KB
SHA256 df0ed2336f5839998dde768a02855d9582d5c888d81d7d6fceb0e0649d28eba3
MD5 b37041fd9c6dc8610dbb2a86659de61a
SHA1 93fac72cc994f2ced762abb628eaafe154be8a81
SHA512 897b61b3b74d206f376109ce172b369ba879beb65414258b6b9aa322c8a6057fce4bdc887076e910ef1769de2eb3ae021822c1578b6903a3df73a8c31cf85cfd
SSDEEP 1536:2/vMdt1Lb2uAVf6EzXmKtUH3DGY9VujHR727mfb/A6EJ0sSvZUPxB6Pt:YvM4uAZfzQD5mY7cqivZ2xBYt
TLSH
T1489302307AD2473BCEFA59A95AE146E572D79817C214CC80FC9261CF01CD8E529BABDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5858a428e5b6cf73e7914a28b41e2c5d

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\5858a428e5b6cf73e7914a28b41e2c5d
Size 184KB
SHA256 3807d69f33e3efbf9a9efb698bf7b3685d0dfd9d84643bacae883d68ed3db13a
MD5 b9430d92b3e4b59253eac1fc5aef4a7d
SHA1 1acaca6ae98c5e64839deaaa93704b55303351bd
SHA512 189d239c3b5f85227d5417733dc1f659a0d7d2f3359be86a9fe2cdd9762caee811910d345c551a0aaa12362fdf72ca8deb5d972f86aaf39dd44eea226899a01c
SSDEEP 3072:MB1jTkGtXUl0mM6LbpgILHigCaNTWuJiYm24MuJm16FoxP3iSP5Ste:+lTLBUCf6iOCCNTPH9oOxP3rP5Se
TLSH
T1B30412B08F54CE2293B6429D24E291E174D7E80692ACDEE1CE1271CB5CC954CBCBE65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c4418c46255ad64258e271005208817

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\7c4418c46255ad64258e271005208817
Size 227KB
SHA256 1c7164af4ded6e7fcb016911f001fabcfc96d045f9d5c30992cc663ad7a5d836
MD5 42c74bb6712a741502201a031625efd3
SHA1 e73f02ffb23e35880846b59f0f8bad124afe6266
SHA512 b128f70df2eae9cac0820fc8a0149fe382dd292e4419ce670f8b1388af9179b5ef1b880ef7f42c6bc7f92581b64f1b15ffb415a308a8f72628f904f673216be0
SSDEEP 6144:Kl1zGUgNepA7rLP3cRxM/xpThY1s14tUEqbJCOpd:8l5DcfEDM/7lVOav
TLSH
T1293412705AA06E5AF373D93E5DD3D310F9D32447009C8A2EEB53429B99816D8B96F2CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

817d6eec9d31e585113aab9de4525117

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\817d6eec9d31e585113aab9de4525117
Size 231KB
SHA256 b7e81f6de544ad8ab214564a23975a2c5cf4db1beeb88259c8b8dee3a6c910d6
MD5 57c63a8d285907693d216e8b14ea7c9e
SHA1 cfa1709d1f7813bef3e16573db289eaaf11e96e6
SHA512 ec4de32c94910e6de062776754887d460333c74ab260eb58927640eab1cb0ac90568a8e80cea8d9ca114e3a9bfeb3b9e83bfbea7d2bd8c2c8e11c7b9f5e73657
SSDEEP 6144:aVaBCOLZhbuDE5lHqijLNGcqEQBfmA8kAbbfd:aYl7uE5ldPNGc5QBt/Abbfd
TLSH
T199341276294A4B17E16E4AC7ECD3439539D379A7812C8C20E9F35612D8808DC7DBF29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle_assets_G_2.5.801.218.json

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\bundle_assets_G_2.5.801.218.json
Size 5.1MB
SHA256 2822ec80e56916f94d128ea5780fc393c6ce1cd29e0c4a72ec8798fe5ea9e719
MD5 ae893ea98e565cc9cf4159b837d999ff
SHA1 11f405c2187416145433c9b0cafa7be83ab9d19b
SHA512 3a46034484d1888af1c0425e0b9190a2c4ce32b4fd0bb469619420d680f66ad306469490814e9a1c8962397413cb8d8643d0e49f493c1002466f2de2d12daac7
SSDEEP 98304:iPOqBqd4Y9tThKpXcFjWhUuUauWK6VyWK+ieKGCnDfjHbvLn+tDYellLJiJt78/i:WBqd39tThKpXcqtDYellLJiJV8/2hMiB
TLSH
T115362BBE290CA99A45D6ADFE1975CF76C034E3D1D90446A0F3101C6C8F9F628FB5B90A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle_channel_G_2.5.801.218.json.down_1787113636391_3

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\bundle_channel_G_2.5.801.218.json.down_1787113636391_3
Size 776B
SHA256 bd2b7f6b5d2f769aa6ba6b452a6a7a07ec1a9916c67434440a81c51068c22f63
MD5 5c465b1c6b4cb96a9dc10a1e4749de5d
SHA1 cc864c7a2ae9f94b4f834aa681a80c79b25d54ba
SHA512 6af70086d1ed2fd6aa9a319182f85c48933f7bab019fdd21db1c96bd61ca9e57134aba9a0587c759f1f1df17db0bc6bbf49979a6477c079318c95c4a132a2fd3
TLSH
T1B301970BE018AC78CB962D7AB867D2032A54883CD7DA9406CC008C122F4B97F2D0CEA1
MD5 SHA1 SHA512 TLSH

Submit Download

bundle_dependences_G_2.5.801.218.json

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\bundle_dependences_G_2.5.801.218.json
Size 1.8MB
SHA256 52fabd1141d19e62150c88221a9815299cffd6eb76227661fd75af90d83c016e
MD5 deeac484c6d7818dcfbd50f91b85f1e8
SHA1 168a195b52c512f4ac62a0b0c4b86ee532ae5a4e
SHA512 a12964893c6e0311a0e5f74aec2651abfc26d28990350f1eba72881959368cc3f8b9f9a307f7f1e85f5fcb9fbd6cc05cf2c9a5928d56eaaa3db4d0ffcfa0bd42
SSDEEP 49152:oCWOCpU5SVHycDvliFktsW1qHRI2Su73R2g:oCWOCpU5SVHyc7lirW0HRI2Surgg
TLSH
T11B852EF2AD580F5D80674ABC362ADA7566B04997427090735A240CF74B8A3BE337F61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle_preload_G_2.5.801.218.json.down_1787113636391_4

