ebfe0446f2f3f24a4d6b652ef55ba0e1ca024ef3f62dbdc91def8f26fce6062c

Resubmissions

16/09/2026, 22:36

260916-2jdgvafb3910

16/09/2026, 22:32

260916-2f1g7stwfz10

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Duels+.Launcher_3.9.1_x64-setup.exe
Size 4.6MB
Sample260916-2jdgvafb39
SHA256 ebfe0446f2f3f24a4d6b652ef55ba0e1ca024ef3f62dbdc91def8f26fce6062c
MD5 a7e2bfa7b95ea1b07a130bf2520b4e7a
SHA1 5002be1987cfc3e9ca5c12d7bfd3e9a320a33f9d
SHA512 a7bdc5d0cc6d2176cbca4dccd7de1c28da5d54563159c2f3e502aa66922c16f4202432a254ccb7eb74fa00888efc2bee1195573f96fea6c0a23af8db9b5a4e67
SSDEEP 98304:dfXHcsHLkC7RggUi6robORyhOPriwbc1q9yNyMlekokMquBsmk71R9oaAx:dfXxr+s6rwO4hOPr/bbyNLxuBsmO1RXc
TLSH
T1092633380353E2E7E3224270B833563AA6859D5473E82FC7DBE18F581E228959F3559F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 460 created 5596	460	Duels+.Launcher_3.9.1_x64-setup.exe	82

Executes dropped EXE 1 IoCs

pid	Process
2312	duelsplus-launcher.exe

Loads dropped DLL 7 IoCs

pid	Process
460	Duels+.Launcher_3.9.1_x64-setup.exe
460	Duels+.Launcher_3.9.1_x64-setup.exe
460	Duels+.Launcher_3.9.1_x64-setup.exe
460	Duels+.Launcher_3.9.1_x64-setup.exe
460	Duels+.Launcher_3.9.1_x64-setup.exe
460	Duels+.Launcher_3.9.1_x64-setup.exe
460	Duels+.Launcher_3.9.1_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	duelsplus-launcher.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
60	discord.com
64	discord.com
93	discord.com
13	discord.com
14	discord.com
24	discord.com
40	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 38 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_1215446834\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_870047800\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_47367381\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_481194491\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_481194491\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_1215446834\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_870047800\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_47367381\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_481194491\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_47367381\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_1486654052\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4184_47367381\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_1842357301\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_481194491\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping876_237564457\female_names.txt	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Duels+.Launcher_3.9.1_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2032	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340718215449631"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{5B2B98CE-7418-420F-9517-E96819A1A84D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{DA576C7C-F5D9-4E38-A2D9-41FE63836E00}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
460	Duels+.Launcher_3.9.1_x64-setup.exe
460	Duels+.Launcher_3.9.1_x64-setup.exe
4868	msedgewebview2.exe
4868	msedgewebview2.exe
3324	msedge.exe
3324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
876	msedgewebview2.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2312	duelsplus-launcher.exe
4184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 2312	460	Duels+.Launcher_3.9.1_x64-setup.exe	89
PID 2312 wrote to memory of 876	2312	duelsplus-launcher.exe	90
PID 876 wrote to memory of 4932	876	msedgewebview2.exe	91
PID 876 wrote to memory of 788	876	msedgewebview2.exe	92
PID 876 wrote to memory of 788	876	msedgewebview2.exe	92
PID 876 wrote to memory of 788	876	msedgewebview2.exe	92
PID 876 wrote to memory of 788	876	msedgewebview2.exe	92
PID 876 wrote to memory of 5664	876	msedgewebview2.exe	93
PID 876 wrote to memory of 3316	876	msedgewebview2.exe	94
PID 876 wrote to memory of 3316	876	msedgewebview2.exe	94
PID 876 wrote to memory of 3316	876	msedgewebview2.exe	94
PID 876 wrote to memory of 4188	876	msedgewebview2.exe	95
PID 876 wrote to memory of 4188	876	msedgewebview2.exe	95
PID 876 wrote to memory of 4188	876	msedgewebview2.exe	95
PID 876 wrote to memory of 4188	876	msedgewebview2.exe	95
PID 876 wrote to memory of 4188	876	msedgewebview2.exe	95
PID 2312 wrote to memory of 1092	2312	duelsplus-launcher.exe	96
PID 1092 wrote to memory of 4184	1092	cmd.exe	98
PID 4184 wrote to memory of 2012	4184	msedge.exe	99
PID 4184 wrote to memory of 2032	4184	msedge.exe	100
PID 4184 wrote to memory of 1080	4184	msedge.exe	102
PID 4184 wrote to memory of 1080	4184	msedge.exe	102
PID 4184 wrote to memory of 1080	4184	msedge.exe	102
PID 4184 wrote to memory of 3036	4184	msedge.exe	103
PID 4184 wrote to memory of 3036	4184	msedge.exe	103
PID 4184 wrote to memory of 2476	4184	msedge.exe	104
PID 4184 wrote to memory of 900	4184	msedge.exe	105
PID 4184 wrote to memory of 2476	4184	msedge.exe	104
PID 4184 wrote to memory of 2476	4184	msedge.exe	104
PID 4184 wrote to memory of 900	4184	msedge.exe	105
PID 4184 wrote to memory of 900	4184	msedge.exe	105
PID 4184 wrote to memory of 3012	4184	msedge.exe	106
PID 4184 wrote to memory of 3012	4184	msedge.exe	106
PID 4184 wrote to memory of 3012	4184	msedge.exe	106
PID 4184 wrote to memory of 4604	4184	msedge.exe	107
PID 4184 wrote to memory of 4604	4184	msedge.exe	107
PID 4184 wrote to memory of 4604	4184	msedge.exe	107
PID 4184 wrote to memory of 3256	4184	msedge.exe	108
PID 4184 wrote to memory of 3256	4184	msedge.exe	108
PID 4184 wrote to memory of 1712	4184	msedge.exe	110
PID 4184 wrote to memory of 2092	4184	msedge.exe	111
PID 4184 wrote to memory of 1712	4184	msedge.exe	110
PID 4184 wrote to memory of 2092	4184	msedge.exe	111
PID 4184 wrote to memory of 5148	4184	msedge.exe	113
PID 4184 wrote to memory of 6096	4184	msedge.exe	114
PID 4184 wrote to memory of 2956	4184	msedge.exe	115
PID 4184 wrote to memory of 2956	4184	msedge.exe	115
PID 4184 wrote to memory of 6608	4184	msedge.exe	116
PID 4184 wrote to memory of 6608	4184	msedge.exe	116
PID 4184 wrote to memory of 6776	4184	msedge.exe	117
PID 4184 wrote to memory of 6776	4184	msedge.exe	117
PID 4184 wrote to memory of 6940	4184	msedge.exe	123
PID 4184 wrote to memory of 6968	4184	msedge.exe	124
PID 4184 wrote to memory of 7024	4184	msedge.exe	125
PID 4184 wrote to memory of 6676	4184	msedge.exe	128
PID 4184 wrote to memory of 6676	4184	msedge.exe	128
PID 876 wrote to memory of 1572	876	msedgewebview2.exe	130
PID 876 wrote to memory of 1572	876	msedgewebview2.exe	130
PID 876 wrote to memory of 1572	876	msedgewebview2.exe	130
PID 4184 wrote to memory of 6196	4184	msedge.exe	131
PID 4184 wrote to memory of 6196	4184	msedge.exe	131
PID 4184 wrote to memory of 6084	4184	msedge.exe	132
PID 4184 wrote to memory of 6084	4184	msedge.exe	132
PID 4184 wrote to memory of 6084	4184	msedge.exe	132

