hxxps://geo-xn-mgbb[.]xo[.]je/?i=1

Analysis

user interaction
yes
max time kernel
90s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://geo-xn-mgbb.xo.je/?i=1
Sample260522-zcsbbagy4s

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5236	gd.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gd.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4192_522301823\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsIconUpdater.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1964	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedgewebview2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239557069877150"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{7ED37DA5-76A5-4F92-9DEA-3D6E00EB620A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
5268	msedgewebview2.exe
4192	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3108	4192	msedge.exe	86
PID 4192 wrote to memory of 1964	4192	msedge.exe	87
PID 4192 wrote to memory of 1908	4192	msedge.exe	89
PID 4192 wrote to memory of 1908	4192	msedge.exe	89
PID 4192 wrote to memory of 1908	4192	msedge.exe	89
PID 4192 wrote to memory of 1816	4192	msedge.exe	90
PID 4192 wrote to memory of 1816	4192	msedge.exe	90
PID 4192 wrote to memory of 2148	4192	msedge.exe	91
PID 4192 wrote to memory of 4100	4192	msedge.exe	92
PID 4192 wrote to memory of 2148	4192	msedge.exe	91
PID 4192 wrote to memory of 2148	4192	msedge.exe	91
PID 4192 wrote to memory of 4100	4192	msedge.exe	92
PID 4192 wrote to memory of 4100	4192	msedge.exe	92
PID 4192 wrote to memory of 1988	4192	msedge.exe	93
PID 4192 wrote to memory of 1988	4192	msedge.exe	93
PID 4192 wrote to memory of 1988	4192	msedge.exe	93
PID 4192 wrote to memory of 4784	4192	msedge.exe	94
PID 4192 wrote to memory of 4784	4192	msedge.exe	94
PID 4192 wrote to memory of 4784	4192	msedge.exe	94
PID 4192 wrote to memory of 1872	4192	msedge.exe	98
PID 4192 wrote to memory of 1872	4192	msedge.exe	98
PID 4192 wrote to memory of 3204	4192	msedge.exe	100
PID 4192 wrote to memory of 3204	4192	msedge.exe	100
PID 4192 wrote to memory of 1724	4192	msedge.exe	102
PID 4192 wrote to memory of 2324	4192	msedge.exe	103
PID 4192 wrote to memory of 1724	4192	msedge.exe	102
PID 4192 wrote to memory of 2324	4192	msedge.exe	103
PID 4192 wrote to memory of 3048	4192	msedge.exe	105
PID 4192 wrote to memory of 5008	4192	msedge.exe	106
PID 4192 wrote to memory of 5008	4192	msedge.exe	106
PID 4192 wrote to memory of 620	4192	msedge.exe	107
PID 4192 wrote to memory of 620	4192	msedge.exe	107
PID 4192 wrote to memory of 4452	4192	msedge.exe	108
PID 4192 wrote to memory of 4444	4192	msedge.exe	109
PID 4192 wrote to memory of 4452	4192	msedge.exe	108
PID 4192 wrote to memory of 4444	4192	msedge.exe	109
PID 4192 wrote to memory of 4624	4192	msedge.exe	112
PID 4192 wrote to memory of 4624	4192	msedge.exe	112
PID 4192 wrote to memory of 1772	4192	msedge.exe	120
PID 4192 wrote to memory of 1772	4192	msedge.exe	120
PID 4192 wrote to memory of 2368	4192	msedge.exe	121
PID 4192 wrote to memory of 2368	4192	msedge.exe	121
PID 4192 wrote to memory of 2368	4192	msedge.exe	121
PID 4192 wrote to memory of 2564	4192	msedge.exe	122
PID 4192 wrote to memory of 8	4192	msedge.exe	123
PID 4192 wrote to memory of 2848	4192	msedge.exe	124
PID 4192 wrote to memory of 3744	4192	msedge.exe	125
PID 5236 wrote to memory of 5268	5236	gd.exe	136
PID 5268 wrote to memory of 5292	5268	msedgewebview2.exe	137
PID 5268 wrote to memory of 5552	5268	msedgewebview2.exe	138
PID 5268 wrote to memory of 5552	5268	msedgewebview2.exe	138
PID 5268 wrote to memory of 5552	5268	msedgewebview2.exe	138
PID 5268 wrote to memory of 5576	5268	msedgewebview2.exe	139
PID 5268 wrote to memory of 5696	5268	msedgewebview2.exe	140
PID 5268 wrote to memory of 5696	5268	msedgewebview2.exe	140
PID 5268 wrote to memory of 5248	5268	msedgewebview2.exe	141
PID 5268 wrote to memory of 5248	5268	msedgewebview2.exe	141
PID 5268 wrote to memory of 5248	5268	msedgewebview2.exe	141
PID 5268 wrote to memory of 6020	5268	msedgewebview2.exe	142
PID 5268 wrote to memory of 6020	5268	msedgewebview2.exe	142
PID 4192 wrote to memory of 6104	4192	msedge.exe	144
PID 4192 wrote to memory of 6104	4192	msedge.exe	144
PID 4192 wrote to memory of 5792	4192	msedge.exe	148
PID 4192 wrote to memory of 5792	4192	msedge.exe	148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://geo-xn-mgbb.xo.je/?i=1
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9652dc188,0x7ff9652dc194,0x7ff9652dc1a0
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,5306080508368635779,2367896904326369684,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2001718788651652497,16467185591647480262,262144 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,4040587332606109411,8712940991639993621,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,18084273499346328882,14944822692029361205,2097152 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6103506126012347367,9842314374921400770,2097152 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,11272828080470647420,1349755903486603118,2097152 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,29869894214212639,2211488031094458228,2097152 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,10799069505077736124,1282547885976664720,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,14268377767520273107,16635830648258840462,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,9977849623460905669,3087348618106217635,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,14201956374061783018,951965940920774149,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12996801380379028258,16550768564699880392,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12996801380379028258,16550768564699880392,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6480749949994769871,6855204612671373268,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7062191174326069516,18359185435145477241,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,13153034789581019667,6753888624041940269,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,2281363601979673752,11147851487073042296,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,2907112123593129610,9041416549987213307,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1399591617999593577,14205480579245161291,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5992,i,9036755486506164422,5701219844753661296,2097152 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,10324879938750206780,222399394740911435,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,17054482383318226663,16902497213210999136,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,1692139221757034145,1801024816106484728,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,9497978784411388733,5089960731836024053,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,9655796728356727086,12725405566376555050,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,10000713832819125240,13468837484313549195,524288 --field-trial-handle=2304,i,6849789201922149418,3452155409016583982,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3592

