ebfe0446f2f3f24a4d6b652ef55ba0e1ca024ef3f62dbdc91def8f26fce6062c

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Duels+.Launcher_3.9.1_x64-setup.exe
Size 4.6MB
Sample260916-2cdt2atwes
SHA256 ebfe0446f2f3f24a4d6b652ef55ba0e1ca024ef3f62dbdc91def8f26fce6062c
MD5 a7e2bfa7b95ea1b07a130bf2520b4e7a
SHA1 5002be1987cfc3e9ca5c12d7bfd3e9a320a33f9d
SHA512 a7bdc5d0cc6d2176cbca4dccd7de1c28da5d54563159c2f3e502aa66922c16f4202432a254ccb7eb74fa00888efc2bee1195573f96fea6c0a23af8db9b5a4e67
SSDEEP 98304:dfXHcsHLkC7RggUi6robORyhOPriwbc1q9yNyMlekokMquBsmk71R9oaAx:dfXxr+s6rwO4hOPr/bbyNLxuBsmO1RXc
TLSH
T1092633380353E2E7E3224270B833563AA6859D5473E82FC7DBE18F581E228959F3559F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1992 created 5124	1992	Duels+.Launcher_3.9.1_x64-setup.exe	82

Executes dropped EXE 1 IoCs

pid	Process
2140	duelsplus-launcher.exe

Loads dropped DLL 7 IoCs

pid	Process
1992	Duels+.Launcher_3.9.1_x64-setup.exe
1992	Duels+.Launcher_3.9.1_x64-setup.exe
1992	Duels+.Launcher_3.9.1_x64-setup.exe
1992	Duels+.Launcher_3.9.1_x64-setup.exe
1992	Duels+.Launcher_3.9.1_x64-setup.exe
1992	Duels+.Launcher_3.9.1_x64-setup.exe
1992	Duels+.Launcher_3.9.1_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	duelsplus-launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_958435052\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_958435052\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_958435052\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4512_970538569\female_names.txt	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Duels+.Launcher_3.9.1_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1992	Duels+.Launcher_3.9.1_x64-setup.exe
1992	Duels+.Launcher_3.9.1_x64-setup.exe
4804	msedgewebview2.exe
4804	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4512	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	duelsplus-launcher.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2140	1992	Duels+.Launcher_3.9.1_x64-setup.exe	89
PID 2140 wrote to memory of 4512	2140	duelsplus-launcher.exe	90
PID 4512 wrote to memory of 4896	4512	msedgewebview2.exe	91
PID 4512 wrote to memory of 6128	4512	msedgewebview2.exe	92
PID 4512 wrote to memory of 6128	4512	msedgewebview2.exe	92
PID 4512 wrote to memory of 6128	4512	msedgewebview2.exe	92
PID 4512 wrote to memory of 6128	4512	msedgewebview2.exe	92
PID 4512 wrote to memory of 5528	4512	msedgewebview2.exe	93
PID 4512 wrote to memory of 5872	4512	msedgewebview2.exe	94
PID 4512 wrote to memory of 5872	4512	msedgewebview2.exe	94
PID 4512 wrote to memory of 5872	4512	msedgewebview2.exe	94
PID 4512 wrote to memory of 2952	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 2952	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 2952	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 2952	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 2952	4512	msedgewebview2.exe	95
PID 4512 wrote to memory of 5584	4512	msedgewebview2.exe	99
PID 4512 wrote to memory of 5584	4512	msedgewebview2.exe	99
PID 4512 wrote to memory of 5584	4512	msedgewebview2.exe	99
PID 4512 wrote to memory of 3920	4512	msedgewebview2.exe	100
PID 4512 wrote to memory of 3920	4512	msedgewebview2.exe	100
PID 4512 wrote to memory of 3920	4512	msedgewebview2.exe	100
PID 4512 wrote to memory of 4804	4512	msedgewebview2.exe	101

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5124
- C:\Users\Admin\AppData\Local\Temp\Duels+.Launcher_3.9.1_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Duels+.Launcher_3.9.1_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1992
- C:\Users\Admin\AppData\Local\Duels+ Launcher\duelsplus-launcher.exe
  "C:\Users\Admin\AppData\Local\Duels+ Launcher\duelsplus-launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2140.5664.8946395930830916297 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView /prefetch:4 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffb5f715fd8,0x7ffb5f715fe4,0x7ffb5f715ff0
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1404,i,9435444009812918244,16269210398977317826,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1404,i,9435444009812918244,16269210398977317826,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2328 --field-trial-handle=1404,i,9435444009812918244,16269210398977317826,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1404,i,9435444009812918244,16269210398977317826,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a /prefetch:1
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1404,i,9435444009812918244,16269210398977317826,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=1404,i,9435444009812918244,16269210398977317826,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4672 --field-trial-handle=1404,i,9435444009812918244,16269210398977317826,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

