a4ac9dcd045e9f21bccceef2846a209f25deb2cca87019893938604413ec7e8b

Resubmissions

27/10/2026, 23:15

261027-28wpqaxvaw3

27/10/2026, 22:53

261027-2vffksef658

Analysis

user interaction
yes
max time kernel
689s
max time network
691s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
index.html
Size 12KB
Sample261027-2vffksef65
SHA256 a4ac9dcd045e9f21bccceef2846a209f25deb2cca87019893938604413ec7e8b
MD5 bfa04495e0ca71ba63cd9dd34c4e77e8
SHA1 f26710602b5d232a69954ae1ec3a22e46ea4c48f
SHA512 516d9b0d0a339a268799b353e4991d07e7f416bff3ef52d86eebac48c22cf18a8cdad7e5c4e6472d2e303ade2b16d44d782713230c959f93bc934e27c77e094c
SSDEEP 192:Gz37c4FBycygOgSxUuZSTtUR7Rc0R5T+GcBAyqRI:EB+U47Rt5T+BH
TLSH
T1AC42E9A77DA655192223C0945BBBB33C74366407E705CC50B69D93A4AFC8FE38CA359C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
145	1596	msedge.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Hytale F2P Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Hytale F2P Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Hytale F2P Launcher.exe

Executes dropped EXE 8 IoCs

pid	Process
5856	Hytale-F2P-Launcher.exe
2440	Hytale F2P Launcher.exe
4936	Hytale F2P Launcher.exe
4944	Hytale F2P Launcher.exe
2244	Hytale F2P Launcher.exe
1932	Hytale F2P Launcher.exe
2132	Hytale F2P Launcher.exe
5812	butler.exe