C:\Users\Admin\Downloads\geometrydash_full_archive_version_3.4\WindowsIconUpdater.exe
"C:\Users\Admin\Downloads\geometrydash_full_archive_version_3.4\WindowsIconUpdater.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4832

C:\Users\Admin\Downloads\geometrydash_full_archive_version_3.4\x64\gd.exe
"C:\Users\Admin\Downloads\geometrydash_full_archive_version_3.4\x64\gd.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gd.exe --user-data-dir="C:\Users\Admin\AppData\Local\gd\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --autoplay-policy=no-user-gesture-required --disable-features=HardwareMediaKeyHandling --ignore-gpu-blacklist --mojo-named-platform-channel-pipe=5236.5264.663986912455009584
  2⤵
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gd\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gd\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff95f09b078,0x7ff95f09b084,0x7ff95f09b090
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gd\EBWebView" --webview-exe-name=gd.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,13315107144831090922,3831394153435685949,262144 --disable-features=HardwareMediaKeyHandling --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gd\EBWebView" --webview-exe-name=gd.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2084,i,13315107144831090922,3831394153435685949,262144 --disable-features=HardwareMediaKeyHandling --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
    3⤵
    PID:5576
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gd\EBWebView" --webview-exe-name=gd.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2420,i,13315107144831090922,3831394153435685949,262144 --disable-features=HardwareMediaKeyHandling --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gd\EBWebView" --webview-exe-name=gd.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3648,i,13315107144831090922,3831394153435685949,262144 --disable-features=HardwareMediaKeyHandling --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gd\EBWebView" --webview-exe-name=gd.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=3744,i,13315107144831090922,3831394153435685949,262144 --disable-features=HardwareMediaKeyHandling --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
    3⤵
    PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4192_522301823\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 42c9e44c464f0dffa2458cd91166d905257eb8b889dd310e1fc520d37da4fc0f
MD5 7680cd0472713df7f9a020d3ae5e36dc
SHA1 3a82beed88c8715d33558ca3963fb3567eb2b685
SHA512 995ca8402757d9f305301423d6b747d122a21469b7639dee006f21d159f545a03236e2dd55b5fc1f8ec22435a127e7a387d7560081c9f50399f98bce92e88437
TLSH
T1D941D67816E3454DE3201B7A60F02E5639F98D953EE37E1D5D4889703A4FB22831F278
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58919c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58919c.TMP
Size 1KB
SHA256 92ba2ca701bd928bbbe3c1eae394072201d024791e41213152c881e10a1284cb
MD5 1a9909f7322cf29c968d6ad428f9fca7
SHA1 25cd554b7c024fa1ec4ab01f889386c6fdc90741
SHA512 dc000e6c47f5a24fd5bf40603af06e556b19fbb3a209cd4eddf339301acc86142d9e14dea10d5a66f4c88b8da44fec5131b457bd459154df4e363b972e67c8bf
TLSH
T17541D47816E3044DE3201A3AA4F02E1639F88D953EE36E1D9D4889743A4FB22830F278
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c5ab2019b859149e7b3093b9d62bd158ca08697559392c82778e8cbc86df439