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\bundle_preload_G_2.5.801.218.json.down_1787113636391_4
Size 9KB
SHA256 256e97e0bed4e0d2b86e0d8234063fbb23d9885503982251bdaa98f119c43593
MD5 3c6d9bb2f86bddf03a148f097f6d133e
SHA1 9f0584932482015a7a8eb359361f22fd9d93ce72
SHA512 098b264c5ffcb68144f172ef051f03c1bbd5781653fc03ba4be0929e831689acdea8906f05965d906d6b9ffaac264a8bc3ac33472d51ed8965700b006117f188
SSDEEP 192:MopdE59x37FMkejaHsLe7fmnDeNZbNwXDutYLZPS9gDLHxyb3:M+q5X32kPeeWDeFwTXLZPer3
TLSH
T1A112ED2FC8D5CF1602C491C9B97609FD890AB857AC7A0E389AE49D1107C553F61CFBAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fed6ef12f280737cf7c1ee1952b93db5

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\G\Windows\fed6ef12f280737cf7c1ee1952b93db5
Size 267KB
SHA256 0cc62be9080b40e4be108ffe4421243ae57b14b72626df8b279c4606bbd83298
MD5 6be33d87740906932b2b46ea409c2ce1
SHA1 397a6da501a8ae9107c0bc9928990c4075ef4667
SHA512 a9c7665194b4b2d7f610806ae969b79dfbb713e53c434278e74e1f620f7f62426b1ce5aa041d11858514bf2a7455c66d644a44c51fed0d42b290e92465b132db
SSDEEP 6144:E04Z0CymRtd+6Xw/dWw5CDs7il2cC6UN7va9+QIxILyVjaVT8FSk3XO:DQndcVWKms7ilAl9a9+QGILyVeR8FFnO
TLSH
T19F44121169581E6AE372618D2DD2B1B0BDD35D1F9268CA87EC23C0174EC894CB5BD3DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle_assets_R_2.5.800.214.json

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\R\Windows\bundle_assets_R_2.5.800.214.json
Size 4KB
SHA256 0dc29b19a332086b4b13a0cf27db025bf7318822cd30d3bc7651c9ff6e6c6f64
MD5 d16b909cbeb47e5e9b79d030ecf7a11a
SHA1 5ffee24763f7ad8c98aa6cbde9c0b3ae78ab068e
SHA512 b25f1417d253102d30bdc229080219ecaaf4e1a2c3421e269a4ea15b2f11ae1875bfe139aaabff5d1c408f690d88402a7c2e92cc053d40a73cb11e2e2a1f7b43
SSDEEP 96:S9RTOzHirkAPA1azt/dkRkGbfgLXSLFi88FTAvAvDDERH1AU:WiHir7I1az8Rk+gLi088FUovX0H1AU
TLSH
T1D291403BBB235B5760A48F30BA73EF6D2BB28184164AC357E29015282F88C47BF5F455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle_dependences_R_2.5.800.214.json

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\AssetBundle2\R\Windows\bundle_dependences_R_2.5.800.214.json
Size 3KB
SHA256 47fc3f581249d957ab76deb8add859603327d85af42e71fafeb80e30f51fefa0
MD5 7d23d66c006be23e543e362c28b25919
SHA1 ae1d5766f7a13edab8cb3afc05f6ae3c14b280ab
SHA512 d47e371778349923d761a4feee977a229406e57fe8f758162f2aac8b3d6fb98e6161c736fae9097753587a12c74a1aacdd2382d7b2f8cd52ebd33bfe510878a1
TLSH
T19F61DA242AB3FA869D10952579B99F7FD1E204F02A33512ED040EC281CED260DB6FBC7
MD5 SHA1 SHA512 TLSH