Loads dropped DLL 23 IoCs

pid	Process
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
4936	Hytale F2P Launcher.exe
4936	Hytale F2P Launcher.exe
4936	Hytale F2P Launcher.exe
4936	Hytale F2P Launcher.exe
4936	Hytale F2P Launcher.exe
4936	Hytale F2P Launcher.exe
2244	Hytale F2P Launcher.exe
1932	Hytale F2P Launcher.exe
2132	Hytale F2P Launcher.exe
2132	Hytale F2P Launcher.exe
2132	Hytale F2P Launcher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
5252	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
3144	powershell.exe
2536	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2648	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Hytale F2P Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Hytale F2P Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Hytale F2P Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Hytale F2P Launcher.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hytale-F2P-Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1596	msedge.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{74A85CD7-DA0E-40B1-9C68-F63885D11CE3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{7F71D394-F06A-41A1-811E-CF258A4656C9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2648	powershell.exe
2648	powershell.exe
2648	powershell.exe
2536	powershell.exe
2536	powershell.exe
2536	powershell.exe
5856	Hytale-F2P-Launcher.exe
5856	Hytale-F2P-Launcher.exe
3144	powershell.exe
3144	powershell.exe
3144	powershell.exe
3896	msedge.exe
3896	msedge.exe
5252	powershell.exe
5252	powershell.exe
5252	powershell.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6068	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeIncreaseQuotaPrivilege	3144	powershell.exe
Token: SeSecurityPrivilege	3144	powershell.exe
Token: SeTakeOwnershipPrivilege	3144	powershell.exe
Token: SeLoadDriverPrivilege	3144	powershell.exe
Token: SeSystemProfilePrivilege	3144	powershell.exe
Token: SeSystemtimePrivilege	3144	powershell.exe
Token: SeProfSingleProcessPrivilege	3144	powershell.exe
Token: SeIncBasePriorityPrivilege	3144	powershell.exe
Token: SeCreatePagefilePrivilege	3144	powershell.exe
Token: SeBackupPrivilege	3144	powershell.exe
Token: SeRestorePrivilege	3144	powershell.exe
Token: SeShutdownPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeSystemEnvironmentPrivilege	3144	powershell.exe
Token: SeRemoteShutdownPrivilege	3144	powershell.exe
Token: SeUndockPrivilege	3144	powershell.exe
Token: SeManageVolumePrivilege	3144	powershell.exe
Token: 33	3144	powershell.exe
Token: 34	3144	powershell.exe
Token: 35	3144	powershell.exe
Token: 36	3144	powershell.exe
Token: SeSecurityPrivilege	5856	Hytale-F2P-Launcher.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	2440	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	2440	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	2440	Hytale F2P Launcher.exe
Token: SeIncreaseQuotaPrivilege	5252	powershell.exe
Token: SeSecurityPrivilege	5252	powershell.exe
Token: SeTakeOwnershipPrivilege	5252	powershell.exe
Token: SeLoadDriverPrivilege	5252	powershell.exe
Token: SeSystemProfilePrivilege	5252	powershell.exe
Token: SeSystemtimePrivilege	5252	powershell.exe
Token: SeProfSingleProcessPrivilege	5252	powershell.exe
Token: SeIncBasePriorityPrivilege	5252	powershell.exe
Token: SeCreatePagefilePrivilege	5252	powershell.exe
Token: SeBackupPrivilege	5252	powershell.exe
Token: SeRestorePrivilege	5252	powershell.exe
Token: SeShutdownPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeSystemEnvironmentPrivilege	5252	powershell.exe
Token: SeRemoteShutdownPrivilege	5252	powershell.exe
Token: SeUndockPrivilege	5252	powershell.exe
Token: SeManageVolumePrivilege	5252	powershell.exe
Token: 33	5252	powershell.exe
Token: 34	5252	powershell.exe
Token: 35	5252	powershell.exe
Token: 36	5252	powershell.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	2440	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	2440	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	2440	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	2440	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe
Token: SeCreatePagefilePrivilege	2440	Hytale F2P Launcher.exe
Token: SeShutdownPrivilege	2440	Hytale F2P Launcher.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
2440	Hytale F2P Launcher.exe
2440	Hytale F2P Launcher.exe
2440	Hytale F2P Launcher.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe
6068	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 5808	1572	msedge.exe	84
PID 1572 wrote to memory of 1596	1572	msedge.exe	85
PID 1572 wrote to memory of 2380	1572	msedge.exe	86
PID 1572 wrote to memory of 2380	1572	msedge.exe	86
PID 1572 wrote to memory of 2380	1572	msedge.exe	86
PID 1572 wrote to memory of 2516	1572	msedge.exe	87
PID 1572 wrote to memory of 2516	1572	msedge.exe	87
PID 1572 wrote to memory of 5840	1572	msedge.exe	88
PID 1572 wrote to memory of 5840	1572	msedge.exe	88
PID 1572 wrote to memory of 5840	1572	msedge.exe	88
PID 1572 wrote to memory of 1316	1572	msedge.exe	89
PID 1572 wrote to memory of 1316	1572	msedge.exe	89
PID 1572 wrote to memory of 1316	1572	msedge.exe	89
PID 1572 wrote to memory of 2956	1572	msedge.exe	102
PID 1572 wrote to memory of 2956	1572	msedge.exe	102
PID 1572 wrote to memory of 2956	1572	msedge.exe	102
PID 1572 wrote to memory of 4848	1572	msedge.exe	104
PID 1572 wrote to memory of 1056	1572	msedge.exe	103
PID 1572 wrote to memory of 1056	1572	msedge.exe	103
PID 1572 wrote to memory of 1568	1572	msedge.exe	107
PID 1572 wrote to memory of 4860	1572	msedge.exe	108
PID 1572 wrote to memory of 404	1572	msedge.exe	109
PID 1572 wrote to memory of 5268	1572	msedge.exe	110
PID 1572 wrote to memory of 5268	1572	msedge.exe	110
PID 1572 wrote to memory of 5268	1572	msedge.exe	110
PID 1572 wrote to memory of 2472	1572	msedge.exe	111
PID 1572 wrote to memory of 2472	1572	msedge.exe	111
PID 1572 wrote to memory of 2472	1572	msedge.exe	111