MD5 1f112185ae8f22effd4d9ba2a7049172
SHA1 d21537c246b59f56a7720226f815b871b9fe2a91
SHA512 a21549d6df4fbd123162d61c5dcecdf08df7ea09cd7ad3ab0d26ab096f3b3e856eed6d81b64a9428c67262dc59e3ab6123c3031bb479c18d591d3a111de47160
TLSH
T1E541ADF3C3E4856EC91196F0BA18AE2BDE1D0915832C3D5A89E4EF1B93F2871E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d4bfe73fb2e557940b6ab6d1a646354470beb4bccde3d48693023926bd5fa533
MD5 76d9703c84ce7f70d094912d59fff07c
SHA1 e19812a812e587b9edb4a94b2d189cb6568dc080
SHA512 215cf3a96bd78b4fa49abbaed0d43e382f517c7403c87cbcadd7c5f29b549b1ca90b46c74e1b0ae2d0e2665b77c67aec43ef5de0e7f027d328eae3991ccfd06a
SSDEEP 192:sxZ9RWyM/jK1Ml8MkX/f3sa2x4jtIdpnkHW6+WNjdK/Y9I6OtIg4J:sxZ9oMX/f3sa2TkHbw/1c
TLSH
T1A152C806AA349977CCDBD20DBA557B53D6F9157292940E48E9FCDA0C01E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 477294ab7d0fb0b671a8aab582c27cdf020eaeece8b2c048782da155ff09d79a
MD5 ab517a9306a97354a954147f76ac4298
SHA1 92ce0ad7e54105127d12a73b06645a9c64f76047
SHA512 6c15e9cb16cf9b432d6668582f06f6413a1e012695350f9793f11980672a1adaa8bbc8fb17670fcd9e53029203165e9fa848122b21d5dc1132597aed8d0ff7da
SSDEEP 192:sxZ9RWyM/jK1Ml8M9X/f3sWNx4ftIdpnrHW6+WNjovXY9IZOtIg54J:sxZ9o1X/f3sWN9rHb4X2q
TLSH
T10752C716AA349977CCDBD20DFA557B53D6F9157292900E44AAFCDA0C01E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2730f2f5593d7f41a2cec58f66473e1c05e569e17797da890668e1c831bd847b
MD5 b67363a1dee66c68855a03fd0d4df9ce
SHA1 0dfa2d0d691edb0399ec063b324446282c2099f7
SHA512 40e8cd083304f791a22ad4d3fca1684ab2902f0f475a155ec043aeeb7c18d84e77b2e09f524b1abd056ddc89bab112ccaebfc551ff942dc2aa86d538336f40e8
SSDEEP 768:F+cv2Cr7pLuLXowWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPyeFLlwmWNyroA:F+cv2C9EXowWvu+Z+u1jayyeFLeRNpst
TLSH
T127F2FA3B2C0CCB7E4F845E9CED2A7E8E6EE8018B5698895447FA844C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6a093304a12ac4bd6f102ecedf8689fa317809aeaf637e3d459fa88ab263d70d
MD5 0747dc689194c0eda2dcaa22e128c8bc
SHA1 ece92df1d24ee4f1a4cd8fcc2bdf59f8d16e0111
SHA512 3856c43a6d682c41a95382be8a95af4d382cb49d217b86b6677ef7965220730c7b27051a671bc3347d35e091f86055834d3f73b5074d57e956bb9c06d7be1ca3
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDujeKEoeEmsKbSOeDmKoc7z:mTtNlTh+
TLSH
T15BC11557B2370702297D695CA3628A368F4531633814F5EF7BB900A10E6AF221EFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e25749f7-c202-4d93-b125-855fa27c092b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e25749f7-c202-4d93-b125-855fa27c092b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7ca4e5729d3a273027c708deb0b440d1bea9b894cb12ac996e812db0e6442942
MD5 2c89525c5eb37b206af797bf112d9889
SHA1 234518bb9ceafe952a45b969efa178eb8b96e250
SHA512 2eb436f1005d33ecf9f480768a0ab7398832755a15e85edd139b342ae9d67afe3f4e806d5e4962bc1ce9a2a71407b94fcc20890663c7b6a4cf8ca11c8d7653d3
SSDEEP 384:n9tNnNnb9SsNo2hziRWie+CnOhiJrWu6B2LnOYPpc+F7:9jZbEIbVvOhihWu68yoJ7
TLSH
T1C5927E3269382DBB9EA26D45F54736136FB861EBD4C12EC0DDCC6F1D01CB68C230A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3f4ecc71b2a1f2fe029522b716703fe8f6595c44c69f3241bf429f24be874efa
MD5 05ce6c316a6a70afcc87fdef1333aae0
SHA1 a74341313d1f5649378d4964c3525151b8f6d403
SHA512 39c0ff0767cd36f105f7bbdf8656a09f23f3c89c9b30855d9806b90710ef1e60ccf043b24f462f66ca84644084d46649c8b07d2c4736258176a5e9b84367b73c
SSDEEP 192:uuZPsNoyQel+YLerYQmiU1Lst4e+CGKO1maXSJrJJi7/KU8:nlsNoyhzikWie+CnOhiJrWuU8
TLSH