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5596
- C:\Users\Admin\AppData\Local\Temp\Duels+.Launcher_3.9.1_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Duels+.Launcher_3.9.1_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:460
- C:\Users\Admin\AppData\Local\Duels+ Launcher\duelsplus-launcher.exe
  "C:\Users\Admin\AppData\Local\Duels+ Launcher\duelsplus-launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2312.5812.9864974587966720171 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView /prefetch:4 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffba2bc5fd8,0x7ffba2bc5fe4,0x7ffba2bc5ff0
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1796,i,15303584796765485396,16629575309679869593,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=1796,i,15303584796765485396,16629575309679869593,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1796,i,15303584796765485396,16629575309679869593,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1796,i,15303584796765485396,16629575309679869593,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2012 --field-trial-handle=1796,i,15303584796765485396,16629575309679869593,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=1796,i,15303584796765485396,16629575309679869593,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4616 --field-trial-handle=1796,i,15303584796765485396,16629575309679869593,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4868
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView" --webview-exe-name=duelsplus-launcher.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1796,i,15303584796765485396,16629575309679869593,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4eb6d511740c2ce320eb216e82604857a2bbca0a
      4⤵
      PID:5480
- - C:\Windows\system32\cmd.exe
    "cmd" /c start "" "https://discord.com/api/oauth2/authorize?client_id=1399820097807188108&redirect_uri=https%3A%2F%2Fapi-prod.duelsplus.com%2Fauth%2Fcallback&response_type=code&scope=identify&state=%7B%22flow%22%3A%22launcher%22%2C%22port%22%3A50000%7D"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/api/oauth2/authorize?client_id=1399820097807188108&redirect_uri=https%3A%2F%2Fapi-prod.duelsplus.com%2Fauth%2Fcallback&response_type=code&scope=identify&state=%7B%22flow%22%3A%22launcher%22%2C%22port%22%3A50000%7D
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffba099c188,0x7ffba099c194,0x7ffba099c1a0
        5⤵
        
        PID:2012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,15071956548642040052,11652841836219870229,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,9854711051923192751,16600044642458323523,262144 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
        5⤵
        
        PID:1080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,1930587978504443921,7312500519268740487,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
        5⤵
        
        PID:3036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,9721588587974813211,16766981371986930804,2097152 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        5⤵
        
        PID:2476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,16742482594014337533,18042581275105225330,2097152 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        5⤵
        
        PID:900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,17113983050193397471,10263988343403489945,2097152 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
        5⤵
        
        PID:3012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,6345362235992686995,6424195696224089314,2097152 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
        5⤵
        
        PID:4604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,6642550943230687431,15493139131333854103,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
        5⤵
        
        PID:3256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1558527230672722085,15269626695264348287,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
        5⤵
        
        PID:1712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,16408432147496869251,13428763431060893539,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
        5⤵
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,6713143968907324313,4541770312672633595,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
        5⤵
        
        PID:4068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,6713143968907324313,4541770312672633595,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
        5⤵
        
        PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,5062861153809296923,7714481547847113945,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,13979081387719280477,13820262238168364623,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:12
        5⤵
        
        PID:2956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,4927008095861603399,6218359922825303725,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
        5⤵
        
        PID:6608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,822445177765824935,16894826235492837679,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
        5⤵
        
        PID:6776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,6227948947289756474,16382505123418607562,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
        5⤵
        
        PID:6940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,348886304419110448,15832752460397587436,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:14
        5⤵
        
        PID:6968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1452,i,7174648007762082436,17575977598689827165,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
        5⤵
        
        PID:7024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,8591357526095610914,7488358811455826356,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=1468 /prefetch:14
        5⤵
        
        PID:6676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,18308065363118929304,14677792274586946091,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
        5⤵
        
        PID:6196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5160,i,2017155634515638188,6633640955378747024,2097152 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
        5⤵
        
        PID:6084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,4112216044054661316,7983367573236355012,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5400,i,4540029863170859093,6284627744975565394,2097152 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:1
        5⤵
        
        PID:3724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,2238080135697634117,6479756968668917681,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
        5⤵
        
        PID:5076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,7593107186043661912,9650269919086390865,524288 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:14
        5⤵
        
        PID:1724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5676,i,2025167550014068884,3542505187342886952,262144 --field-trial-handle=2516,i,17893615643835888139,16580430461447532017,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

duelsplus-launcher.exe

Path C:\Users\Admin\AppData\Local\Duels+ Launcher\duelsplus-launcher.exe
Size 15.5MB
SHA256 d7fa21ddaee18cb39a8de1a3f5a233039c3b9c54b408a9d4086a792f18d3d6a5
MD5 be2ca7cf8c64f8ff6dfbc8ada9aa8f5e
SHA1 58547133b702bbd413db5c394db1bbaef67639fe
SHA512 6e4d92f5e83cf7bfa9336e812a2a0f3a0a1505ac1fd59d7d1dee92b38453aea8c06a0b4c6133901366f560446dbbc09714e872791d29d4c6532d67f4f8e775b4
SSDEEP 196608:LgUxipiMNWpnJ+pOnFdqgLIf74FiknwXGK8B0cLRPOGy6tQ:LNQiMNWpnJ+pOnFdqgLIyF3/0AWGFQ
TLSH
T1E5F608257B5A99A8D09BC47483878A72493130DB0B35B9FF448892383F79BF56F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 6026648f109bcf42d8f006e48e1a210cebbb7840f23ffbe718b266cec29a11fc
MD5 4d3f240da5d0f297ad8ce0468929bce6
SHA1 5a998907b2e7f00d86956fbd05f8db5d3549d448
SHA512 5d729464417ff454c3ede495c5fbc06ddc748e8f7b557d590823bd526c9ea7d2051f8b11083df6b29d8cc843a659a62da2743604c8fb11d3ebcbce1d2024d361
SSDEEP 192:mzQMIEZrDn+jiKI5GMmpOhIeW2P0urlis19LbD:msMrn+pvctMyT3
TLSH
T1E212514A51A550A6E7547D72C8E89D82FE38B11CCF8BAE332093E9F5BA1F370C466304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 05131a50d39fc7fbe3c603c9a2bc4480aa63e3d39c655dffa35ddd6cc1fa41d8
MD5 40e7343b13dff80c60b4fdc0030abfcc
SHA1 7d5bcef2d0414bb2b82e4ae2294d7ae6b4ae36b3
SHA512 f8c30fcc0e7e5bf1ba1ad1c6e95a790ed7d20ed43cc68b1b03f31706ef6e3338b05304736b30bffb9b82d4afb251805ed9dc9064e4e4e17a55327b32c6700429
SSDEEP 192:yzQMIEZrDn+jiKL5GM6pOhIeW2P0urliu19LbG:ysMrn+0vct8ITK
TLSH
T1C512634A15A550A6EB547D72C4E89D82FE38B11CCF8BAE332493E9F5B91F370D466304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595644.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595644.TMP
Size 2KB
SHA256 e506f80882645c426a7f28011a24800e1a5fb719df92d6a63ca9e2868d08e34d
MD5 78696f6ac7af5c146897e8c1bda4d289
SHA1 7c1154178ca07844ebc94790670efa9d328f9081
SHA512 9de040fa798c99abb54212afa603d370fc292f5c57c911a70748067158f5832a59ec6b9d88ddf73706a67c62da66bb3be0e8274a99c2920bfb61e26835b48997
TLSH
T16441F64B12B848ABF79854378ECC8ED7B63CFAA190C3EE112594CDFA6E6537081A4704
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1b07da7f3641b0f83d28c88482c5cbeea34fb8ab50eb0aa5c272b8b25e1920b3
MD5 5ae102fd67c4b64830209ae2bc30b5fa
SHA1 b68271083130e79881b9f43c0bd991cc2bad121f
SHA512 e2e06378bf5430ad5f339d22c8954fa62226b81e6d7020c29ec9e4c93cd40d5bb644a4e077c36166fcd8e028bff3d588db54c60212ab5c094dea73298aa27661
TLSH
T14661A0F3C7E8862DDD1156F4AB142E1BCE2D0914432C3D6AC9D49F5B93E24B1E181A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 15191ef0ee23ae2d1575d68d26564bd3b1dc649bc3dda074d6ecaabe8612c7c1
MD5 cf1240849721ccc54611638fcf68ab68
SHA1 aee2d7f44ed34d8dc3eac66225358189dcba3057
SHA512 3a3a6e12fcfa75208949fcc88617936ed2bc4e12d635c93f7cf3fc9857a90f5b314db56fa83f9a78710e7c72bad824d898e9284c61b13dd27957175716fed725
TLSH
T17931BEF3C2E8467D8A0155F87B182E1BCE2D0955932C3D56C4D49F5F93F28B1D28099E
MD5 SHA1 SHA512 TLSH

Submit Download

b790c72f-cc96-4e29-a54e-091d22ccf813.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b790c72f-cc96-4e29-a54e-091d22ccf813.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 32cf5c7b2e17425bd419760c5387bd9ef6044deb7189fc9786a74700597ac0ca
MD5 f4c9a68e2ce65b40391a3b7e61e5aee1
SHA1 5ffa8803897fdfca3b8a7ca8552401a590d3b99e
SHA512 7924341f4946510334ea72e36cc5e86d55b59c41069b2d030f69e8c1e6bb0ff11da11c025bc8c6c1fc81ac7a3aa5bc74aafe0d14b6d9414a12284e271728df73
SSDEEP 192:sxR2R2CD/fDsfbI2ZsghzoA8plR/g6+WNpFD/YuniPGDIgtJ:sxR2vD/fDsDIAsgcH/53/P3
TLSH
T1EE329516AD28A93B8CCBD21DFB597F53D3F95032A0915E58E6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b5919ec49209b3e00fbea22865350ff6e9efe6412aa3ebb13165f9cad1c40c26
MD5 44145fd3c0e94d6d72d9325e4e9959ed
SHA1 b82b704e83a2070a309d9000c779bbf705f1110f
SHA512 57e8505b9b576f3f39ee02d48783c26b0488323c77f03e112c938406b882f1bee16d899d46080cb0b12e2868f439caca450e179d48f057d0f487af2b20b1d067
SSDEEP 192:sxRhR2CD/fDshbT2ZsghzoA8pTR/g6+WNpNqZ+dAcnwRiPGDIgDLJ:sxRhvD/fDs9TAsgcN/5iZVJ
TLSH
T1EE429656A9286D7B9CCBD21DFA55BF53D3F91032A0915E48F6FC861C14E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e0b22cc55332346469bc6e02fb4eb9cc62598d611e830d60c07dc92c9af1c97a
MD5 af4ff873eb063853fb674a0ff20034e1
SHA1 9bd7de409b04765f6c4d6261710b59a029f6c356
SHA512 82dfa34f56128ca309c7428ce8905fca8610123d8761edc222ab72d5a34480a186e8caac71430c64745de66c11234815e05e2ddcd4cab6001576cebe0b00c6f5
SSDEEP 192:sxRNR2CD/fDshbI2ZsghzoA8plR/g6+WNpFD/YuniPGDIgDJJ:sxRNvD/fDs9IAsgcH/53/P/
TLSH
T1BF329516AD28A93B8CCBD21DFB557F53D3F95032A0915E48E6FC9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bbe22f9112648513f6e0c4ad870ce951127843b7fe1bb5cd035ad6b757487655
MD5 f0e9fc12503e2745ebce8a3cd7394f73
SHA1 7ae9836528cfe30675624ce839cf5658cadf90a3
SHA512 5ed0c24577413d97862c906ee628ddf013268b2e0748306194c706d8659c36f1ec733f5225253fe9be29095c4d2066bcf9f47edf92575da32c3845c1b6e71f20
SSDEEP 192:sxRNR2CD/fDshbT2ZsghzoA8plR/g6+WNpFD/YuxiPGDIgDLJ:sxRNvD/fDs9TAsgcH/53/ZJ
TLSH
T18542961AA928AD3B9CCBD21DFB557F53D3F95032A0915E48E6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ec41937104ca039d576185927152989f7469cc9610a78c700b317f7f204e9ce5
MD5 507728820bc02299f3042a48fb7734b4
SHA1 aa7a657720cdaadc95600fd64c01d4081a62408c
SHA512 3b99ec421e980c67a0fcea2dc47508d23ce6289ab614975d48e5caa2109793fe8c16f4eb4b8b3ac2081f53c4a915557d036364c63c22f923dccb823cabae39ff
SSDEEP 768:/jnhTH7pLuLbcJWg6cfmw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVixlRkPirosLkFI:/jnhTBEbcJWg6cfmwu1ja1xliP5OoI
TLSH
T1EDD2DA7B740CCA7E4F800ADDDC197E9B6DA802CB9698CD8047FE985C02D6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\1ec8242b-cf8c-4df8-ad09-fe0ec0d82ca0\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 2ead9b459a586d240501aae09fc10eaaf7f3717362372ecec52ad8841040e821
MD5 85ba084d4311b94a6d39a05deefdac79
SHA1 744a870e04f830f4f30129b6e776afed4bf6f790
SHA512 42d159377b66670512261093c1e4c632ca26dc4a947e28fdb28c9dcc6b4bc636ca3a3142b8dc1bb9be2d09ff1e2c62f7326a88f7043b95003844adb747452beb
TLSH
T1F3D0230FE4000491E9BB5F918B71053B8B20BC8C28C1908CF0030019C891EA7C602FB3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 32db09889a5c0256828fa5df65d23c0c089584916ab119e4e4adfcdb88ba4fbf
MD5 6d8377cce36b1a4e466bffbf5b501043
SHA1 5e760edffde97615ffe27a63ce8a3b44e8272276
SHA512 3eaa4550befd48a727cfed416042d01511fc890255e936fb8d44cf127113ece83dd12f375246342ce7cfea9b089de69665c9cc27e3180b0f5f08e30c0af35f9e
TLSH
T174D0970FE8000891E6771F928A71012B8B60BC8C18C190ACE003201D94B1A97C611FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58de36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58de36.TMP
Size 138B
SHA256 654428a15fb850da3d0f53fe748bef588b3065c463cba54d607b9fd93fbc8696
MD5 a0efe12bfdd4dc0ec9169b6255196337
SHA1 842c97bc1becb80a5ab5f84b6faddd35bb0578b5
SHA512 e1c3bffc3fad3ee357ac5abbafc7789237ed598ad93f95588f1779ab37bfe933418aabc17bd1c25487da1df67605466b9c1d228baa4baf367c878b3aaccb1293
TLSH
T163C02B63F0010411CB331F910332520C8B017CCC5CC2848CF043341860B5E236746FE6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b6ab094ca352865517edd0ed66d2806a6112843651f4fd585291c439c390e40f
MD5 c4db28238a57005f0c91aedc12564dd4
SHA1 8407906abad493193f3aa3959d5f97e23badb07f