Submit Download

BinVersionList_Realtime.json

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\BinVersionList_Realtime.json
Size 113KB
SHA256 b87db5171a246fa9a4a8fb5fd62d8b06c22ef218a72bde4e0d40e05f36778818
MD5 2fe1f4f94a92f6a6ee73ba5a41499f67
SHA1 9acc61032d0aebd1ed6f4a637439c23b3300d22e
SHA512 e1274c949884b197b6243b5a072e332532a6dc90cfab7dfb9296aff554f02a9289f970afd9cc202075a5b5ebacd5b379f7a8da217404fe0ad105468a11470dd7
SSDEEP 3072:dumnenMbkVygX256T6i97qgdq/htFR0dvuCMWk:dqI8ygX256T6i97qlFR0dWC5k
TLSH
T113B33A10421C38B616E72AC565F99CE2156931DBE37504B4AF2CDB2E078DBF0B76268F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity_commercial_cumulative_charge.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\activity_commercial_cumulative_charge.bin
Size 130KB
SHA256 cafac445de42b8a8290adce638b3cc16e533a27ed506569fb3bb9b7e63e99144
MD5 14ee146b8e5103c6da9863fd25c2f5da
SHA1 6e999b421c9741e15ee4c6edd30d755a09c39713
SHA512 8fd0d0fe8a24c3efd9333923d0f1511f390d98b199a624615440f43a498bbf0e2ba0c3e0fa2400a2b7dc17d6cdb0fab3218acc00c19a713c215236cf0fc8210c
SSDEEP 768:/kP1pF7RA4MpLjKKn+ojjLTtf0ysOni7EDUnHfzTTUQS/+6gUU2mgLP0FqXJsZ6g:SY4MR/+6QgLP0lhcUxJsrQ
TLSH
T106D3DC24FA329E26D2112337A2BBF940D344AF8F0915E185B3C87A7F4A7BC56561FC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity_commercial_cumulative_charge_group.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\activity_commercial_cumulative_charge_group.bin
Size 9KB
SHA256 d42ee8b243591b87ea7a1a1134db8526c954af3a300e509c29c6b7f8ad77b1b4
MD5 316b9f9f1b61cf888babeaf57aca5101
SHA1 7db292e679b2068116655f9a2481c7e1141843d0
SHA512 a2e52b19670e6a8e55cb91395be5c1a0e7b259d455fc089e0ecc6d9e37e0266d5d08e42e33b7bc569b247d7b7c5b654f0ab6cc7228ff2113d4a1ac976a8a4d4f
SSDEEP 192:Te6jhbz9NhBCiR8wjv+B4nW+nd2xG9pBv1XYnDPu:Te6dbz9JCgBvs4WOuG9lIbu
TLSH
T1C7229A405624EA9EF3837BA60473F8818139696F8A57600977C8DBF77C94C57812EE8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity_commercial_task.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\activity_commercial_task.bin
Size 1.5MB
SHA256 59bb429ce5fc48f2464649a5368cfaa75bf1c3db3889b09fb2d7d0c864e1510c
MD5 bfa7a21f3b48b70775c9e04b57000b2a
SHA1 06e582b301eeb583770d0446a73824e5201d1399
SHA512 5c79431ee3cf1f2e3e17a31a4220631e2a7baa42745db9b6fca3c459e89adbcf6ab2c8422180d367aa5f2c3e81b7641bba3ca81f8a7d721128bd98db9e2a9aab
SSDEEP 12288:pi8er/W9sXoK9bUNOnYJooYDWyPxwk8x/CUs:M8e6y9bUZ45wk8x7s
TLSH
T1FC7573D1F61320D1D8949AB045F7DA4161B1BA45AC0AA5CEB0D0FE7F0F5AB8337DA13A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity_commercial_task_group.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\activity_commercial_task_group.bin
Size 145KB
SHA256 9b21fa3f541550ba19edae1897ecf11b653ff338221463a760004c7f2c7247b9
MD5 5747a543d2e5366985c087eb32aa411c
SHA1 34e5fa877fb7424fedfae5ada47158c6a7c117f3
SHA512 f2079be166ff076f08e3bf21645bbb98e5a11c099953551b18bab88be05a99f3ab2ca759358dcd9797c22eef64525af77d18a620efd005d976a0dced407e903c
SSDEEP 1536:enTFUJNSo0pkiOJ626Fqbk74xu/ReXXP7AxdS1v8pOvsXoay8:enCNekvUHYbK4YMXf7mpoQ5y8
TLSH
T1ABE3E0C174279161E0D99A7201E6FD0176B936C8AD4A998A72F8FF3F07119433CCB6B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity_control_season.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\activity_control_season.bin
Size 8KB
SHA256 f2de743f50b6b7df4bcd0b751a96af23d0ed9e06f2a14d7c6fd7e30cf07f8dda
MD5 58b07c6bd6ce3ee99740470e5ffc79ed
SHA1 da22c41696bd83e1be24ae38591d0cbe1eabd0df
SHA512 641d0c65111110c5597985d8d30aafacc9a9347d3ed80e35963408d418e4d08dd960c654e767138dd63a23fa527f7f9d3ed94021f2bd1d6dd2b1da8b9106fa51
SSDEEP 96:uWjAkcOjfnLvY+NE0Nt6GKOCeQQdqdF09PAccYAdvGdwtSRnDnO8jSDqiv8/8ktQ:uW7LEPzQjzyeWtgNAxE/o/r+Tq
TLSH
T1DC0200A877A2DDE2D0B8CB7809E9C7512375FE554B0B827332C07B6F0CA67501F0A686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity_cumulative_charge_group.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\activity_cumulative_charge_group.bin
Size 8KB
SHA256 378c3fe778a2ac46ea1ade5eda5d21477195d027d63a45795fecbdd6b1e2566f
MD5 26aab8f2351920c53fb3d4891f732104
SHA1 d0e3dc676ce83ba4e98db7f800fc350d5522c3ee
SHA512 2a3d7d7bf44e516957eb5f49118e280326f32d812679b51824cbaef5b0da9b9196a1eb131da765c0ce49752236ab339f53cd429977d9feee7cb4be78f94c756e
SSDEEP 96:OaTteVpeDeteSe3RgYB0atkhbz9Nc5Xgh1MYRS+y20WLQDs0kujLWAOYz9D+mNJ+:OeAphbz9NdSjNjzx+mNJcOUbMTwYrs
TLSH
T1150258A451641B9FD0667BB69073F8A1C009699F8E0E710837DC0E3E5CA5C7B912BF8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity_hero_battle_group.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\activity_hero_battle_group.bin
Size 3KB
SHA256 1f63ec1b7a9671cbfed310b9693964b5608f4ad5cf9172c3a87b3280a9667f17
MD5 2263b5077a81b692beeb64131bb5c9ae
SHA1 56a164b7ab454ed3b2a0d56444f2a38c7623bb75
SHA512 ed0fc462ae8c488f1d94c067544490f3f8dbff38688d9bbd03882371d45dad912f0d33a53da008f9f817eedf5c4f0f5ad97adc6128296d72c8d0880ae4a8608f
TLSH
T11D61F141AA854DC1D4725E3095EA7BC16374FBC3BC31EE8315B4E67C6CBA2D14874157
MD5 SHA1 SHA512 TLSH

Submit Download

activity_super_exchange_stage_reward.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\activity_super_exchange_stage_reward.bin
Size 10KB
SHA256 e5a535bdd415de61a2a17fde699f44e6a284f11062d57b5c893d9461e35368c5
MD5 8dc1b905d669401be4bcd7f3f940f598
SHA1 86512b9c1b16cffe6b210222d177d844fe0ab91b
SHA512 8c80631b09c82a56491880dfac1bb96a58f995aa4cf152f1506ad3304c10bc0b0611d6859fbf6015974c88f0b7b8848730f2b42862f435cea44031851375568f
SSDEEP 192:PMY1a/Tz0h6/VESZ9FtDN3RnZZD44o411Q09PVZcnbTlBME:ez0h6/VESZ9FRN3RnZJ44h1a09PV2nbL
TLSH
T19622D9E9B32611B7C5E0447A407C1E81CA8E58AFCE17B5AE4B4DCAAF0C5F6425739CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dragon_main.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\dragon_main.bin
Size 1KB
SHA256 206fd5cfe66a040246adf9ac589148738d22145dcccee67fda9fad1036f1dcbc
MD5 5cb5b92d22ef3166c2150179054f0539
SHA1 c41d12e167cdd06b282c20032d6a1df0f2e71e95
SHA512 e6fc9f22e7f03e5fbc0a88f89b56628acb5997aa2dcad83dfe578aa6dc598b0e757f09082ba7cc301d02ece4ff23eba5108780c0f00ad2eaa669b02c787b6938
TLSH
T1812114C12DAB0A60C1658B76199ABA82971775C48365B3107302B27D0EF73DC7D845FA
MD5 SHA1 SHA512 TLSH