T184420A3569386CB79EB2AA45F5473B13AFB8107BD5852E84DAD85F0C01CB69C2306D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8b95b4507fb8af3a6028f58a695363cfefce00ea548af13a3397e427cabb4fac
MD5 0267a8f4c997c51cb000da6a3b7d0ff4
SHA1 b7731b3c9caffce446cdcb7149802b0f657faf17
SHA512 f830d7174a45c9cd24ab22198b6f9468346abdc09a14ce824bfdd2caf71e462684eaef31b986f95018f4e61bfee223643971414187c82d3fd95a21a4924b06a3
SSDEEP 384:n9tNnNnb9SsNK2hziRWie+CnOhiJrWu6B2LnOYPpc+F7:9jZbE6bVvOhihWu68yoJ7
TLSH
T113927E3269381DBB9EA26D45F54736136FB861EBD4C12EC0DDCC6F1D01CB68C230A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d3ce506b356f57e464cf8a6ef17c7900352d434e40728bc6453ba5b3d4b0005d
MD5 6ba6f249c1b40ef9267b21964786248a
SHA1 64e029f85259591461dc50c636faf13a61895a16
SHA512 606e04c13a657e191278e6abf21d7cb9ac1e402ee4f157c62ccd821a04564679f03a454e28fad406bbaab11b256aebc13b94c9603eb6d54caf0bcafabfb0984f
SSDEEP 384:nHtNnNnb9DsNKXhzi4Wie+CnOhiJrWu6B2LnOYPpc+F7:HjZbJvQVvOhihWu68yoJ7
TLSH
T1FD927E3269381DBB9EA36D45F54736176FB861ABD5C12EC0DDCC6F1D01CB68C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 7831853e59a71385052cd5d4a9e91f124ca32090b14e3f7ff072802d475c8d1e
MD5 da61de4cbb3bfa383cae58a73016692c
SHA1 e986478cbe3d91ec508446f33a548920c2d5890c
SHA512 f45dfde0bc798e6142c7c42d569ab1cc893ba3c715626205cf0406e6437c0efe7a7af5e54e7e78ff4a75b590f59d412106f3d9764c05495e4ebdddc0da236a0b
SSDEEP 384:n+iFftNnNnb9bqysNS8TUNTUlIlXhzi4BiZDf0S+CnOhiJrou6B2LnOYPpc+F7:VFfjZb1LwgTnDSvOhihou68yoJ7
TLSH
T138D2A4F198E78976D9AE4B83A73E6D429EBCD197B4841980BBC81D0CCD871BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fdd897a431919aaf12fc6836ec41c0699d9622216f8bc1ce14e87171f9ab6777
MD5 40ac195a8816e59d7f6adeb651a3eaad
SHA1 73b9383d26680cf44ce843843841716a58c79e40
SHA512 5ee1297b43f470f2ebcd11983ed8e2f53ee87d0c8b9bf3fca84c0b8e562a40b3fdf97e5ed1213e9f7cdeec79c1d5115c7d730a6a7360631465b2738b57fa9543
SSDEEP 192:JONB6v+YL3QmiUyLm+h+CGKO1maXSJrcCH7/KU6:JONB6vzNh+h+CnOhiJrVuU6
TLSH
T187120A3579786CBB9FA29E45F48736179FA8207BE6462F81D9D82E1C01C779C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ca04ab99e6ad51b56676589fd424fc62f5a888750d070d6f7e3b88839528364
MD5 c14d4774d48f9d9624a81c0aee9ca64f
SHA1 b2554393d40a73db4df3f996e5034668fa87b597
SHA512 643734d643f2bbf0867c315b7fb16783b3579848e060d26c754cc2010a0121bab877f1baed036ed186d2d9641418bbca6d9d7f960a08e7e5f67f072678893d0c
SSDEEP 192:JONo6v+YLNQmiUybmZh+CGKO1m1usab2U6:JONo6vz/TZh+CnO8I2U6
TLSH
T1A602E83579682CBB9EB2AE49F58737179FA8217BE6512F80D9D82B1C01D764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 be26efe1d59a3d90054e827b37d1c17c90490faa22c62f5bf9c0f94e9b43ce4f
MD5 354bb0b4d5a1a718fc3b62297dac3d78
SHA1 a54d91aa3a07f3a4126146befdb8de414bafe2a0
SHA512 52cc4b9c3833756451296fe281c53e8de047fa3b94e40270be1141b2bc6516a1faa14a4d4dc9e802e79cefc7ae7b599f7b7e263a068f246f83c05f22a455e81c
TLSH
T137E00443D30041F5F014133500C7171017D1C070017103070D5007553C133101D30740
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58a071.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58a071.TMP
Size 392B
SHA256 44e45f53ab5cf4768f0d3cfd3ee6b55549b4c99da8d4dd6d9350ee104234de47
MD5 f7490a32ebf0fd78061be5a2b84305f0
SHA1 28720160911e6a7650103bab8c6b822ad6888705
SHA512 17ee1f442d2212ec2b38582e1badea995345a5768995e27b30b595acde24435dcfb0293bfa792ba42868c393b96cdc7db4945c9aaf0a81861d75324226f62701
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