SHA512 8b0a33a40fd2a5784bec97685e27553235e6ffac718c1bd3bc0f0aaee4a70fa419adfefa5ee34e4dcb081195fd0498f276dc981fe8798ca324cebc11e6382e90
SSDEEP 48:KgbIhKU48/yBEIzKRy8MFIFKuA4Py1Fwhz:KgbeKU4uiEIKRy9FSKuAKUFwhz
TLSH
T10391366431760210793E791986E9BB1F8A8271633154ED3B77EE0492DE7AE184CFC6CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\c1a37554-4ed2-4fce-9539-50b744970f50\index-dir\temp-index
Size 72B
SHA256 68652a7f79fbd8e786261fed59f90dfe862112bc537f8dc7108e3fc956ee7cba
MD5 f7402b9ba5baf51717ec1dcadbe82c41
SHA1 8ccea137ebb1d51be48f86186d8f1df8fa53a77b
SHA512 624350643a75de602dccfe9e33301d380ddb55936a647a4aef887a87f9a94d7304f43ad928eaabaef12f51027650e5c1283287ee86d10e8771149d9624a17afb
TLSH
T18CA0021443C95544D82045B4701A1BB52700C86414600713C89115AF8C901C45D71815
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\d80a699b-32d9-48cf-ad84-953a536c1e68\index-dir\temp-index
Size 72B
SHA256 f516f28fb8c5677b282ee93a65bea50a28e2051cb8b5a4a96b4f0ee4f7c8d208
MD5 7604f56ad4417e1c8488e77a73fa6f9e
SHA1 0db490c57baf2d073943e23cbf0082d8e94d2c3e
SHA512 b3dde209e4cc8208ae60c37e6f44768bac3949c406f8b65bb6b914cb0e19b76ddd3ab02349bb04c0b6d38f6a4a0df7835138df3ffc657e3fbc88cd3a8fdda1c2
TLSH
T123A0041043C511C0D01431F571054FF57700FC7404511747D4D051CDCC51DD47D11015
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 36e7c25fab6300ed0be7c8913643726e2ccc751df4e6d3bb5e7e0cffc28530df
MD5 5fc878dd40e35a423f97cfa31b443dca
SHA1 cc4be36ec1a3b3249e49d2e05a2ce04d1e959bd0
SHA512 da7e1413f996f262b67d01af36fabdd8ac5c913151b555c2ba6341c3f9d1404155684dfee65a2c772587df4b551329872483d4ac0375532bed563916ff5f4544
TLSH
T167C012B790A299912FF525EB215B32C8C93A7FD99CC4EA4C9463302D223886B1400925
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59fcc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe59fcc5.TMP
Size 178B
SHA256 76e980946e3c0b74b75fd64ecb9e89b13061d605fab94aeaf4686248a7c2ace6
MD5 d73c31f9c675cd4df1074b9e58bfd68d
SHA1 fe46f01dd93f981110def95a84e88e41e439f19f
SHA512 7fc1805ecef99c9401460c44a5f913f71b9932277ce64c36164c76a75540b6b1b54fc44cbbc3c2cbaddfeed80d280b16b613d95ace9543a062a92338c0c95f27
TLSH
T1F5C012B750928AE52F6924EB122232C8C9363FC85CC4964D5462340931358671505A60
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b731.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 8a5060ae7a7ccc9124a4c625c82c98cf749b7a041e59d8aa82d9753480d6b106
MD5 83f7a72ce8cd38973a8b0ca6c47e3a2c
SHA1 918c5ac94224e86201dd7218e3dc5012ecb864ee
SHA512 1f3b94607b8999ee1ebb5ea6d8945b7a5e63290eefbea2a543abbea75ecd2aa72584ec0209e72fd32cc1450a056dd5d080588b595d13a216423d755602e44029
SSDEEP 768:+FQL3Pwgl17QCXO5YhLJMIYNa8S5oYklnA+zwcTRsL:VL33AkjTWRdA4wcTRsL
TLSH
T1CC1327F598D38976E8AE5387A33D6E419EBCD163B1885994FBD80E4DCC821BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bf5b34c9e11020458fe64cf06f46c16a588ba85a85f3930bbb74708463bda109
MD5 f80144657ed7dabe43d619212fdeef02
SHA1 36022cc7651eda2dd48c13e7a19327b448f39385
SHA512 73183fe8078e17a3e0bec3b33d29daaac47a63e5fd9c5c15bcf35ac71cf0d0c72e4e599fdb5a01f167233a9aaa02ff4a1dd4ea38cb10d802588d962b3373bdb6
SSDEEP 768:do/UxvxjgC+23bfGSO5Yh9JMIYNa8S5oYklnAaTSH8L4:nZj3+23zSk9HTWRdAAS04
TLSH
T12103C03A9D94A9738CF663C4770A6757AEF55223D0C16AF889EC1F0E17C72AD5303451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 dc274568e0f844c2bab1a80bf8cf7d4251cf8c0e411f1d9942a2a9014bc6ab3b
MD5 434540a9d1a4188f98eb115d2da8084c
SHA1 50c2c571b4a76dec517272730f332feb80dc6b29
SHA512 600a4ae8817cdbcf28a0760614b1f0e842db42a200534578e25f6d314b28622a5da9315824f077a90874a6fb4e50ce361c7a3fe3a1ed6b6c2e475e9149bfb15e
SSDEEP 768:F9/3k17VYSO5YhLGMIYNa8S5oYklnA+zwcTRsL:3/3kkkwTWRdA4wcTRsL
TLSH
T178F2CF35A9A4DD739CEA93C9B20A7B52BEF5112381C90ED8D9EC5F1E05876AF0703812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a84d894ead3e62e5256858b56ec8669d5bdcbce99ce89aa9113db017561cfe21
MD5 aedebc3dff96e5cdc6b32e5108a4da57
SHA1 54f707fd6cd8a5130c8d8119eb75f8e694aa1af2
SHA512 9cbd1dd121cd398155ca0e0dfa5768174965b8cba3a42ba253e0a1cbba8fad581233f427cab270f99a0f204026eb16218e93b3d4b72e908c52401302a9eb8237
SSDEEP 768:s/3117VYSO5YhLGMIYNa8S5oYklnA+zwcTRsL:s/31kkwTWRdA4wcTRsL
TLSH
T105F2C035B9A4DD739CEA93C5B20A7B52BEF5112381C94E98D9EC5F1E05877AF0703812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

9473f1e3-1eb7-41c1-934f-479645ba8df8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9473f1e3-1eb7-41c1-934f-479645ba8df8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm96CE.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsm96CE.tmp\modern-wizard.bmp
Size 150KB
SHA256 e004d05220d6b5334625b748cfe6daccea3b91c0b8413858f553838be5935f26
MD5 8f4c86bf3f23990a01113e0c935c4d0b
SHA1 f00bd1597ff0a2d55a9a47288a334f8837ca74f5
SHA512 482ed9c8e186155e339cd3f4cba86734ab0e8cfbcaf12b646ab2879ebf82807b7ba220ab0c5376507d3161977d245ece75118cf5c36301c7a6d1a40eda24f41a
SSDEEP 3072:Ppj2ppppppppppppppppppppppppppppppppp+pppppppppppppppdpphppp+d:Ppappppppppppppppppppppppppppppj
TLSH
T182E31D6A044428EC14BF042ACFB054A374D9573E4DFFA4DF5C21C1B939AAD29BFA5B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm96CE.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm96CE.tmp\nsis_tauri_utils.dll
Size 32KB
SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
MD5 6ebdde247cad8468575f1f2a4d7ae2a2
SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
TLSH
T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4184_1908026358\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1d4d6f25b376ac4fbcad2b7e222757800781481cba8cec7cac63dfaaa2cf9364
MD5 44b04a4148147152f20a2bc51399dd04
SHA1 ef0356772784073e3f21c3ba64dce2a2d70640cc
SHA512 9a4fb08f6ce05fc205a7e78dcc1284993c66a3897071ec87267a795b4512be64262cdc9f0a7e05df7ae875974bba4134cb04fa859e55f67ea9da397a58dac79e
TLSH
T192D0041151171001D015117F1115C14001515D40FC1351C41414400D17434400401400
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 63a248a4cf0ee599c772859bdf642691d733d60fe15dc86f3a98bf9665a014a4
MD5 bf597f6cbf17152f46b31dc514318727
SHA1 171d98ceb7d252b25dab9b512ed461fc6e52eea2
SHA512 df4d0f27567a431b817a36e49544baebefc5fd1e78c16652cf535ac4e03e3d1767ad9533802440fea8e637ba6536572034bae337bf848d0c4c6611615c078119
TLSH
T1FED0121332130134C02021771103A1480441D60BD4068084682CC51E2B054900D02841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d53020fe80bf96850398b049a593c8ab6d9b0a8c6f9d75e6e29504c085a06fed
MD5 83cbf582cda9dccd51ae3d10bf2ee634
SHA1 d2b3fd1add61bca31215ba7912b97465897450c3
SHA512 90cb0c2977a02b85fb99c6888663ecacd791f841bf3aa413f7ff28470256dc55d659c6f28023957a02a254627c8b26b43011f37e72653750c578e25300039585
TLSH
T194A0022252D00522C34227B515E603807A31DE5C17030B57849203B4EA563648213001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0d49aff290b7252e6d660435a9bf9b701090e75b77253f3633c8f56d6ab8eab5
MD5 b671a95277815155f190ed880db88bcb
SHA1 4bdc3f18c1441f199227426ecfac0a94a2469aab
SHA512 8d6af3d9aaa494103e4da430f20b5759b2bf396b470f834a2042af0834497c1c8b9c47c1a2e8874428b8776c46bd34fe9d20571a8c82b85079669a9bd23a3011
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59e18c.TMP