Submit Download

function_open.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\function_open.bin
Size 70KB
SHA256 01f79d86c409462106a881dd21a19460b9aa198eee1e87f471f84c3fea192ed0
MD5 443a1d9d398d496f56e22ba74d01ed40
SHA1 624eed24644c0b6c50d9789c55bda10b26c0243a
SHA512 139487ff71e3229efcd618dfc41ec7cb5ce4e747de344a06d27e4e6b742b7f5e92f44c82ee6ee555262b7a97eebeb552b6c996f03ea7476963821bb36c1f0133
SSDEEP 768:a39wIxuXhoRxTfYLY7YAY9YSqacjTYuAebluymfMo9dfMuV3:RuRokMObluymfP9ZMQ3
TLSH
T114631F83653BDC3FC3F236B22389E9568D28F6565642D5237BC4C34F06C0AE1165B9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game_configs.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\game_configs.bin
Size 174KB
SHA256 2d022667ccd91605c8909a4c6c880c8ec8352e178437aa9065e7d4293e8963a3
MD5 60c13bba3a3c4c6f93c41c9703ebce77
SHA1 746cea1c1fda169ccdefc17ed6264e3aa6a37b74
SHA512 9e6ac526d6eed8850f89ed67cb7cb6ad59fa4d45fc0ed9bef4c6c78e029030a00516a9f7440777b216906a0dc4b43ee572e22c60ad4f88da33b2ab98fa432e64
SSDEEP 3072:Lc+Ncwg+uv9OeBlrYOW4sAzS7FlPKkuMxvXPwQ:JcwHuFO8YnBz7neMxvXPwQ
TLSH
T1790429263628C41BC0E33ABE67A6EB9143747081E745C763F3D47B8F868E9417E1764A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

high_return_list.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\high_return_list.bin
Size 983B
SHA256 b5ad1056afdfb1fa63faee108ade3bd2908aa04d693631c3d41b31e29a431d7a
MD5 0508247a9fd4c06a79c7aca8a2a61716
SHA1 03a9199ebdbc9794cd72464a04adea16acdcb48c
SHA512 4c9e949b478f7856a3d9b5e0e8f4cda80ba15129720adb0ae34dcda35094643a28afa96dfb34eba49090d7a3bd211e583e78ec060259166b04ed66e13ae9d64f
TLSH
T12E11AFF9358EDEAD8001445E92C1C86A818374C1CAB9A51273367B2E708E3D1FB4E786
MD5 SHA1 SHA512 TLSH

Submit Download

hud_recommend.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\hud_recommend.bin
Size 19KB
SHA256 700488af486f8c8cd1028fe2bc933b26d8ee9d932c8c66541c78e52afaf9f5c3
MD5 40a9787561b4f70eb19f8b2bce281103
SHA1 7c7ebea9dcd4912ab8dda667fa6b2264407580d7
SHA512 dc49033592ec70136990bd3c447c1e6d25f44b0fc4f163db2a12236a9182af1c94e6ebead62f132f827a2b124ae3b5c6cfd12d2c79110606cb4534be3da8ddc4
SSDEEP 192:8UPaYGmBwkENKItEnW2VTjxbdXan6mJnkXpORu0QloQKRkw/yqDdzw3jx5x/X8XE:/arkwkE47VbdvIo0Q+fRkw/9DRwzF0XE
TLSH
T12E92DD00779CD74AC82379355D9AE3E19234FB5B5A48160B33807BEF0FE97A21F4A649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iap_configs_new.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\iap_configs_new.bin
Size 87KB
SHA256 e448fb0d2894e19f1bd9a2f3f7bfa91d86cd224ea4394f3dcd680256034454ea
MD5 60817bec8bcd00b09c40f401ba86295f
SHA1 dbbf4e834329afb47ff1279952e70edddfb5de7b
SHA512 1730838322d2240466269b5bf993d36bcda0cc21ef632efdf2f121ac1c294058015217af07895f305e519928429fef6e86c6f7f362a59d433a20c0b68fbebad6
SSDEEP 1536:expWhgccbQ75/wtmp+coIckP6mxkFDridhh9/rvS7KKF/0qoz7FaP9ajY7sh:eogq72OmkCmxkhrQ9/rvS7nF/0qu7FaE
TLSH
T18893ED713E31D36DD0D52EB4B524EC818D2D3DBEF466A4DBF2D47B9E098A841222346E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iap_package.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\iap_package.bin
Size 1.3MB
SHA256 89774629f4b419076dde93a7ff04d04d5c9640914f21927d74d7e2c31bb03028
MD5 74bcca7f49f8bf49bef0d3a8891d5bd6
SHA1 b962793a204c4f4b7ccdbf196d6b5c1c92587fd0
SHA512 8ca7bbd697b30725418996dff6a0ee13b64475c2a2ae805a5a56a6b50d338d04265d7f3beb0acdb96af20b4418b87a0e33620559952fa34efd44a36cb2cba0da
SSDEEP 12288:xn0DoqKH1NhiyuHwxW3FeP9E+H9rYZ2e0T2:d0DoqKnbuHwxWUP/WU2
TLSH
T1AE653F42FE208605C0953E70A045EF719B3FBDB965626397B1C872BF1F87AF1992241E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iap_package_group.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\iap_package_group.bin
Size 737KB
SHA256 9f8ba324f5dd7e46bc0ea8b37bf4acef352826485c309d665addcdd4ee065643
MD5 e4fd37d879e854ddc35afab1c5019c97
SHA1 8bbcb23746435ed7df97b9b67d928683deae57fe
SHA512 6f1980e111636d8ae438d3f91aa90202dae9643dcdb849e4772071fc7d4646090aea203c8341fa5227964ed6048bae9418024dc8fe6f28d312f65e9f8f4d78e7
SSDEEP 6144:UIOCz01Bbksg1jmwsssAEAc8c8Qg8c8gEgAgAMsMsMU0EvfcxB+Kqn3L4J/FRrY6:44joKQn3kJ/F9zeTv2/
TLSH
T128F453126B625388D180FD721042EFB08FA9FDFAE572168E72F5769F1C464610E2F29D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