PID 1572 wrote to memory of 1812	1572	msedge.exe	112
PID 1572 wrote to memory of 1812	1572	msedge.exe	112
PID 1572 wrote to memory of 4136	1572	msedge.exe	113
PID 1572 wrote to memory of 4136	1572	msedge.exe	113
PID 1572 wrote to memory of 4136	1572	msedge.exe	113
PID 1572 wrote to memory of 3396	1572	msedge.exe	115
PID 1572 wrote to memory of 3396	1572	msedge.exe	115
PID 1572 wrote to memory of 1352	1572	msedge.exe	116
PID 1572 wrote to memory of 1352	1572	msedge.exe	116
PID 1572 wrote to memory of 4708	1572	msedge.exe	119
PID 1572 wrote to memory of 1476	1572	msedge.exe	122
PID 1572 wrote to memory of 1612	1572	msedge.exe	123
PID 1572 wrote to memory of 1612	1572	msedge.exe	123
PID 1572 wrote to memory of 1612	1572	msedge.exe	123
PID 1572 wrote to memory of 2192	1572	msedge.exe	124
PID 1572 wrote to memory of 2192	1572	msedge.exe	124
PID 1572 wrote to memory of 2192	1572	msedge.exe	124
PID 1572 wrote to memory of 5856	1572	msedge.exe	125
PID 1572 wrote to memory of 5240	1572	msedge.exe	127
PID 1572 wrote to memory of 5240	1572	msedge.exe	127
PID 5856 wrote to memory of 2648	5856	Hytale-F2P-Launcher.exe	129
PID 5856 wrote to memory of 2536	5856	Hytale-F2P-Launcher.exe	131
PID 5856 wrote to memory of 3144	5856	Hytale-F2P-Launcher.exe	133
PID 1572 wrote to memory of 3896	1572	msedge.exe	136
PID 2440 wrote to memory of 4936	2440	Hytale F2P Launcher.exe	138
PID 2440 wrote to memory of 4936	2440	Hytale F2P Launcher.exe	138
PID 2440 wrote to memory of 5252	2440	Hytale F2P Launcher.exe	139
PID 2440 wrote to memory of 4944	2440	Hytale F2P Launcher.exe	141
PID 2440 wrote to memory of 2244	2440	Hytale F2P Launcher.exe	142
PID 2440 wrote to memory of 2244	2440	Hytale F2P Launcher.exe	142
PID 2440 wrote to memory of 1932	2440	Hytale F2P Launcher.exe	145
PID 2440 wrote to memory of 1932	2440	Hytale F2P Launcher.exe	145
PID 1572 wrote to memory of 1736	1572	msedge.exe	154
PID 1572 wrote to memory of 1736	1572	msedge.exe	154
PID 2440 wrote to memory of 2132	2440	Hytale F2P Launcher.exe	155
PID 1572 wrote to memory of 4652	1572	msedge.exe	156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff12a3c188,0x7fff12a3c194,0x7fff12a3c1a0
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,11139487094219747404,15795975258315251413,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,7155660260452948298,17282030525064201137,262144 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,11525616884102676666,14991796552018509378,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,15909899204212649252,17243534497132881956,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,9168373546382309788,796339459685236599,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5244,i,17208877518122729862,3114665437854772466,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,15053583817609767043,10122260372445249881,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,11594501551636762991,13871553898182708694,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,16883449065598375239,11408940860804012775,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,11572358238623799010,1656396124248442711,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,15504013954096257535,5331754983759304167,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=2612,i,8355562720848029052,10721233412775915540,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3888,i,3632576738024955760,8923314817431796722,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,17517156255885602170,5047827709084415072,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6436,i,9160329294525914942,14194602715189161915,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,1513341325939756320,4828194803833405823,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,10531773016009250970,15144223809487872614,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,16888082762445428628,18325079880341642088,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,16888082762445428628,18325079880341642088,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,9606798934615460029,5780084337890988213,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6612,i,10555087360379195656,11880979529523774533,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7732,i,3006199525289986176,2884251262588335896,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:1
  2⤵
  PID:2192
- C:\Users\Admin\Downloads\Hytale-F2P-Launcher.exe
  "C:\Users\Admin\Downloads\Hytale-F2P-Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7812,i,11156970109304422622,11565705199023579462,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7948,i,15025727112430377215,3851177605963125646,262144 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,17340888565303251452,3733515507156108367,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7676,i,4545107635337120420,12410788849553183819,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,10212533480110866950,12762769647033845900,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7728,i,16981880614529121815,17768274726007658532,524288 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7648,i,13144364901801279664,15909509391815799046,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7172,i,13695587403612365848,15820301799070005956,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6912,i,14113898547758656491,7124589840624816249,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3888,i,8622242104005223435,13488090777971681145,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7400,i,10172246467275683850,4416591812865902521,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=3836,i,14446065114039181811,6128140030265279328,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6668,i,3440541385602764661,17838498105827314213,2097152 --field-trial-handle=2292,i,12079818969562622693,6300306136942602344,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:568