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Network\Network Persistent State~RFe59e18c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 f61294d73cd22e49335ab2d8dea24de87b547bda11d05ac4e478a410e86df061
MD5 c9f5b9dfa73463571f5be24d451fe754
SHA1 55dcf0ccdf489b1bd4c0985cc470102941959718
SHA512 25f9fc905c8028f5fc8d89102d7bac243f9161a1864d580b07a226e73638be03ef647b0eb36724d4173c5a9d9b0dfb005587dd5fdbdcc1742a560596a8b79324
SSDEEP 96:stb/dEjCGf3b9nk4o5h16Z0oRs7/x+6MhmuecJoVMv1ejeTtSK+gs+h28XM1C7K:stjyjLonMsV+FdCQQj0pG6K
TLSH
T13FD19606AE24797B8CC6E118FA357E13E3F9607265D11E58E7F84A1C08D66DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a2d6c0f3-6902-47f1-9244-a90c2b4b746b.tmp

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Default\a2d6c0f3-6902-47f1-9244-a90c2b4b746b.tmp
Size 6KB
SHA256 75651ebafcab31c9109cda06b827ee03f51d33b98c93150589b887d9e8aa99c5
MD5 f3441802ff26351ba08c0c0636a95f12
SHA1 33aa68f71df01684e71c6d7047e6c2784e8345e8
SHA512 cacf293c9fab7f9e15bd2804bb09da587e9f7bfd833e473aad7da2958999dc612d7f3a594de80320249e129b2498db7f8234b5771bc122795d46f1cd571e539a
SSDEEP 96:stb/dEjjf3b9nk4o5h16Z0oRs7/x+6MhmuecJoVMv1ejeTtSK+gsWQP28XM1C7K:stjyxLonMsV+FdCQQj0wG6K
TLSH
T117D19506AE2479BB8CC6E119BA357E12E3F9607274D11E54E7F88A2C08D66CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Local State
Size 16KB
SHA256 ce2847ca4b5f94f8aebff35eac5131cb8486ed722dbe1f17216af564fa17c669
MD5 87d732b70a177590817b15710e574325
SHA1 14ff7a698711fa9f489e98d7320f65bb2b558970
SHA512 6705b6e96829ae8a77aed2b26de37f34fd7b71c93f0003bc6d8483226acc535e450de2400328a550a242fd83f30db13d825fbbeee48a5cb2bc30710cc8980614
SSDEEP 384:6+aQikB+z/xvxjg/qhEbNBSkkRUiS449z2:F/UxvxjgC+3sBSpF2
TLSH
T17C728E3BA5653D3399F3E50479590F8BDBB894A290C76EB84ABC5F0A06C72C40347D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Local State
Size 2KB
SHA256 f1c93bd79b0c08932b04c9455e85f1fefaca4271344ee72c09ebd6bd60093b16
MD5 ae5d836f1c850a8f780647c34308116c
SHA1 8fac81380fa0db32ece53e3915ee7a6c24446dc1
SHA512 e252fb470aa8975add12776883af2cd2b811480e8b3e80300c66b7af35e6ac7ab45afe8bedd33c12c41de929d2015caeb4d62e8d1239f64c2265abb7d7ec8091
TLSH
T15F518473B9507E3789E28A04B98A3F92DF7590E5AA522F1069DC0B1C41CB58C2347C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Local State
Size 3KB
SHA256 799add6c9e1ff37cc5ae26be397ada01c0d7e8dc332300e42316f739caf0fca9
MD5 7a2c24ad266b2f6b2b4bfb30816ee614
SHA1 9b79cf470013c675dfe39ae02e24b17b310a5f11
SHA512 24f77b067ed9eac11e20c9c56a0ce7711f26b98f4fdd34029ec09a2615bf66614799be4b21b5be532d617f70fa8b37863352fa4259207c50b340b07d763a7f33
TLSH
T15471947BA9A0AD378DE2D904B8863F56ABA15067E5867F55D9EC0F0D01C72881343C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58ba14.TMP