itemlist.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\itemlist.bin
Size 3.4MB
SHA256 4f1f6dc798af6e347a074a651ba69017bfa96d6c069fff35717b040722aaacec
MD5 1831435c9998c4db1895b488b3d22438
SHA1 68573880aaac80f789a57c03689ec7c2df60f561
SHA512 ccdaa9da73f694f75cbc1fb2cf7b701be7398e2cb8e40b72c3df89d40d109038575f125d8eba5f9e5b9f1c1327dc4a03230be9dde94efc90bcb48fb9f53d0f15
SSDEEP 12288:Yt6XcJUrxsvFWs+0fis5mUIkVX22GIf1Ow0Ujy3Mej9wXSgGeoc+eu3PHu860aWq:MiduoeGPO8609V+h
TLSH
T1F5F5A317CE49AC03D6BA79F98827DB116330F2D6D9708437FAE0464B5FDC1989AB14E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package_center_new.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\package_center_new.bin
Size 11KB
SHA256 8b0f78b3945ea0e51a11581030f01481231b510299e460ed79c9f5770dfc3514
MD5 6940dcb5e81246413f41d9f80d2b01af
SHA1 83ad5c9d587ec1a0371178690cf8f51b36f69ce5
SHA512 54e78a18d5f12ef8aad1b342452106e87d4f792c9c3393e517f444d3f5e221002add93265324b0686ef714948400e8a2bd3e942f9d85a395ca560f768085fc47
SSDEEP 192:9Q78Ue8w0nDk4JY2AUfu+DeuVGXI0dZK+:9Jj8w0nDkrTUnTVG4K
TLSH
T1BC3297331726E2A5D2C10F79F367D660891EBBA46064D99276C0F3934BAE804ED73D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package_tag.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\package_tag.bin
Size 5KB
SHA256 da81106ea331f9d3703b43c299ef7c8e89457a177537b33f66e4fad4c324e08c
MD5 8b3da111eadd2bf941555d9bbb3c67c2
SHA1 08f473b1041809e34bc64dfcf933ec092291ef6e
SHA512 dab0b2a54017fc7d927561ef0c0e75aea02da4340242b116bc0da1a1e117a393cee7aabe7d1ea60f247721c6392bd3b1be460456dbceb3a18c109dfc10b0b542
SSDEEP 96:x8pGLDu0ua8KJ1VKsipFJeOLl/LcnuOoJCl/mWHM7RipI:0Gv0a8KJ1VcpFJeOLf5JO/ORp
TLSH
T1B4C1C7227DC6D0B5D6556FBAF764C804D2ABB394A8465E0373E83BDF4ACB080E027342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource_main.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\resource_main.bin
Size 22KB
SHA256 3c9bc0bd1587af29230e6b7f8d4f61141fdc6160bf487f0f68295cc976b09809
MD5 fb458d1df87bd3a080a3fce8ca14f9bf
SHA1 99557feda05eed0cb4b72dc7cf4bd74ae15b707b
SHA512 69ed769e3f90d162c13721b3073936355468a6fd8cf9b40c6622c48b62f2847872951dc4527363ecb8356ae8b1da0857498fa2e13aba915833b866815a0f55dc
SSDEEP 384:nKDzJsXdY4edMZtKQ+avGkQgbklQmhKu3n:ncsqTMZh+av62+KuX
TLSH
T108A21B573911E4B2E4B527386876E54196217E43C43A413BF8F4BB7F46F2EC0AEA6C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select_pass_choose_group.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\select_pass_choose_group.bin
Size 35KB
SHA256 5b177dfa8a43e664cdf56d215fcb8dfb99b67d12166d207c163fc8d45c1ec04d
MD5 f2611af396ca5853d69646a12f1b56d6
SHA1 72257001d6250846846a1ed1c42274740f8400c7
SHA512 ec0b20e63d8dcae998909bb9ebf800e47987289826188b8dcb3bc94e4d86706c652994f2449bfe4eb3ffddca70a78e822b4eca372a58a1faeba008766ac6c4fc
SSDEEP 384:Tyk7Nnw0mJ5jdk5en/wfrcbpP+a212gYkT3yu8fiRKZmfoqXEvg9SaPrig:TyMnw0Ai5enooiXyn1mfo8EKSamg
TLSH
T182F233143587C5D1E96F85763EAED8B0A5A07DC42E21681BB293BB5F0F2BB03E487417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select_pass_level_group.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\select_pass_level_group.bin
Size 36KB
SHA256 5259dc11ba01fdfeb6b136a04481482b53493fdb0cc7309db83fadd0bb2c36e9
MD5 6ede65a0a6e379a3c9ee1ebb3439a529
SHA1 856421114731aa4905b4f01e8d95f881f469ee4c
SHA512 7c29469a0aa5961429be46fb96f4c34bb78e0c8c4feaf7caafcf3cc6f6ce3238bb67c0301ea318d265a1c732bd91484a9a6233be8cbb697403e8cb848ff89fd9
SSDEEP 384:btXwr6Zsj14LcbqDXw4KskFdx3FYKKRWsjHQXtwwM4k:bDZsh4pXLKskFdpmQsjwXe9
TLSH
T157F2FEA1F55BCCD6E5866538854EDFD24351BE822C80C8C5B1A8BF2F2E73141615F8BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select_pass_level_main.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\select_pass_level_main.bin
Size 251KB
SHA256 647370e4c6de1376081e3c95e8f7aa67277f1a3761813c683254528ad16cd6fc
MD5 d959649a716629ea5533ca8923035abe
SHA1 b27470dd60087899f0ab0c079c458e86b7f02b98
SHA512 d2f8a2be25ef2d53a48a9258ad1344b6649d841e4ae962d1f426d01c88a4e852c5cc3e75b717cf0c32ba9271852dda9b1e7baaf5f981a451c8ef30b0b407140f
SSDEEP 3072:1Lr41eGBtTAy2PbyEsDJLd3XSJ9OMDNvL:1Lr41eeIbyt7XSdDZ
TLSH
T158449B10BE068DD2F83282370DDED7D1E771FE912FA3A947E191B26F1A2B3905C05969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shop_link.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\shop_link.bin
Size 392KB
SHA256 019599ec29332bc069417483325ab3f3c72122a38ad0bc59e947ee32ade09617
MD5 7b93042d7adce47b9663c9bd76faf800
SHA1 1985065e9dd3519ce48333de932429a918c2b7a8
SHA512 dde21073eb935f81d63f01a3878db06f8157ef43da862370ae49e785489c2903c901919a26a94fd2e9f538efb5d12ad585a2084e9f2fbe90e260e47f0a853e35
SSDEEP 3072:SrHZBtkWkgZbhpxgFmTTm5UuRLgYhGKkm8WYZ:S7ZBtkWkgZbhjTTjIsLKkmXYZ
TLSH
T142844003BB98E876D0A56DBD696EC3D84735F9868BD01397F5D8230F4D970A07E2D288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shop_main.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\shop_main.bin
Size 175KB
SHA256 248bea3d7d344a1f3a6ce5b7b0c03a14b68fd8317863c5349f532388b9278f9c
MD5 04fe9293adab01fff7b083015bbcca0a
SHA1 a2fbc6279df6340b22f540736938b5cc70a81271
SHA512 fd4927d011e77639355c18d33d9c698559f4b24e110111934765e5fc399ea64019b473720c10986b325cc3e5a5e594b0e7556b59f1c03d993a9a9d24db143458
SSDEEP 1536:s8PVxelYYeKeNxFWj+W8rZ8Yd9I7iUKL8QVB8UhgDSB+NWWYcUNPC2zr:s7xeKeNxFWj+HrZ8Yd6LKL8QVN+MrNx
TLSH
T161045103B7993822C0BE3DB874A753980B34DAA1C7A33354D964CA3B5E965F57A342DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