C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1752,i,2261677251699485025,3998870593497719248,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController | Select-Object Name, AdapterRAM | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5252
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --field-trial-handle=1752,i,2261677251699485025,3998870593497719248,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4944
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1793141104086725 --launch-time-ticks=674210039 --field-trial-handle=1752,i,2261677251699485025,3998870593497719248,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2664 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2244
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793141104086725 --launch-time-ticks=676781527 --field-trial-handle=1752,i,2261677251699485025,3998870593497719248,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1932
- C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Hytale F2P Launcher\Hytale F2P Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\hytale-f2p-launcher" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1752,i,2261677251699485025,3998870593497719248,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2132
- C:\Users\Admin\AppData\Local\HytaleF2P\butler\butler.exe
  C:\Users\Admin\AppData\Local\HytaleF2P\butler\butler.exe apply --staging-dir C:\Users\Admin\AppData\Local\HytaleF2P\release\package\game\latest\staging-temp C:\Users\Admin\AppData\Local\HytaleF2P\cache\release_v36.pwr C:\Users\Admin\AppData\Local\HytaleF2P\release\package\game\latest
  2⤵
  - Executes dropped EXE
  PID:5812

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

butler.exe

Path C:\Users\Admin\AppData\Local\HytaleF2P\butler\butler.exe
Size 23.6MB
SHA256 c3358decbf3ac585833ce12b464c084d7049d51928fb57087a22a6fd2911bc98
MD5 f05bc93d3e53ece89b03a8d1e6d9f128
SHA1 d0b5cc8af7781326cd0aecafa03427fd0b150e4b
SHA512 de65841b88e399e43e9f5cf78c31ae8f31854eac426c5d910a2bd6f363dee2d8594962c5ac2af22ec914b064348f3812db35e7989589ee1efb6f2e83dca33896
SSDEEP 196608:Pmnzl7Htl8IGqMajMK/0zkd7QQfPyaxN/W8l1smGd:Pmzl7Htl8Najf/0IDPr/WF/d
TLSH
T181475A03F96185E4C5EAD13086679223BF717C894B3023D72B60F6292F76BD0AEB9754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\HytaleF2P\config.json
Size 361B
SHA256 9e8aa688b567fda1e05cb1308e901faddd0d15e965545ce004e18cfec25d67e4
MD5 df2de790865312a1dddec0cc667b4c50
SHA1 1bd597e50db66aff48d59e0edd5870e18b19cf6f
SHA512 a1e82d0d61b6db19e50afa82eee26898968f576b0f879d2c767e7c452806798d6d977e777bc6cdc4fd98c78d0c75607612f07e2c77eba44dbd3d07d4a091d946
TLSH
T116E08C34E87EAC2300C42659187D0593AB204C674E843EA8378C5A0C9F4F91E58FEB59
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp

Path C:\Users\Admin\AppData\Local\HytaleF2P\config.json.tmp
Size 387B
SHA256 90ae74f41bf1e6825a7396f87f1aafebea65fe47d62006645154b7d9e4813228
MD5 b60eaefc07f4176a3d57ff12c9de7729
SHA1 d7f85b92291db6542ba94852be891e27ce48fae9
SHA512 44e08dbcc83cc2224c430f5a3734999bb86d429a3e26613d752452884ad2f0730b9b7cb43af64fcc2eac7b22e3985df24aae0bb6e8b62f4db96e6da3260930c5
TLSH
T1E7E04F34E83AEC2300D42659487D15936B304C674E453EA8374D5A0C9F4E51F59FE759
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp

Path C:\Users\Admin\AppData\Local\HytaleF2P\config.json.tmp
Size 439B
SHA256 d31c95a348afb17a3bbb2c79de1e81c733bc508f3d7e614995dfa4355e123ab1
MD5 31972f5481926f58cea772b285769f49
SHA1 ebced41c107d20c90e487c436dfde014a8208820
SHA512 c389ecfbd581a7b9920251c3c9c64c51433fd63375f6002500661f04ff4d787ea6a5b3549c8271a571406387f8fd0d611dd230b7b27c04512307ee8d918f8b59
TLSH
T1F3F09234E83EAC2300D022595C7D15A76B305C634D883DA83B8E970C8F4E91F68BFB54
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp

Path C:\Users\Admin\AppData\Local\HytaleF2P\config.json.tmp
Size 389B
SHA256 5916b361d8be9ddea7feb5b3a398161d1bc068274a2a912968c3e509e5eaee94
MD5 870272b36dddb6ec19dba8acaa64a1e4
SHA1 e30f1017d95afe323c2a4f7949212d1b816bbd25
SHA512 36b9701e194ce7cb8b18dd86f84ec554c620091bd2a574cceea473b7494fd468a835331a2828890ced952641db90983e610329e04ad2e309ec4f29a6880697ac
TLSH
T1CFE04F34E83AED2300D42659187D15936B205C674D853DA8378E560C9F4E51F68FEB59
MD5 SHA1 SHA512 TLSH

Submit Download