1ae9ab21-1379-4b47-a56b-1d1dd347416c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1ae9ab21-1379-4b47-a56b-1d1dd347416c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fa18c694a784f7fb8e2a3077768865a611633e69c8a1964b9dbd03b4f5a194e8
MD5 95a09533d0372728d55ad5e519b6b193
SHA1 aecfafbf187e8508d94606ffb0f1cc3500c80b24
SHA512 fa53eb2df2b6d27cccdf3ef9e7982e3edebf17460f5cad0e0d88dec76d74e695a7e967979c5aa405e08bc936c69621b67cd416d361b9e66b5ffaa40e5a804b10
TLSH
T1C3411658AAFA1158B3B77E569BF6A86D443EB8772E06D45E10110E8F0B73A40C971B33
MD5 SHA1 SHA512 TLSH

Submit Download

e561e495-9483-4661-bfb1-716fb92d1209.tmp

Path C:\Users\Admin\AppData\Local\Temp\e561e495-9483-4661-bfb1-716fb92d1209.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5627860-d9b5-4d7f-b55d-a8ba1077f0f4.tmp

Path C:\Users\Admin\AppData\Local\Temp\f5627860-d9b5-4d7f-b55d-a8ba1077f0f4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e88694ea-4894-40ce-83b2-70eed6a74029.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4192_13138205\e88694ea-4894-40ce-83b2-70eed6a74029.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4192_1715236315\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f8bb77bb0c14831f98edfde5a5973aa1948a419b1dc81ca5268392c95de3da10
MD5 36c4f017bae99831edab85ab2550cf44
SHA1 16b8ad503f33838b3cf64fc51f393e4dc70d1d32
SHA512 0c41ee54465793bbd5288c682a48c11223291e63b822498b18eec443e313dfcf0f0973e43a0339baa74be7e50cf27054d95c43d6f8a7023127bdced2fa3e9a6f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fe295cb681abc4f3c8d9c5b463d649cf5d369df07f601c5968090b011ffcbc5a
MD5 7f6d31c737195775d1465cd5b7461b44
SHA1 4a7e4176f94452feada1112c6ae510cdc8dcc25e
SHA512 8e701b531980c604dac96398ed26ad5d2122c45825debf9c7a57f2a3a991279bda082a55f831f015a832709a01f960e4768dec4787b2063ba59094f896ec4e23
TLSH
T15FD0121236024135C0303833110671084504C60B42054144A42D863E5E041540906481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 987f6b3f09ad28089af9af8482096b7b0d807ad0db8415e5ba8fc984ffb5b5e9
MD5 f6fafc57a9e224248af73217f85a6afb
SHA1 0f3a4c6a806f486d3bfa334486a688ee9117dd7e
SHA512 a234fa79e17a32bebb6b4196f647d8e75c08f7ae95874aa312213530747697ea407712062c9ee60489368f80ddf4809004b31ed7b971516267450ab08e0b1fbd
TLSH
T1B4C04818C470FC41D60F1AB249E66C8832752864FAAB2D76CB906D30A6C33B067B8E54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596085.TMP