duelsplus-launcher.exe

Path C:\Users\Admin\AppData\Local\Duels+ Launcher\duelsplus-launcher.exe
Size 15.5MB
SHA256 d7fa21ddaee18cb39a8de1a3f5a233039c3b9c54b408a9d4086a792f18d3d6a5
MD5 be2ca7cf8c64f8ff6dfbc8ada9aa8f5e
SHA1 58547133b702bbd413db5c394db1bbaef67639fe
SHA512 6e4d92f5e83cf7bfa9336e812a2a0f3a0a1505ac1fd59d7d1dee92b38453aea8c06a0b4c6133901366f560446dbbc09714e872791d29d4c6532d67f4f8e775b4
SSDEEP 196608:LgUxipiMNWpnJ+pOnFdqgLIf74FiknwXGK8B0cLRPOGy6tQ:LNQiMNWpnJ+pOnFdqgLIyF3/0AWGFQ
TLSH
T1E5F608257B5A99A8D09BC47483878A72493130DB0B35B9FF448892383F79BF56F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\modern-wizard.bmp
Size 150KB
SHA256 e004d05220d6b5334625b748cfe6daccea3b91c0b8413858f553838be5935f26
MD5 8f4c86bf3f23990a01113e0c935c4d0b
SHA1 f00bd1597ff0a2d55a9a47288a334f8837ca74f5
SHA512 482ed9c8e186155e339cd3f4cba86734ab0e8cfbcaf12b646ab2879ebf82807b7ba220ab0c5376507d3161977d245ece75118cf5c36301c7a6d1a40eda24f41a
SSDEEP 3072:Ppj2ppppppppppppppppppppppppppppppppp+pppppppppppppppdpphppp+d:Ppappppppppppppppppppppppppppppj
TLSH
T182E31D6A044428EC14BF042ACFB054A374D9573E4DFFA4DF5C21C1B939AAD29BFA5B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\nsis_tauri_utils.dll
Size 32KB
SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
MD5 6ebdde247cad8468575f1f2a4d7ae2a2
SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
TLSH
T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e74168025cac7cf6aa06e17cfcc78dc757679dd657bd999af87a308a26c013d5
MD5 f5af479c1e4ff02761d1cd88ecb2305f
SHA1 552be31f1b2608bf9aee98fb9db269a31ea5b45f
SHA512 ed309a8fa17f0e6cdba271d2acf69f6f64934eca39ab4b8e60fdcb6ee851c2c072053165c34275a17ecae92290d85cfdc0f1545c32a40bd70fcbea21eecc65d1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 844819e8a75325d2d3c9ae8fd2f86266a85fc24a445c0da3a7e77a0ddc1da80b
MD5 4c9cacc20f11551ce3f8ffc436673e83
SHA1 27062af2638d6002a9c116f866cd7a62b0cebdf8
SHA512 aec7e826fb1de4a1b57dae3b432e3a8b0e47008a5c9bd4106e3c60771ab384fb934027927b456b4d7e12101410e7200a69f39af32c6a7cbc945a3d92f1691a60
TLSH
T116D0122332514274C01521330A136A0C1440D12B40058004D439851D1A580549922462
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

6a7a16d4-1abe-4190-a1cc-17755636e34a.tmp

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\6a7a16d4-1abe-4190-a1cc-17755636e34a.tmp
Size 6KB
SHA256 95e74720fba40a3601a92cba2a4aa47f60dd741e6c033acfe702e8b70653288c
MD5 9d93012e0156af3257ba0a7204c2f61e
SHA1 e0c62cec758c777fb9dd1adcd506cd82ebeccfd1
SHA512 10e4b89a6c02f4a79f90783fd351f05a3f7aa5394e59ba7d9dda0b5fb02530fb2eff10c1c27fd781f549b381ed84b865a2e14318cb904b383bf3e12d7ea7d227
SSDEEP 96:stJ7/dE5YNb9okLo5h16Z06s7/x+6MhmuecJbA1ejeAUK+gI28XM1C7K:stNydYon6sV+FdbAQjjGG6K
TLSH
T10AD186156E24797B8CC6E509FA39BE17E3F5507260D12D58E7F88A2C08EA6CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 6da0107255e180bb60020bffc42ed4a81faa163477b25e61034daf20726bebd9
MD5 75d07907163c9977c526e9e2b12c146e
SHA1 e8e700294444360a393e2f9bfa8d3bec1588d403
SHA512 76105a003bf1d852b72e7e932507f2d8e77caae3c9405868b5b33e50cc257406b88285995dd1eef22d40ad430ceb7bcd649d2b3db9f1bf031ee3782f114e7c5f
TLSH
T1AEA0021391C00132C1103FB114D246857FB1CF2C0F871613449503B4B89C3C54903041
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ebed.TMP

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59ebed.TMP
Size 48B
SHA256 7b68c813afa605aa81bf5b3cbca8ec79e86a966e22458a6729066e40ddda1d46
MD5 baa5304483d7f865ebe723a68e691ffc
SHA1 1a8b23a17d91a43b47f1c8cdaf242fd4b0039afc
SHA512 a6fc758a34e5846963829c42abc97dfdf573e813f72b5c8fe567dea97ef97ef31051991eb22ea785138463826a57d83f761fc6892ce686bdc2cf494a97909fa7
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ac219.TMP