welfare_tag.bin

Path F:\FunPlus\Tiles Survive\GameData\GameAssets\BinaryConfig\welfare_tag.bin
Size 14KB
SHA256 110e72b39275142c9100d035ec001dfc1ca4dcb5e35f1e5e2f803ac5647cda6c
MD5 991b1c59f6408198a23c16bf2a6a64bf
SHA1 ca151b65548612a2e1fada7c8745fdac83102a00
SHA512 0c3dae6ee04a2f34ec925472e10c15d7c6e008fa54a987859f8c7c6ef91e51687a5d914b15255299a4e5ed9aacdae5fa23cadc026a44016652ab41156db092ce
SSDEEP 384:kFI3BqhUDRETDoit5l5pb3PFGlrNQd0qbrhr/IKQKFwI4QiyY1CKkGzTiR7mj+2v:kFI3BqhUDRETDoit5l5pb3PFGlrNQd0X
TLSH
T10162FB10BC15E5BAC2992EBF1408CC0CFA6B73A6E6143D9B7BE09FEF190EC812543655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa5145a1-f71b-4d5e-93bd-07210fb9c44c.log

Path F:\FunPlus\Tiles Survive\GameData\LogCache\ts.global.prod.behavior\aa5145a1-f71b-4d5e-93bd-07210fb9c44c.log
Size 872B
SHA256 348b5e7cd911987dbfe9de1e0610cc5b0480055109718b42b5157765963d6d11
MD5 6bf4e161f8815bc810c9fe61e6b6f26c
SHA1 26c3cdf642595ddd93a4d384ca794272175b9f44
SHA512 293c758c9b52c382bfeba3c512daae912add545687d31277c4bfca734ccad7a6c1469934bd7e29fe61bf36a76f38d50ac8c82be470ab704b8fcde43d9a4c5a4d
TLSH
T1E0118844B5EA9EB30B1799A8188D3493A3D187454510ECD5CFE6C2CB95EC0AC0E8C8A6
MD5 SHA1 SHA512 TLSH

Submit Download

Launcher.exe

Path F:\FunPlus\Tiles Survive\Launcher.exe
Size 651KB
SHA256 a366191ca637eb86a88cf3b82649a4a4d8e70963be3ed16a2ea58d5db024adb4
MD5 6ae171f76becda5035501194b3cc7fba
SHA1 ac91cdf935e078df1c024ac68d457f7173ee8eb9
SHA512 de2c1ea233eef1871ebe1dc96361a71d354d7d49f80152761ebbc655c27e471f36cd6e92b92e7cdb6373c9bf38525702a014e3bab0531ea8451fd579308a4b33
SSDEEP 12288:hncEugueyR7Qehq/Eby82gQBqYmys3fpcmrCJ:hnceuemcF/qy82/qYFEfpnrCJ
TLSH
T15DE4DF95A7A40CF8ECBB913DD956490AEAB27C160760D7CF03E086561F633D1AD3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameBabyConfig64.dat

Path F:\FunPlus\Tiles Survive\ngame\2.5.800.204\TQM64\GameBabyConfig64.dat
Size 288B
SHA256 135be48af9414f7003379c510f4fff07f078e726edc6ecb89028df6fe8656880
MD5 52f7d130059ca0f8ae62977bcf9d8e2b
SHA1 e6c7ca45c597ec343547abd9383d39dd9e55424d
SHA512 2041e8b3aa0e6c5f3421fde06fd36b1cc37f0162aa2726336a9e52babad99ddf83e71d422b66554708aaae50750de1b42aa575e39329b65b2c0a2c461613b320
TLSH
T186D02BE16E092871B28031CF54089C40FF16531F068A08BFC0008F273E7809433AC3BD
MD5 SHA1 SHA512 TLSH

Submit Download

GbDump.1.241185671.tspc.exe.dmp

Path F:\FunPlus\Tiles Survive\ngame\2.5.800.204\TQM64\dump\GbDump.1.241185671.tspc.exe.dmp
Size 463KB
SHA256 b04735f739485700cc889c33394a55762bfea392964bfe78198007351c4788a1
MD5 66cc9056947deb2ac57e687feab2383d
SHA1 8790c7dbc796faece3b67e6e3b96d5426bfbf795
SHA512 11a135c708178bc22fad2c952d7df4c8c074b016e4afedb2cd4dc3834be7e31a93ee7a9782bb59fd95b487038b2d2b5c86fd2756b36474d35373bed09bb03fa9
SSDEEP 3072:639kDyxTjMojGQyUaL4oc57Ye+784ABHbRH:W9igUojGPU6c57TR4ABHbRH
TLSH
T108A4147EF7D2CF0AE4B585B9488B633826F2D94D0B23CFB61E8181356D46A34C764B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FPXGame.dll

Path F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tspc_Data\Plugins\x86_64\FPXGame.dll
Size 540KB
SHA256 777c580882a91f40c417c899835ce4ab8a526b737c04a9598cbec814ae3a96ce
MD5 815f49cded28c4a33b7ecf1de3a0a53e
SHA1 fb98eb90e6ab541bbc440d1471651035362d9169
SHA512 f23fdd92dc901a9f4409d47043d34a47092e588169452fc11f5f1722f9a35c2786407933c399c288bf12e6e70e2a50afc28a02b36e9b9f0d9c68b590b2ff68ad
SSDEEP 12288:eHuiaDQFJO5/WrlM210DYj69AMAo/9D9+A:edaUFc5/Wrl08OJAUF9+A
TLSH
T1CEC46C0DA6A907B9E0AED138C9579E06F776784903A19ADF03D045B21F237E05E7EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle_list_G_2.5.800.204.json