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596085.TMP
Size 48B
SHA256 c5abd19cc9e84179e9df37c2dc0fb4e3e104e2eefa5a9854aa619224496f8fc5
MD5 0ae96806a0dde9e4b9dffa0c52b7f9ad
SHA1 641108e3f3ed68ac01aba20b2b638f72ed6d816f
SHA512 e9d97ecdf29a7161d678666963fe9d323b673d2f955003f3a910607a9b132fd3ec389a7677866c7a728b034e7c0dfe6de2d2386689cddec9227a3d369f4660b5
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe59863d.TMP

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\Network\Network Persistent State~RFe59863d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\Preferences
Size 8KB
SHA256 8ab86a29a27d4d7a47f7f1624b469120a16b893e7cc438387db021c05864daa2
MD5 26ced08bb73cb53276dba768a23fd164
SHA1 d8f5de5c086809cb51d8bd76dd8dc2f2e5dcb8ec
SHA512 9311f734c0830e6cacfc2eab72901726ffe51da7871248436960ad6e1ddc200d2a2f960af0eadfd5563a86db9a97dddb1ce75e994c0301577c35c9a352e6b1bc
SSDEEP 96:stH05i++GFdb99wffNZ8i0vhEDkAPmUl7qx+WVHMSm+uecZouSWUdQjc+g+bcKOB:stH0UbxfVZ8paZOUlS+WinouVUdV0cKC
TLSH
T12C027316AE58AD7BCD83E50D7635FF06E2F950626AC41E19ABFCCA4C49E66CC1107C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5985ef.TMP

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\Preferences~RFe5985ef.TMP
Size 7KB
SHA256 84966ee87419a7273c715839a6e83748681e0cabe9382c1a5374dccee8009fc4
MD5 c3bba6c470a28e2db6f298d26d2feb2a
SHA1 0769651af040cd35ef35ca8f7882e60bf38545fd
SHA512 54003cb4b2d9517ab3e416ff220caeb35579ed1c0d6bc984673018e617f0c78edd2f635d7f58df73c5070a480471c05ff565ebd934a3b297c0fc1a82606de227
SSDEEP 96:stH05i++GFdb99wffNZ8i0vhEDkAPmUl7qx+WVHMSm+uecZzQ1idQjc+gP6MEB:stH0UbdfVZ8paZOUlS+WinzQwdVd6M8
TLSH
T101F16316AE98AD7BCD83E20D7635FF07E2F950626AD41E19AAFCC54C49E62CC1107C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Local State
Size 1KB
SHA256 8bc5124153744b632954d87bd9599ec275c5c25801a97504b7687e100e8a5fd0
MD5 1e3664888fb8ebacdf252fc73c3c75eb
SHA1 ba2755e7dd84a177392f26627f16a073437e8dbd
SHA512 7734c3185161be7cb2d6153700dfebc20e35a447ef38a58781e434f3cf2768e8dc25d5b05b0b0ecd422b3888a8e374a70ef041a34b939c91e2a71ab0d5f927d4
TLSH
T1703179B3E4545F33ACE1665672C2BE5B6E241035D1914F4850DE5F0C02E72AC5E3EC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Local State
Size 2KB
SHA256 364860137fa70736abde7beaf1d8584e607b9b44c5d7c1a327f3b97e33411726
MD5 c476893eb204d00761e31e15e605c0c1
SHA1 271ea7496d4e67d074cc42793598571287e62659
SHA512 d95e37582eb0cde9acb010299434ced76b2bd84b190b99f2233a54649f37233e53a3d7a3b4fa74a9ec0c9cb5baa60b8bfd7134449500fd289d9bed8bb05e0af9
TLSH
T1F4519673B8149B37CDF25A1579867F23AA392071D6922F9094DD1F0C01D726C2B06C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Local State
Size 3KB
SHA256 f9df6c699158e42516cef7c1bcaa5db1326fa40efaa4503005f05805f647e004
MD5 7630fc14b940fe9e27b992c749634b20
SHA1 8148515b6b5eb3670655188556226e438993953f
SHA512 5b932045fd50257fac34e5282b438076dcdf2e2eb249c8a5378e3eb5e83420bf1c9f6c0f63c480fec5ffa725c859155e97cb1a63706b7459bb7b645c8eba08d7
TLSH
T1E771B672A864AA3B8DF39A05B9C63F16B7A51032D1D53F98C9ED1F0C02D73981702C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Local State
Size 16KB
SHA256 165ced6eed57bd90a33e5ed579f4fe2552334ffe1a33f2da382b9bb61c9bd8f0
MD5 fabb4c5f0ce1bd525467ec69246e0da0
SHA1 3aeb1a3e0b8a67b2b7de9b2f0772ef3fbb924d99
SHA512 92595db1de7314a5ad8b97d2915c48f95541ec97c40b026c8cac841b7de27829d8c45193759a517de945513dd8314a7194328bef1471e71c74135bf8c5d959e4
SSDEEP 384:znsr8vAVy7dG5UI6limIfB8pNbvQTn+et7clF:Ir84y74GVsz+eBclF
TLSH
T1BA72AF31A5309F3B8CE1DE15FD0A2E1ABD7841AAC5C61FB9C5E96F09435B2D50382D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Local State
Size 16KB
SHA256 55354aa8038f0621d7969c4679974c7a963c6bc1542d2a47581892a8b9260ed3
MD5 cbd9851cb8af422793a6a9a01d378527
SHA1 586543b02a31290e49220d2c7a834f75e704a921
SHA512 a8a3e24329ac7c7eff35485ea6e11bc347c52758b2ad47b7fd86adc692bbe56f4cc62e8c8a3811cde18958cc9c956329fb8b5ba1b453c378724eff343ff78960
SSDEEP 384:zQsr8vAVy7dG5UI6limIfB8nk3NbEQTS+kt7klF:Xr84y74GVkxW+kBklF
TLSH
T1D472AE316530AF3B8CE2DE15FD0A2A1ABD78419AC5C61FA9C5E96F09435B2D90382D73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590a85.TMP