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Network\Network Persistent State~RFe5ac219.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 c7e903644e34fd2f04d33c0d5c77fc09c07cc489d0c1c8e3fa9b572cdfaba00e
MD5 0dfd028845af73666b0ffb81ddff0486
SHA1 1f48d6fad83de454691f5fa701e473ef05bab6ac
SHA512 e246c34ddb410adab69e7f75d0fb0b9a09d8c6732d46a604b0c2e21b3323ec321779e22f0389ce3abd3ea4fab84128db1265b107b7328bfc7524b96ec63fd5b4
SSDEEP 96:stJ7/dE5vGNb9okLo5h16Z06s7/x+6MhmuecJbA1ejeAUK+gZN28XM1C7K:stNy3Yon6sV+FdbAQjjvNG6K
TLSH
T145D196166E24797B8CC6E518FA297F17E3F5607260D12D58E7F84A2C08EB6CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Local State
Size 16KB
SHA256 f58380ae6b543fb65c192e8a2f136f4800197fc690c7bdfd1f21e2f7016326c2
MD5 44c4bb5d25e5a8bb0856dae0072b7572
SHA1 a9af7305fbba2fdd31282a6e3fcd8b871e572002
SHA512 5e79afaca968b6141c3c20faa3d554201ffd0aba890b970ff2e8d4a301debccf346f68ade0622337c62260c3b29c95b4eb68e61e15e0ca489f3afb61b261b7c1
SSDEEP 384:P+aQikB+z/xvxjg/qhEdWNBSiNOYOBQpIR9zq:e/UxvxjgC+SkHBQpcFq
TLSH
T1F8728D3B64753E27A5F3E50479590F8BDBB884B291C26AB85EBC5F0B06C32881353D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Local State
Size 2KB
SHA256 63d609252643307e5bd73d92c72a3da7c11a65a4b8f133f41bafd9cc82d0360e
MD5 77dc76e5c752e61fb9178c69eabbdc4b
SHA1 ac2160de311db3123cb16f8eab4bb4eee669df3a
SHA512 603b47e7f35ef83fa4f11fd0c354f67ad33f7018b22cc51067fc5a90d9e981572f72a2694721df5b0b4840d4618bbda3212ed51695952400c1da21d669e41330
TLSH
T117519577B850AA3AD9E29904B84A3F23DF7550E5DA521F60AAEC0B1A41E754C2363C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Local State
Size 3KB
SHA256 d925ba3830c9a5c5f4258676c0376bc32e186ad302e0a08e8ef0b3ee0ece779a
MD5 47ea32f63a7e0ef30654b23b99e6fa82
SHA1 f5414d54e69941cdc371635a6bded1f6ed44a506
SHA512 e4ea38c4dd6522f059caaffa1b0e19c62ac7cea17bae94fa9539cb991bd82e760ed6bcfc1aa5393f920aeff87a36f18db9079eb84d88a0042e2544a68baefb25
TLSH
T1F671787BB860A93B9DE29904B88A2F16E7A55067D5917FA4D9EC0F0D01D768C2353C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe599aee.TMP

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Local State~RFe599aee.TMP
Size 1KB
SHA256 c587e1e6d612c021dbbac4874721a78dffeade51d40cd2f2d35b3b18c3f4f1a6
MD5 013097c49e9e6f57899f51e7311340f9
SHA1 676b1f558d10073fb0d0083e69170839812e9ee0
SHA512 1bb03b1f2017d32b8e0ec1824fdcfa704638050a80898a5f9f3515597d2e2607540637d96805ad3212b58b3dd4b6bd1296e2993ba451304adb1a92cc7192058e
TLSH
T12A3172B6F8902A36F895A505700ABF979F7000AA82518E0066DC4A1E12E744C637BC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2952-167-0x00007FFB7D4F0000-0x00007FFB7D4F1000-memory.dmp

Download

memory/3920-346-0x0000027C60FA0000-0x0000027C60FCF000-memory.dmp

Download

memory/4804-366-0x0000025F34430000-0x0000025F34431000-memory.dmp

Download

memory/4804-355-0x0000025F34430000-0x0000025F34431000-memory.dmp

Download

memory/4804-357-0x0000025F34430000-0x0000025F34431000-memory.dmp

Download

memory/4804-361-0x0000025F34430000-0x0000025F34431000-memory.dmp

Download

memory/4804-365-0x0000025F34430000-0x0000025F34431000-memory.dmp

Download

memory/4804-364-0x0000025F34430000-0x0000025F34431000-memory.dmp

Download

memory/4804-363-0x0000025F34430000-0x0000025F34431000-memory.dmp

Download

memory/4804-362-0x0000025F34430000-0x0000025F34431000-memory.dmp

Download

memory/5584-323-0x0000018C02ED0000-0x0000018C02EFF000-memory.dmp

Download

memory/5584-287-0x00007FFB7D830000-0x00007FFB7D831000-memory.dmp

Download

memory/5584-288-0x00007FFB7E400000-0x00007FFB7E401000-memory.dmp

Download

memory/6128-91-0x00007FFB7D4F0000-0x00007FFB7D4F1000-memory.dmp

Download