Path F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tspc_Data\StreamingAssets\GameAssets\AssetBundle2\G\Windows\bundle_list_G_2.5.800.204.json
Size 2.2MB
SHA256 80378c01d6bac2ef844d613a94ec720c7282013af526ab2810214a0db2afb636
MD5 6e99adae8c8c6e05816a2a0ba07d10eb
SHA1 a1794ed164ca0dfce8d003ad4d42d87004d20342
SHA512 ea2114b7f7e91bdf4f931f43129eba29ddeb55b5ebb88116cd73886c0b05b905880c12df1288edf83d6f8ecba1f32ea28db097d5d7b2aed7433116932d8840d3
SSDEEP 49152:GAfesT+iXCwq0J66KvliFktsW1qHRI2Su73Ri:GAfeE+iXCwq0J6jlirW0HRI2Surs
TLSH
T1AFB573F13D580F5DC06B4BB87728D27562A0AA670734D0835A245DFB0B8A39A773F61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bundle_list_R_2.5.800.204.json

Path F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tspc_Data\StreamingAssets\GameAssets\AssetBundle2\R\Windows\bundle_list_R_2.5.800.204.json
Size 5KB
SHA256 6d812430953acbd790991890c25f66d7ee36a88534f9e10cfbdbc3cffcc2ead7
MD5 f02aed28a701bc4e70639e1daf8af5f8
SHA1 3987383df27a5e45dd1e5c954ec8efff03c482ff
SHA512 16710ac62cd88ca83c295c87fa91b004e3d32ad693243d55578d1240872731b8422cc20716af59e6c13afe4359af745422d1c726aa4dc69e802c4a7d6dfaaced
SSDEEP 96:a4Q1p2QyAJMSRpk8xy+APxsBt1666i/7ffXoiiMOANutsaAu/faA/PfiwtI:av1pRxJMSRptyFPeBt1666izff4ir1N1
TLSH
T1D6B164243A73F6D6DD5891B0B6BC9E3DC1E200B02A35219ED055EC7D18AA160DB2FAC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google-services.json

Path F:\FunPlus\Tiles Survive\ngame\2.5.800.204\tspc_Data\StreamingAssets\google-services.json
Size 5KB
SHA256 bbd1ca1b72eeccb9e6849ffd4cfc7acb835762f1e45636a7fbfe8f9546098f42
MD5 a7a4442c0fc99cccc48d66c9458772a1
SHA1 6182355f0dfb6faafcd9eae70db9584477f72296
SHA512 4e25568dc19db9a12e314d3b68797f94b928ca8b2477c3a9cd6d1b78efc11001f951662ab65e2e3290656c0845deea659a4087b840b172d144e9db7183e3e987
SSDEEP 96:gP5y5FKUwXHeqsEoMHOovLqCDaaFXHeqsEoMHOovLqCDaaaXHeqsEoMHOovLqCDb:gP85kNXxsEoKaCDaMXxsEoKaCDa/Xxs0
TLSH
T1ABB14D48C1B09CB31AE993B46D7D9285933881838E7A7D5E7FBC810C5F9D4151BACBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 1KB
SHA256 4c1f3e4614086556a83aca4570c385df4f853d8b4165a9cf6f32d2732bfc7618
MD5 e8b23e6af9901c28aba102d18a0d4b68
SHA1 ae792499b017ee622b989aa6148cabad264f51f4
SHA512 e3a01df7a5eca2f21e6af5c51a629342d0faaf944cc44431203f8f38c8f00be3a369202f4a946d0534757e314c7d4360e08c0d09e04fe09e02f087bace3440a9
TLSH
T1B831EC400680C35D6C28E065FA517F792C15A87A6B5EC66E0BD0D1D7D2D3D9974B283F
MD5 SHA1 SHA512 TLSH

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 1KB
SHA256 5087f7e1a2254df8f41fbac38ff9505f73448d0724b78b475af11c2589135fe3
MD5 3ebd4734ac1d2f1daebc3ef84226a578
SHA1 7d6b2462aed07033d038e741abecfffa666c3414
SHA512 b39eac17e3a61dd2e6b66636615ddc6fa572bca86ca7c7c3c1099467af4096046ff70cf5b92c44ed671bc4c4b0ed921216bc06d04ec7b8c30d50ad860e462870
TLSH
T125311C400A80C35D6C28E065FA517F782C15A87B6B5EC66E0BC0D0D7D2D3D9974B283F
MD5 SHA1 SHA512 TLSH

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 1KB
SHA256 aa8b8700fc3165c056d35f4603acf700f0004ff8e140b0abe7631b4fcf811eae
MD5 0ebd0d0386ac48e415249e531d954297
SHA1 30310bc29ab361d1b8e705ceccda53f8c3f2a740
SHA512 91d42522778a158e66b98e4103603c22ee511395437a7ebcf0b4ad93d794237141aaa36ea8dc6417d3830619d431b63bd23704c3a3966de9b5061c7df12b5daa
TLSH
T1DE31E91986044F5AB5713071F4455EF59D30E376DB6BD51B47850009D489E0C49A6C33
MD5 SHA1 SHA512 TLSH

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 1KB
SHA256 c6184786a58eab1a1a4c59f160fb8454732de8d42a6b7aa732b7db006c2fcf1d
MD5 8c352bde9207dc33e4a926497f1c6217
SHA1 c42245a0120fb7b154d72d58d2a637643654aef5
SHA512 6c731a319fb1c6e739b1897a159db61a97a3db51ed3adbb48b378d4c800d3ea9755015c453a2d4f8423612f7a476254d4110556c5d1d6ee5c81071782b6bada0
TLSH
T1903129188A084F9AB9703070F9455BF6ED30E736EB7BE96B4385000AD18CE0C49A6C37
MD5 SHA1 SHA512 TLSH

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 18B
SHA256 3e7e288e24e7ae00bf788dc3d7f8282f1d890527397d3c18afc26711d0849b2c
MD5 265392810cfab823833f5a0f4258b98b
SHA1 f3219d0bf5e3e449eaa865ac83140d4b38124490
SHA512 549c973a2e3a118053dc73e097af89407a8849616139e4e7144b22fb6565982c2e1162ab4d2f55dedf064e1e4a3c1670d083b8dc177229b798edeea92d357e43
MD5 SHA1 SHA512

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 73B
SHA256 61260eaa48fa6a3f27db2964ba09ee398389188fea5688b243cca5bbc2a1d159
MD5 06487ad341b2c1cf90e2763052fafa11
SHA1 6f175c74c720d7fc1b5a695cc610ea7b338c9421
SHA512 bad2a312d2c2c6d69b725792e93dd5403f92308c000df039c86f0408c38a735141051bc8fb31d38b5aa5ee9747a79a50635db439219ac40098ad82c98aeed7db
TLSH
T184A002048D515328A5F18218DA628F6AA5719F5A157BF37C1CA2A48C460ADACE14A8A3
MD5 SHA1 SHA512 TLSH

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 137B
SHA256 a4d6ce03e7a8b8c0d7796cf5ff07084818d5ed8e15be9042f066c580f9666480
MD5 f2be4f533f71933e472067b0af3ea872
SHA1 5fb45ec5f73f7230f45fd7a3476e83945467e587
SHA512 999a07ebe55a003a4dd19974767db31defadb17e1167db3c4b8d4f0e0f1e2af2ca2ddc4dbbb2b0c8e4d7a2cc2e7d07bbdfdb7b94b36ebf4a1df27ff1e3cdf5ca
TLSH
T184C02B0458934B2C31B0C015A3120B5508B10A014337F72D0C71D188400ED5CE183453
MD5 SHA1 SHA512 TLSH

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 151B
SHA256 f697ab821f5389a8f7022c97853c50ea02dfc0bd4c83d92f1fb62bbdc3668dac
MD5 0561f34d0ae093ca4d511e6bf48f7b84
SHA1 1a873478fe53ac5f2251c9bd0b50af6c22a9b429
SHA512 6d13aedb7d01c348c1d5016182ec20113bf63f227fc091563b6b318df4bd934c3dcaf034e6ebc768d0ca4c3a9885728721a35be817b2fd6c1049aff307120b21
TLSH
T11DC08C0599A35A2C31B08025A3120B6908B18A164227A72D0DB2D1C8400AD9CA182862
MD5 SHA1 SHA512 TLSH

Submit Download

ts_global_setting.ini

Path F:\FunPlus\Tiles Survive\prefs\ts_global_setting.ini
Size 1KB
SHA256 175fb4fc012f0e32f9a931f29275d6ea68265aa1b7c94bc3641ab55ddaccbec5
MD5 9cd1f347b3b26aaa446d994d282e7a9f
SHA1 c2fc84e3d8fbe94118deb220392c53de4bb9e97d
SHA512 41a7507af72714f693d835a6f67a9d43a9f18b848ed02a888737894458cb88eb433e0de9619b57577562f0ed65bfca2360a866a4bd6609c02426fe1cd8487398
TLSH
T166210B414A80825D5C14D021F7817F79281618B53B5EC67F06C0D1DAD2C3D99687382F
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.exe

Path F:\FunPlus\Tiles Survive\uninstall.exe
Size 1.6MB
SHA256 2042bedd61c5aede7b90d2302c267e8f4c179e4c3e2d93b1a44a7cb01020dc11
MD5 7d8389fb7d8e9c9d2e78daeeb1f9c5da
SHA1 1a4a7e690a431243e4c6f5307a9c9290492259e8
SHA512 f958372b682cc73d3a08ac6cd995e3ea687290bcb2e0124df5b244eed1cd32570d2aa4a7e6cf0857397fc4b81f66bf728fb61aabb34ab481dc53da3a884670d5
SSDEEP 24576:dMUcHSJMqJLJODkzTGFTNbgy1aQjNAIN2Iky82/qYFEfpYKA:QHSJMqpJ2FTNbgy1aoNATdAfiC
TLSH
T1DB751212F9C0D072D5A311302B17D775AABD79B08F919ACBA3D8885D1E306C19B36B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3520-2613-0x0000028E97630000-0x0000028E97652000-memory.dmp

Download

memory/6208-2721-0x00000218E0090000-0x00000218E00B4000-memory.dmp

Download

memory/6208-2717-0x00000218DFE20000-0x00000218DFE3C000-memory.dmp

Download

memory/6208-2718-0x00000218DFE40000-0x00000218DFEF5000-memory.dmp

Download

memory/6208-2719-0x00000218DFF00000-0x00000218DFF0A000-memory.dmp

Download

memory/6208-2720-0x00000218E0090000-0x00000218E00BA000-memory.dmp

Download

memory/7344-11384-0x00007FF8E27B0000-0x00007FF8E2D05000-memory.dmp

Download

memory/7344-11040-0x00007FF890BA0000-0x00007FF890BB0000-memory.dmp

Download

memory/7344-11831-0x00007FF677DE0000-0x00007FF677E5E000-memory.dmp

Download

memory/7344-11039-0x00007FF890BA0000-0x00007FF890BB0000-memory.dmp

Download

memory/7344-11061-0x00007FF8DEE40000-0x00007FF8E0F48000-memory.dmp

Download

memory/7344-11050-0x000002C5AF750000-0x000002C5AFECD000-memory.dmp

Download

memory/7344-11032-0x00007FF677DE0000-0x00007FF677E5E000-memory.dmp

Download

memory/7344-11038-0x00007FF890BA0000-0x00007FF890BB0000-memory.dmp

Download

memory/7344-11033-0x00007FF8D0750000-0x00007FF8D1750000-memory.dmp

Download

memory/7344-11047-0x000002C4A7400000-0x000002C4A7401000-memory.dmp

Download

memory/7344-11048-0x000002C5AF750000-0x000002C5AFECD000-memory.dmp

Download

memory/7344-11051-0x000002C5AEDD0000-0x000002C5AEDD1000-memory.dmp

Download

memory/7344-11049-0x000002C5AF750000-0x000002C5AFECD000-memory.dmp

Download

memory/7356-10775-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download

memory/7356-2425-0x00000253CEDB0000-0x00000253CF90D000-memory.dmp

Download

memory/7356-11171-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download

memory/7356-11231-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download

memory/7356-11100-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download

memory/7356-2722-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download

memory/7356-2424-0x00000253CEDB0000-0x00000253CF90D000-memory.dmp

Download

memory/7356-2766-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download

memory/7356-2427-0x00000253CAA00000-0x00000253CAA01000-memory.dmp

Download

memory/7356-2426-0x00000253CEDB0000-0x00000253CF90D000-memory.dmp

Download

memory/7356-2423-0x00000253CA9E0000-0x00000253CA9E1000-memory.dmp

Download

memory/7356-11845-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download

memory/7356-11835-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download

memory/7356-2752-0x00000253D5480000-0x00000253D5C97000-memory.dmp

Download