Path C:\Users\Admin\AppData\Local\gd\EBWebView\Local State~RFe590a85.TMP
Size 1KB
SHA256 cb69e9e9a2cfa64b006ce9f1bda228753eb5fc6c26126023bbeff1a0de42c0db
MD5 c3eff4a90483eb82a139ce8a5dbba8d5
SHA1 c4a7f538c86c2b6821cac10b779bb8fc683cf72c
SHA512 0391b290bb8e1175975392d5c7dfc5b4f1d645d0e292bb868638f09fce6cb9a58a4b69ed6e201260567dbdca50ee92f4cc167b21f12590bde00e4f1f1e32b8d2
TLSH
T112213273D4546B33BCA159657282FE5B2E54103591959F4890DEAB0802EB2BC5E3BC36
MD5 SHA1 SHA512 TLSH

Submit Download

geometrydash_full_archive_version_3.4.zip

Path C:\Users\Admin\Downloads\geometrydash_full_archive_version_3.4.zip
Size 4.2MB
SHA256 6a6458d1fe876cf64da45bd4336fe7ffdeb4695fb6c4342d3bed327219a0e9a4
MD5 45509c61606b8582349c5833409b20ca
SHA1 ccfc8a72e5411d051cf13babe744602371eab064
SHA512 4e8d4fc0c96ffe4d3579fd25a5ac1484fcefbfc20ec1e07f02afb1d7840c8b0641e61446fe26c324ab81a646ea670535352f27832f4236537a95b42c742734db
SSDEEP 98304:jWhWxshEdHIo1etvpfhhRpr5mnJT74Zh8fk4sUlJHR3rE2vpLhhRpr5mhJT7aW1o:jWhjhoYP/0Jn4Qs3U/Vz/0znX9o
TLSH
T1BC2623614DD4C6B1FD97007C09ABABB88B27F41B65206BF01A55424EF934BCAB6D23C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gd.exe

Path C:\Users\Admin\Downloads\geometrydash_full_archive_version_3.4\x64\gd.exe
Size 567KB
SHA256 2884a3e0d98cc048249c9f9238aab10f10fa4609e5ca4c871edd6100d5938aa5
MD5 6df0d616c25885ae98fb32352804dd7c
SHA1 938aafcbe0beb26d5f65a28fbaf4f375f3b03b35
SHA512 07bdc712ac2117f0fed7ee84c28490446c4a99040ed658be2b5321e9e14ad81c5fdad7867657d4a18b2f33ca9fa3db400db814e85dfdc638adffae088b359c29
SSDEEP 12288:5loLlOAnclYV05u0DTjKOV2isl42dKRMqMJbybBbwbImb4xZb9byb/bpQxbDrPCs:5lo5TV05JD3KOsFSKaudgnp
TLSH
T1E0C4AE19B66400F9E0A7C178CE539606E7B278575BB0D38F13E4E66A2F237A05D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5248-709-0x00007FF97EFE0000-0x00007FF97EFE1000-memory.dmp