Path C:\Users\Admin\AppData\Local\com.duelsplus.launcher\EBWebView\Local State~RFe58ba14.TMP
Size 1KB
SHA256 274da33881c9d66341a22a43d07a09ebe65fc03f1a4f2e21948ff9e0346fcbb3
MD5 d0d3c7c355eecab9891a84fa42f73171
SHA1 eb7bf2e5c94976560c6318c710739a0d399042dc
SHA512 54e9ff26a57048fac097913f4fe9e2fa8434120b43250f382416587b2a27e6b7baeb81c8322acbf36ecc1b515135c8dd64f9d41f0dbda15411e822550b383024
TLSH
T1D03196B6E9A02F329D9155063587BFC75F7050FA62428F0825DC8B2D52DB08CA62FC33
MD5 SHA1 SHA512 TLSH

Submit Download

Duels+ Launcher.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Duels+ Launcher.lnk
Size 1KB
SHA256 faa49cbdf6114e74007896b1bb5b3d98da2370e0e1881cbc598d3a578044c6c5
MD5 d02dcf026729c7b5cd596fe7f5f8784b
SHA1 dbc269784ccb7b07cc3770747f68a0c6a1c3d43d
SHA512 6a8ac3c245ae87fa21424b336635634ca0928153ac4512b70b137f5c62f278edbb0128a33cf68f61a6e30a73e30e254e429f430983a9cb4e48f737c7ad307acf
TLSH
T1A92133118DD9278EC77687F5797B22344776B81BEF710F4C0040C14219AED02ED15D3A
MD5 SHA1 SHA512 TLSH

Submit Download

Duels+ Launcher.lnk

Path C:\Users\Admin\Desktop\Duels+ Launcher.lnk
Size 1KB
SHA256 e42e7ca3b5ab59ea2bce3e34c2ed7626018d415011821422a09d72a3d005a336
MD5 2a6aee291691cf584cc9c3f6c290f34f
SHA1 77dc35e8722218a86ff6eb74596b2c5d0a2d81af
SHA512 a4c1c1ed22f8e7fac0e4e44b5f0797bc85a6db84d4869ff7b379c5da33faac2902e537e9572b2f97ab5563bfe138f5feb1f47556718c808710be7987fc5843fe
TLSH
T1542133114DD9169EC77B87FA7ABB32354775B45F9F610F4C0040C20118A6D02EE55D2A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-96-0x00007FFBC3890000-0x00007FFBC3891000-memory.dmp

Download

memory/1572-1394-0x00007FFBC3D90000-0x00007FFBC3D91000-memory.dmp

Download

memory/1572-1393-0x00007FFBC4570000-0x00007FFBC4571000-memory.dmp

Download

memory/4188-167-0x00007FFBC3890000-0x00007FFBC3891000-memory.dmp

Download

memory/4868-1654-0x000001764C3F0000-0x000001764C3F1000-memory.dmp

Download

memory/4868-1660-0x000001764C3F0000-0x000001764C3F1000-memory.dmp

Download

memory/4868-1663-0x000001764C3F0000-0x000001764C3F1000-memory.dmp

Download

memory/4868-1662-0x000001764C3F0000-0x000001764C3F1000-memory.dmp

Download

memory/4868-1661-0x000001764C3F0000-0x000001764C3F1000-memory.dmp

Download

memory/4868-1659-0x000001764C3F0000-0x000001764C3F1000-memory.dmp

Download

memory/4868-1658-0x000001764C3F0000-0x000001764C3F1000-memory.dmp

Download

memory/4868-1652-0x000001764C3F0000-0x000001764C3F1000-memory.dmp

Download