Download

memory/5552-776-0x0000017AAAB50000-0x0000017AAAB54000-memory.dmp

Download

memory/5552-824-0x0000017AB0F60000-0x0000017AB0F61000-memory.dmp

Download

memory/5552-787-0x0000017AAABB0000-0x0000017AAABB1000-memory.dmp

Download

memory/5552-785-0x0000017AAABB0000-0x0000017AAABB2000-memory.dmp

Download

memory/5552-783-0x0000017AAAB90000-0x0000017AAAB94000-memory.dmp

Download

memory/5552-782-0x0000017AAABA0000-0x0000017AAABA2000-memory.dmp

Download

memory/5552-780-0x0000017AAAB80000-0x0000017AAAB88000-memory.dmp

Download

memory/5552-779-0x0000017AAAB90000-0x0000017AAAB94000-memory.dmp

Download

memory/5552-798-0x0000017AAABF0000-0x0000017AAABF8000-memory.dmp

Download

memory/5552-803-0x0000017AB0F20000-0x0000017AB0F24000-memory.dmp

Download

memory/5552-802-0x0000017AB0F40000-0x0000017AB0F42000-memory.dmp

Download

memory/5552-800-0x0000017AB0F30000-0x0000017AB0F32000-memory.dmp

Download

memory/5552-797-0x0000017AB0F20000-0x0000017AB0F24000-memory.dmp

Download

memory/5552-795-0x0000017AB0F10000-0x0000017AB0F12000-memory.dmp

Download

memory/5552-794-0x0000017AAABF0000-0x0000017AAABF1000-memory.dmp

Download

memory/5552-793-0x0000017AB0F00000-0x0000017AB0F02000-memory.dmp

Download

memory/5552-792-0x0000017AAABF0000-0x0000017AAABF1000-memory.dmp

Download

memory/5552-806-0x0000017AB0F40000-0x0000017AB0F44000-memory.dmp

Download

memory/5552-805-0x0000017AB0F50000-0x0000017AB0F52000-memory.dmp

Download

memory/5552-788-0x0000017AAABC0000-0x0000017AAABC2000-memory.dmp

Download

memory/5552-827-0x0000017AB0F80000-0x0000017AB0F82000-memory.dmp

Download

memory/5552-826-0x0000017AB0F60000-0x0000017AB0F61000-memory.dmp

Download

memory/5552-825-0x0000017AB0F70000-0x0000017AB0F72000-memory.dmp

Download

memory/5552-791-0x0000017AAABB0000-0x0000017AAABB8000-memory.dmp

Download

memory/5552-823-0x0000017AB0F50000-0x0000017AB0F54000-memory.dmp

Download

memory/5552-822-0x0000017AB0F60000-0x0000017AB0F62000-memory.dmp

Download

memory/5552-790-0x0000017AAABD0000-0x0000017AAABD4000-memory.dmp

Download

memory/5552-857-0x0000017AB0F90000-0x0000017AB0F92000-memory.dmp

Download

memory/5552-856-0x0000017AB0F60000-0x0000017AB0F61000-memory.dmp

Download

memory/5552-786-0x0000017AAABA0000-0x0000017AAABA4000-memory.dmp

Download

memory/5552-879-0x0000017AB0FA0000-0x0000017AB0FA1000-memory.dmp

Download

memory/5552-878-0x0000017AB0F60000-0x0000017AB0F68000-memory.dmp

Download

memory/5552-877-0x0000017AB0FA0000-0x0000017AB0FA4000-memory.dmp

Download

memory/5552-883-0x0000017AB0FA0000-0x0000017AB0FA5000-memory.dmp

Download

memory/5552-882-0x0000017AB0FC0000-0x0000017AB0FC3000-memory.dmp

Download

memory/5552-880-0x0000017AB0FB0000-0x0000017AB0FB2000-memory.dmp

Download

memory/5552-777-0x0000017AAAB70000-0x0000017AAAB71000-memory.dmp

Download

memory/5552-769-0x0000017AAAB40000-0x0000017AAAB41000-memory.dmp

Download

memory/5552-770-0x0000017AAAB50000-0x0000017AAAB54000-memory.dmp

Download

memory/5552-775-0x0000017AAAB70000-0x0000017AAAB72000-memory.dmp

Download

memory/5552-771-0x0000017AAAB40000-0x0000017AAAB48000-memory.dmp

Download

memory/5552-773-0x0000017AAAB60000-0x0000017AAAB62000-memory.dmp

Download

memory/5552-593-0x00007FF97EFE0000-0x00007FF97EFE1000-memory.dmp

Download

memory/5696-644-0x00007FF97F4A0000-0x00007FF97F4A1000-memory.dmp

Download

memory/5696-643-0x00007FF980880000-0x00007FF980881000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads