hxxps://gamevia[.]pages[.]dev/

Analysis

user interaction
yes
max time kernel
899s
max time network
879s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gamevia.pages.dev/
Sample260729-plcbcatgpc

Score

8^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
151	612	firefox.exe
151	612	firefox.exe

Executes dropped EXE 3 IoCs

pid	Process
4400	Gamevia_Setup.exe
3940	gamevia-app.exe
8	gamevia-app.exe

Loads dropped DLL 9 IoCs

pid	Process
4400	Gamevia_Setup.exe
4400	Gamevia_Setup.exe
4400	Gamevia_Setup.exe
4400	Gamevia_Setup.exe
4400	Gamevia_Setup.exe
4400	Gamevia_Setup.exe
4400	Gamevia_Setup.exe
3940	gamevia-app.exe
8	gamevia-app.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gamevia = "\"C:\\Users\\Admin\\AppData\\Local\\Gamevia\\gamevia-app.exe\" --startup"	gamevia-app.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gamevia-app.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1020419452\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1274671271\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\Filtering Rules	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1020419452\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1148140178\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\Part-ES	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_597109143\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\Part-IT	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1020419452\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_580276967\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1148140178\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1274671271\crs.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_580276967\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1020419452\keys.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1125972964\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1125972964\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1125972964\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_580276967\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\adblock_snippet.js	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\Part-NL	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1274671271\ct_config.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1274671271\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1274671271\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-be.hyb	msedgewebview2.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Gamevia_Setup.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gamevia_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298021070262734"	msedgewebview2.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\com.gamevia.app\DisplayName = "Gamevia"	gamevia-app.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\com.gamevia.app\IconBackgroundColor = "#0B1A29"	gamevia-app.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\com.gamevia.app	gamevia-app.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId	gamevia-app.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\com.gamevia.app\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Gamevia\\gamevia-app.exe"	gamevia-app.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Gamevia_Setup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4400	Gamevia_Setup.exe
4400	Gamevia_Setup.exe
5004	msedgewebview2.exe
5004	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4184	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	firefox.exe
Token: SeDebugPrivilege	612	firefox.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe
Token: SeImpersonatePrivilege	4400	Gamevia_Setup.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe
Token: SeDebugPrivilege	4400	Gamevia_Setup.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
3940	gamevia-app.exe
3940	gamevia-app.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3940	gamevia-app.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe
612	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 612	4152	firefox.exe	86
PID 4152 wrote to memory of 612	4152	firefox.exe	86
PID 612 wrote to memory of 4532	612	firefox.exe	87
PID 612 wrote to memory of 4532	612	firefox.exe	87
PID 612 wrote to memory of 4532	612	firefox.exe	87
PID 612 wrote to memory of 4660	612	firefox.exe	88
PID 612 wrote to memory of 4660	612	firefox.exe	88
PID 612 wrote to memory of 4660	612	firefox.exe	88
PID 612 wrote to memory of 4660	612	firefox.exe	88
PID 612 wrote to memory of 1356	612	firefox.exe	90
PID 612 wrote to memory of 1356	612	firefox.exe	90
PID 612 wrote to memory of 1356	612	firefox.exe	90
PID 612 wrote to memory of 1356	612	firefox.exe	90
PID 612 wrote to memory of 1988	612	firefox.exe	91
PID 612 wrote to memory of 1988	612	firefox.exe	91
PID 612 wrote to memory of 1988	612	firefox.exe	91
PID 612 wrote to memory of 1008	612	firefox.exe	92
PID 612 wrote to memory of 1008	612	firefox.exe	92
PID 612 wrote to memory of 1008	612	firefox.exe	92
PID 612 wrote to memory of 1008	612	firefox.exe	92
PID 612 wrote to memory of 5880	612	firefox.exe	94
PID 612 wrote to memory of 5880	612	firefox.exe	94
PID 612 wrote to memory of 5880	612	firefox.exe	94
PID 612 wrote to memory of 5880	612	firefox.exe	94
PID 612 wrote to memory of 5908	612	firefox.exe	95
PID 612 wrote to memory of 5908	612	firefox.exe	95
PID 612 wrote to memory of 5908	612	firefox.exe	95
PID 612 wrote to memory of 5908	612	firefox.exe	95
PID 612 wrote to memory of 5924	612	firefox.exe	96
PID 612 wrote to memory of 5924	612	firefox.exe	96
PID 612 wrote to memory of 5924	612	firefox.exe	96
PID 612 wrote to memory of 5924	612	firefox.exe	96
PID 612 wrote to memory of 5956	612	firefox.exe	97
PID 612 wrote to memory of 5956	612	firefox.exe	97
PID 612 wrote to memory of 5956	612	firefox.exe	97
PID 612 wrote to memory of 5956	612	firefox.exe	97
PID 612 wrote to memory of 4400	612	firefox.exe	106
PID 3940 wrote to memory of 4184	3940	gamevia-app.exe	119
PID 4184 wrote to memory of 3952	4184	msedgewebview2.exe	120
PID 4184 wrote to memory of 4208	4184	msedgewebview2.exe	121
PID 4184 wrote to memory of 4208	4184	msedgewebview2.exe	121
PID 4184 wrote to memory of 4208	4184	msedgewebview2.exe	121
PID 4184 wrote to memory of 4868	4184	msedgewebview2.exe	122
PID 4184 wrote to memory of 1472	4184	msedgewebview2.exe	123
PID 4184 wrote to memory of 1472	4184	msedgewebview2.exe	123
PID 4184 wrote to memory of 3092	4184	msedgewebview2.exe	124
PID 4184 wrote to memory of 3092	4184	msedgewebview2.exe	124
PID 4184 wrote to memory of 3092	4184	msedgewebview2.exe	124
PID 4184 wrote to memory of 6100	4184	msedgewebview2.exe	131
PID 4184 wrote to memory of 6100	4184	msedgewebview2.exe	131
PID 4184 wrote to memory of 1504	4184	msedgewebview2.exe	132
PID 4184 wrote to memory of 1504	4184	msedgewebview2.exe	132
PID 4184 wrote to memory of 5988	4184	msedgewebview2.exe	133
PID 4184 wrote to memory of 5988	4184	msedgewebview2.exe	133
PID 4184 wrote to memory of 5004	4184	msedgewebview2.exe	134
PID 4184 wrote to memory of 2248	4184	msedgewebview2.exe	135
PID 4184 wrote to memory of 2248	4184	msedgewebview2.exe	135
PID 4184 wrote to memory of 2672	4184	msedgewebview2.exe	136
PID 4184 wrote to memory of 2672	4184	msedgewebview2.exe	136
PID 4184 wrote to memory of 4628	4184	msedgewebview2.exe	137
PID 4184 wrote to memory of 4628	4184	msedgewebview2.exe	137
PID 4184 wrote to memory of 4540	4184	msedgewebview2.exe	138
PID 4184 wrote to memory of 4540	4184	msedgewebview2.exe	138
PID 4184 wrote to memory of 5868	4184	msedgewebview2.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gamevia.pages.dev/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gamevia.pages.dev/
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {f566e9be-376b-48d3-95cc-df87f389b72a} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {ac8f9049-009e-4528-ad2a-86edefbbd4de} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 25164 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {a3b02cff-4bad-4adf-8255-02a81f9acd6c} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27276 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {32d2752f-b71c-4c9d-860d-21a7a9690420} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34775 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2988 -initialChannelId {da0edec5-0cc2-40cf-b814-33cc34d305cc} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4848 -prefsLen 35012 -prefMapHandle 4980 -prefMapSize 270279 -ipcHandle 5016 -initialChannelId {0c0a109a-ed4b-409c-a9ad-6f7f3278ec54} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 32900 -prefMapHandle 5068 -prefMapSize 270279 -jsInitHandle 5072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {a45b8dcb-1b23-4bb7-b810-41317602be0f} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32900 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {13f09aac-3cb1-4789-8d2d-628153b3169b} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32952 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {2abf00c8-2afb-41a5-92a5-643cb5012de9} -parentPid 612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5956
- - C:\Users\Admin\Downloads\Gamevia_Setup.exe
    "C:\Users\Admin\Downloads\Gamevia_Setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4400

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4564

C:\Users\Admin\AppData\Local\Gamevia\gamevia-app.exe
"C:\Users\Admin\AppData\Local\Gamevia\gamevia-app.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3940.1868.11261453517511948788
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffbb073b078,0x7ffbb073b084,0x7ffbb073b090
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:2
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2068,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2424,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2128,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4548,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=784,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4044,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3776,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4224,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4176,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4600,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView" --webview-exe-name=gamevia-app.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4676,i,7928502764376440096,521245082917971534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:5868

C:\Users\Admin\AppData\Local\Gamevia\gamevia-app.exe
"C:\Users\Admin\AppData\Local\Gamevia\gamevia-app.exe" --startup
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1020419452\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1125972964\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1125972964\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1148140178\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_1274671271\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_580276967\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_597109143\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_840223295\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4184_881840340\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

gamevia-app.exe

Path C:\Users\Admin\AppData\Local\Gamevia\gamevia-app.exe
Size 47.7MB
SHA256 706ec108ad2cd9c17f665921b812ea8802f62bb6994ca4fc81744daddffafc41
MD5 95941836763568408a1897c708514ce8
SHA1 b90d294ae4d4013130af7a76e88218b2aca1c503
SHA512 497fd2133730c3a974fac715b221209bef3dc1871e4953fc01a76616e4f671d92dacbe290ebee164eaea23b952edbeb1f8ac1c7b5e4f52d70d8a66282d3eee74
SSDEEP 786432:Vksa+CjRJDknykh6SF1ZFileXH/iAblyHX0ROSbGrmew:Vkxjiykh6SzGEX/iAxykROedew
TLSH
T1F9B7F003F66290F9C16AC075925A6632FA32BC4943343AEB5BE04B313F65FE0667DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64.dll

Path C:\Users\Admin\AppData\Local\Gamevia\steam_api64.dll
Size 309KB
SHA256 eb17909a76668cf9ae0b92a618a34a50f6c73d3a6787cb4dd8ce36a8b10bfb75
MD5 6a93fe4dd0a832eee52b20e711063ef3
SHA1 45805c752f2d438889e476cd3773789847a8c82e
SHA512 e6ca4b966269ff85829ce119673a5b143d6f417aaa806ee56d6697cfc768840dfc267e2a823114d6c6f5aa1fb42c86f33ab7befbdf4fdca2984b7e0cff71f7fd
SSDEEP 3072:n0leVP204SLiYl7rOa/3KJBTrpH7u+h6yrFDK4uvLE+m5lhTbCgMWmXCEIyq+nUv:yeJ1NiYf/6JBTrpfUyBGh9F4ynv2ClSr
TLSH
T149646B3962750CF4E077C13A88465E0BFA75344B23219EFF266062369E177C21EBB7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 523a9eeef94ba8c0313ab4b625358cb7c77b7404df2d67d750a272b4a96b60f4
MD5 13d741ee1620ae7f442b60a98170dc9e
SHA1 6d22cd5703d6f4c3ed387a4a98c3756987c427f2
SHA512 ba1d583521c1e3ed3f86cb3e5a01924c4536673825eb11b9af509bef94b32a3ea496bfaf270577f8a08d9fcdfa68ba496c7231d618515d310c57a8205b68ae10
SSDEEP 384:HwCe7iO024YCdcs3hk2nhfdDE2Ba/rIVy8eBp+dp+i:QqZYCdv3hk2nhfS2sDIVy8K+L+i
TLSH
T193729DBBCF516C5D1927D985C9A98369DD15F9BB8FF6D0B608203489C784326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFF024B0F5DC6F8FAEAAC62218703D6F3CBC8DF2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\CFF024B0F5DC6F8FAEAAC62218703D6F3CBC8DF2
Size 56KB
SHA256 55938f4ab06edd478f944276691e49a537d52aacb52912cd41c2b42e77ba3e76
MD5 af77c89058a5a3d970f6d289ce90c00b
SHA1 1cebaad21e1adefbb783e7e2b2bd31f13eab896e
SHA512 2c157918f4a54e68dc14901b29c95b4c73bb0bd02f79e317da300b790e67a218f045e334476570c08cbe4f1774be9ad8826dbc0c72f7d10dde16cc7098453396
SSDEEP 1536:LsEcy7fXRGqqHmr7qv32UC7UetOGLkt1W2w29:LHTRlqHSYtgQtRZ
TLSH
T12C43F2398F9A5252C33711B6FAE4E2443EA55737EBF9C5D474200A0D6D847B0B8AEC4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 76f8bb7962f4b05bfcb97e8de87ff354b76e45d4284685ff2fee998621e01b9e
MD5 79c13a8dcf1504f504dc405dbbdd3393
SHA1 fde5b139bcdb16ff546027c95bea96708f6b941a
SHA512 9dd1b7f05925c7cb1c395c13b59b63d923bbc6588b0281fc90da46e913d459ff7bb28e059ee6b0e228091081d471fb736b6d7833da15b955762753a91b2953c5
SSDEEP 3072:j3lgP13owD5MF6U/3eIozgsAGSvJ4qJJP/PQvc:pgdD566U/upApv9Ik
TLSH
T156A3BFFADBA2893C54FFD42C6BC2843EFE226410F3A73009D963775092C5B786679609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgF71A.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsgF71A.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgF71A.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgF71A.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2875a1f62ec3dafa5b2e2f9f0bca805b7fa5ae229c87a672db8b4494cbd3e735
MD5 5ed3870c7b6fff486187c54ce62d173e
SHA1 48fb54fbbde020995eb7778ad33f577d922ba487
SHA512 ab75cedbba4d4cc5fa8e4dd34826c357b259a1de24c8330851c5aacd28310c06bdf751bbf873145cd036987dcb9634133aee819da06f02108b83a5eb6c6c8bd4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 494249bd57a56efc1359dd613104d546e670b3b05651080f902238cccfc94af7
MD5 41988b5295f0cb7cd9a04e3ab17bb7af
SHA1 0e51b3ebbad54d5ec0574df1e102bb9891f80ad4
SHA512 ef5e3ebef16407825bc8ba401724c90dd82a0d349d285cb7f52620b2bf494668babd2ea4fe2240fa0cf317e72c3b332360be5bb9441015952824b06d40ccff80
TLSH
T1E8D0121736815674C42038330002610C0401C21F800954885828952D1A480500E0A841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 03d785f0213aeeb86975898da6698bd8a241add0a96a12b9aea4b817c6c3552d
MD5 89ae10a76b0e1fde5b15a53a6013101e
SHA1 11ea92d1cf0218799adce1f1060769905221cb2e
SHA512 7772cd45f4d6946341da1770c7dcc7ebc3b25565c9aea36344301efe2781ff4c4b658b29acf145628c85147ab36ae48268b0cef20e6aab608838dc3335e0a2b5
TLSH
T148A0021205C811D3D210177568C5818532BD48244B038B9151F413F99D90F414581511
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe62116f.TMP

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe62116f.TMP
Size 48B
SHA256 f7e2408d4741e26e7184a6c0424b40f747bbbb1937141e560a8fa0e199d23329
MD5 87c78b59c95920d5c19e5a254c164a1f
SHA1 494cfffb157b5dda8fd3881cc8b86f1d088809c7
SHA512 04470e793f38ab012ab84b456cc0fcb82ba03ca9d0e6e716ced3e9f5272d26b56daf2c4596f24d000bb905af07ac8f949f13bd72165b4a4584741399ce0e8259
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 4ade12bc434b49946489032eb68c1f0712d95e014f73d0cc04be79614b58cc59
MD5 8c82a7cd5e3b567adc53c61b2d5ab2ac
SHA1 ab0837ef0b03570f4c3a7496d35264be2db5814c
SHA512 29d48bcf87171705d6187d17b8c7b6c77106413adcb41f9d62a8157fdc5b0f4bf50055183ae2dacadc2d8ae25cbba73e740d5165d07f1a139786c1f3f8b0e9ae
TLSH
T1AB317EA2C2E8C66D895166E067343917CD2D051996383D27CDEBEBDE67E1071D22160F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe62d02b.TMP

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Network\Network Persistent State~RFe62d02b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Preferences
Size 6KB
SHA256 a020093ebd7c078632c055b7a280567605af22ad7f777e47be069846ec1074a1
MD5 45c3f7c5fce3e3830b2dd9508f0bdc2f
SHA1 9e3dbeb4544f9a2f13fdc767dd5e6cca4f5f7925
SHA512 7ed2ba18c1ef63114a65ac38d9cac98006b5ecd83437cd57d767140c9cf899996ad3c1195af1217a02c89e82099e087fb60b197f725f18110b2e928536ea1d66
SSDEEP 192:stJ0BhfKZ8paL6/S+WiTHkoxgDponN+MC:staBhVt/Voox5vC
TLSH
T124E1A7076F6859774CC7F6197A25BB12E2F6106266D44E94EBFC8A1C04E6ACD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe6254e1.TMP

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Preferences~RFe6254e1.TMP
Size 6KB
SHA256 a3029ffabdf6e64756eb2018b6017520630505b8b4a86b78b11c6374a3d299c7
MD5 eb2ef6945268a9b51c75b558732138ea
SHA1 c412fec240f9826b4526ee342f5425042f6216c7
SHA512 e65b0ee21287d22581aa3b9c2c69bf7540d680dc1e478ea2b94a61dedf7b51f8e39e388bba0e1a54a53440aaf99b03f897c5a3f3ffe4286dcf4e41c309e2733b
SSDEEP 192:stJ0B5fKZ8paL6/S+WiT1KwxgDpo7N+M8:staB5Vt/Vwwxtv8
TLSH
T16BD1C8075F78697B4CC7E6197A35BB12D2F6107262D44E94EBFC8A1C04D6ADD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Local State
Size 2KB
SHA256 6ab037d829f9a35cff2f2f250fd35aaa12542230c85ccc190c15f23408f87eaa
MD5 5cf4cf6cd8fee7a920a0678d59abb988
SHA1 fdefe2a6463e34c7852aad71fbd01d9cea1b6c52
SHA512 70266cd5d704b235d5b3b7155d54fdd126f17c6a42587b3946ef88ca599f5e81e9a6721a48c7b57d9e21a68054032b8a9bf2e85ba9d289c926b9d6758dd5a655
TLSH
T19651C533A9659B3789E396857D463B136E365075D7616F6096EC0F0C01DBAAC2306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Local State
Size 1KB
SHA256 860513384320d8585e0e65e5a0be910fef95b88522cc3b37f995c00dbfa1272a
MD5 902ac50d739b30a6a61132769102fd9a
SHA1 40b3ee5b2c80eea49078fc7d84e7eed990f20d2d
SHA512 e9216e8411b59b5914a106224077390f9253294c2187c5a9ae6e087f1392867a8742a29b89246bb3e5dfd2254ac34b35e379e064f6918fc5d310c11d8a4fab96
TLSH
T150318573D5A51B765CD3E28676427B572E211076C2218F5492EC4F0D02DBADC932AD37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Local State
Size 3KB
SHA256 dcc248201536963297bce10de5c56e64cc048ab79e40b7163640d84f87c7b39e
MD5 9eb5ced8dbb02eeb7d4f756368855d03
SHA1 971e0ac19e203c0e2037ec77feddcc70473cd182
SHA512 0f4f46c8f22bd7a842a835562ace22820dc65f29bb675dab4183fc8be70f4752b790d46c2a2f484598413fa38523a34d213b20814f6ad6233c434173c6409396
TLSH
T1F471B536A9659A3B4DE3DA45B8862B067BA24037D6913FA4C6EC0F0C01DB7D81342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Local State
Size 16KB
SHA256 8b7ccd8a8f0b0b4b4ced33ce8ac9f8fede85beba49da760984b8bd3dcd83fa2b
MD5 6c868cc6efaaa5b878edeea38d8c9da9
SHA1 5c45c79c1f985ee9e85e9e8305c716641aea933e
SHA512 d398360bf703eb96cb6fc272e130042d5ca4bef790610827f84f4f76f9b3ad7100475dd7756f349faa3490a6a93b10df42dbfaf1673dbcf0f404de889f3177ae
SSDEEP 384:zN+aQikB+z/xvxjg/qhEuNbpSmJoyz9zn:c/UxvxjgC+lMoyzFn
TLSH
T10E72AE2B55796E3399F3E6057A59074FDBBA94B290C1AEB88AFC1F0906C73D40302C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe61b574.TMP

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Local State~RFe61b574.TMP
Size 1KB
SHA256 986a0bb8d09eb786e7dc7c7f2231a97f04af62220793075171b34d6b3215f6bb
MD5 990f03c2209262dbbbd008a04a295d9b
SHA1 a705476b3846c46290ce70d4246d87650146343f
SHA512 2e870fb6a2a7eb2bae3c5a6ee1542826b414467a06d2a139dd466a8160d728884bc717fae9db4822a237a196e9f49144d571f2056b2e648485f1a2cf7d1aa928
TLSH
T1E9216573C5A91B76AC92D5C67642778A2E615076C2108F18D2EC0B0902DB9EC5326C33
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\com.gamevia.app\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\AlternateServices.bin
Size 7KB
SHA256 8bd2b17ececf1c6056b429ef8637f05534a1730c50f40b0bd91047bba5a97189
MD5 0e1fd56e1134eda4aacc4796508cb4fb
SHA1 fea401271f687b8840ec7adb4726dd5de23b3473
SHA512 d3b25ebe18d5b3bacddc50c950c0c814968124453370956ea96bb516eb219d7b0f61691741fb4e40bd04dd34dce71c93d4763b92a720c1ca0cca53c82c73dce9
SSDEEP 24:nuhMZtR8UruJcUkUV1+quNez51cquJvol1jKuJh2Q1buNNs1:zRnavVIez5H5V4s
TLSH
T12EF188EBB3769199F0724FF4609A78889D63060B3CE945449F10D0AB0D922D6D0EEB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\AlternateServices.bin
Size 11KB
SHA256 54f7ddd5c7eba9febf899c06bc4dc19e60906b49e7361399f24de99275efac87
MD5 da7df5d16f658d6d85965eb44af61186
SHA1 bdb7948253b7e8ccc7f4b555fd52409c180cf6d5
SHA512 a27c0817ff172eb55e5503b1d03b425a229880f4af54c47dbc3ab0b3b5fca6a140e9e70b098f20b845066abb9df80e98e32e881b3f429658a2f01d16d0084f56
SSDEEP 24:TRuhMZhPrdUruJcUkUoCM1UquNezFx1iquJvoFx1QuJ8E1tuNN4F1Nu9u1z1nuZX:TVPrSavo/aezFxhx0ES4F11z3zd4P
TLSH
T1A03283EBB37A9159F0734FF4609A38889D73050B3DEA89449F10D4AA09C6796D0EEF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 aa5489e794a3f0c4d15b1da8669d80061c825465b0e96e2eeba7b902fe8d1c35
MD5 636ba0db6bcde3cad5c832eb41d8df30
SHA1 7f16b78cdfaf06d63562c95fcbf92115c420ab62
SHA512 71e77b926e495fbca414ca7637fd7f7560042195660a6b4f10dcec66e2b96e44b362748076ecab4265b4b01411bd90b25fa418eec9c5235e42663c2b33d63efc
SSDEEP 1536:aeWErBy0U6RMfsy0LhRFuki7stnVRU+G9N0WwzJesswo36Ob:aeW4B7Fq0BLhXiwVUtAl8XRqK
TLSH
T1E4632344EB1A953FD82802BA9CD21B007F79F8895A0A2B67371C54787D873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6dc1b33b712b383a4f8f4b73e9043776a637bed43c367cb004c15fbe0b99bdd2
MD5 505807dcb8048b5443c9febc19496251
SHA1 a96326945e334dcba5468483d6d229d2b42d2bfb
SHA512 c042bfcdbe51ec5e0d979edc4bde6924a9407fc17254ba91008250c6904f73d9a0a7b531f0a22a0a88fce8bcd4c78be611bc24f5bd4be088ee86acf6ee451b93
SSDEEP 192:q1d66JozGzgCl6mc0dJOv5zboP1+fyjqwP:Ud66JozGzgC1jUbod+fyjL
TLSH
T117E10D68E628863FC408037BCCA61F454F39399A988E3F1875AC651C2D572DE3B9E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 83f6f1c39371ab390ec2c1aefb17552a54e78bd32e317372745117b890529cb1
MD5 8995a4825d42e3b8d1d88c14a02d828d
SHA1 0ba9b8711deb44f90350ebd719803f6399f643f3
SHA512 1022133836a409d8f955c5991283835fb76e04435b2f5452f7cd6bef18d9d40133bc803a2c588be70dbc8806e6078f804a782e8bfa8af31858ef15bcbf8df17a
SSDEEP 192:tOv5zbowb+fyjqwC1d66JozGzgCl6mc0dz:Cbowb+fyjQd66JozGzgC1jd
TLSH
T11ED12E64EA28863FC808437BCCA61F454F35395B9C8E3F1935AC64182D5B29E3B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 038a15744480def431f7026146e9f85f3e1cfd5c83f3cef09da5f99f3a1bb8ae
MD5 53ec223d46f24f9b291961bbbda3ef45
SHA1 6ab1e9072c1c7d9ecabea9096e01244899f7b32f
SHA512 543d315fa7bb9ffb838dc6ba4611512a1126e3b697d6729d85d108a60afa40d0fbd2c555f9dd48398da04202fa6045f23de829cb7148d26fba302bc1bd1cd184
TLSH
T1D1113D9C39BD4DA999C7D3587442028E57228E4749C71D434D02EF8DCE81ADE326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 4KB
SHA256 45f4903573b653f5ced81ea0819990dd7919cdf4855ee047646edb1a4916a6ae
MD5 989b127f66d4044ec9c02c0a00b142ab
SHA1 a3bea300b9effe83578058b35abc339fd692be4c
SHA512 718d8700b1a83a3e12b0ae7bb040794d991da5b90c1a183eeb5326f070179116d2ab1f2f08f9cf5bfcde39e24474b716f550d247a5c3af6aa83a4b6c43dc8330
SSDEEP 48:YE32lc374RRJO+bClPCEgH7lWReWCXIWl3WzHOWwWGHLuu00C2sPDCiDvD5Z/cKU:hRcETCbYzPjGab2sxHe52T4Oxfoqc
TLSH
T12DA1FD4C62BE5CBE6CC7D39CB846028D56D6470389C72C834DD7EE4DCD86A5A329F429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f051764-1f47-44ce-a35e-922bc355684f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\1f051764-1f47-44ce-a35e-922bc355684f
Size 235B
SHA256 51ca339160d2b17f8382d9a16974b92796868b616902140bc6d5dacf7d28856f
MD5 1958630019ffa7988e9497e6a1a530b6
SHA1 ab36ebb0de7ca56623ab3712438aaf0668180858
SHA512 4fc3c00c6924b56085b65686412f8642886297566c216bd4bb0401c7b08cab47274dcd5ee1dfcf54d2ac50ca4d7ebda7f1b942e80c37da5a58cc516436ca5d16
TLSH
T10CD09780249CA72D48140F07F0E02CD236848C331860A860D6A095B489FA9C94261807
MD5 SHA1 SHA512 TLSH

Submit Download

22fce476-a21c-4690-a255-292d9d521e83

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\22fce476-a21c-4690-a255-292d9d521e83
Size 4KB
SHA256 17478c230f595a11c3280d61ae7afe608873d15a03db2c86e0dd532e2a44ca7c
MD5 51de08f952f4934f557df8e7c3458849
SHA1 afa47243ad047200f23a12a4840e17c20d39e61f
SHA512 fbf98167dfa8a6eddbeb6cafd4679d2074d97899fc71800b665c1a53a0e82af392acf9889675d491ab74c938b206876ee1ab8014a2b656ed29e687c6edd2ee2d
SSDEEP 96:SvrNedU63ktmMMMOQeUe6cgT8DfSnr6AKkeLo8b3/biGE9t9KT/mqHmwm1Cn/hRh:Svf5QSrxLM
TLSH
T139A1DAFDDC2250533A66E22DF1E9FEAB005A693149C8879D6BEC4C3A32D6DB74563301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37cc2b16-c3e6-40e3-8396-62eaf4577773

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\37cc2b16-c3e6-40e3-8396-62eaf4577773
Size 2KB
SHA256 13d0135b17a2753c75efb3ec18412d02e7bddb9d9f4a39718b7f45d1fff13b09
MD5 a1eac76e8ba94f13b0233377bfb2997a
SHA1 41af71ec06a35b75db0a4f00b312eb65a6a6efe6
SHA512 0f4a920406d55d9d492ab51f2b61c8ebcc7f4b43a146c09b18694cfda5121395f06ad44eacfdf4b5412b39198bea1febcd59c2770ed5446d846371d0890d1333
TLSH
T1FB41245C36785CB79CAAE6CDD082278E53A48A0310C61C432D62EF0C8C96659736B53E
MD5 SHA1 SHA512 TLSH

Submit Download

66fa21bb-7591-44c0-867f-a19d5e789caf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\66fa21bb-7591-44c0-867f-a19d5e789caf
Size 280B
SHA256 b0acdd4000bdc2b21e8da796b331c518ad98cc4fcd1f406bbb3d3c5027bc011b
MD5 a4e8792036dc673db1dbee9ce8c29bf4
SHA1 30be8615278e7d921aa139cd1f2e5e9ecd06ab5e
SHA512 311a94abcd59cc5ec55c07e7d70ace735b24b31aeed5c693aa4cbce5c823ff08c014aa7c54fa1ebe96f8e5494465f0277128b366bd5370fe12b40deb97547364
TLSH
T1D1D0EB822C8823AC2C690F9BB0A07AE3302A0C3364F01820A6A00938A6FEDDC8020C16
MD5 SHA1 SHA512 TLSH

Submit Download

87ce492c-3535-49bd-a94d-c9346ff380da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\87ce492c-3535-49bd-a94d-c9346ff380da
Size 883B
SHA256 1824c033824c730961969cc4ccc768d511c489a11b4b3ae8c176e8967f448e26
MD5 50ab474b51ef549f7092c48b52037aaa
SHA1 2d9f27b6a11833af0ff9b6704bcd6a2d378c2aec
SHA512 dbb90c4c6fd883f54d98ef01bb998568ac2a9c6f6d8e1c474cb6b19b84e17aa9d4fc1a57ac8c1154cb420dfc5f9d5ba31d2a272e2e1ba08d404abd04ca6a1439
TLSH
T1AC11C0959774F8F3CC28824BC99677028BE47227C4C951142D615E284D7E51EA7E660B
MD5 SHA1 SHA512 TLSH

Submit Download

b7cddc17-6156-4121-8e83-0f2aa131ef6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\b7cddc17-6156-4121-8e83-0f2aa131ef6f
Size 15KB
SHA256 3ea4695fa8f41dcf13a98a06099738c00631f5a213290cbe8da0d3911ce62656
MD5 d71b73b872b8dc31c9d7ccd4b1edcb35
SHA1 9260018123719e3abae9128d23f6dae64c872ac3
SHA512 7013ea47ea474dbce046380bfa678d68ad3cdce9a0d49e28b143659c71d3500c850e0168df2eb5e46f93b8c4fdf1161fdcfd91a24d683321ccf2814e0bab0586
SSDEEP 192:EtWs/B1Tk3jdn7zeMdOkQglx1rHSyBGNNWHF78HW77Ggy21iB+q4ubRiF29c+ujK:zggd3PGkF780ChH4ORiF29cJjR7WH
TLSH
T1F872EA56643048BA8251E39898ECBFC3E5F528CF4C415FCADBE4BD086DEE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f71cce3e-b46f-4390-8e1a-ad7de44d5b03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\f71cce3e-b46f-4390-8e1a-ad7de44d5b03
Size 931B
SHA256 68a4933a878e7f61ecbf5933c28379e93c2dccb5841a8fb7280b41937980d8c6
MD5 ea915cf5e10344317644cbadac3f610a
SHA1 ed9baffcf65d8a5bdd299a15e36cf79192be4778
SHA512 acbd8b99d7378ad5723ddb93dea67f16f85cd7d1ac0e77ebe21136a557e0072852384d4cf7178832df28fa2a9c649ca7102eb9770ab853467acf22d4c381b9d1
TLSH
T18B11D0919A74B4B38C78938B95F537428BF4B11380C609047EA15A1C0DBA51FA766707
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\downloads.json
Size 1KB
SHA256 1fcf4d1e203cea0603663a6b2d3183ece34ee431ba4c5874321ea2346cbc2d3f
MD5 254e0b43c180ebc3be9149f1aea25553
SHA1 bf8f21e383cf0f8db992ea275459cc43cf30cae2
SHA512 e04b36ad29cf7ef3b654e697ed10d85e215658f6c105c55501d9a99bba1428a4e82c46dd863a8f1b0f7fee700c403e9624d31a26e974c2d2f57837adf88229d8
TLSH
T1D03185F3E037CDDE67467991892C3F1F9D21B09B85C4412E15E9D149818057716BAC3F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\extensions.json
Size 16KB
SHA256 463cae36b4e5abd5bcf00c9fd530741195654922f29e5b6a5693263e076fcc96
MD5 95af64d70f70ede12d789f8cd012696f
SHA1 03761b521b2c1082b949ce156c6ed3df8781df1b
SHA512 b0dc0eb880b6608001d5855de55ab09a6b508bffc268459d629c80d23c513353c5cbaff796b470fa59690827fa5f1a38cc58736bda6648eea5ca55173ed80f4c
SSDEEP 384:HkI4vYUmldvL8dhW894z/96ozL4HHL4P/L4HdL4HsL4HoyR4hc:EI4gRfoXV4J684L474d4G4d4G
TLSH
T1BA72521545048EB8294EA79BAA367E02C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\places.sqlite
Size 5.0MB
SHA256 e0ef850590af3d8b96a8a519ab4e8138294900d24ee9cb09322b3c38c53e47d4
MD5 0535ecb04196aa948f3af239c1560ce0
SHA1 08fdcfaace4dc0bb498a0c86574bcecd6f061cf4
SHA512 bfaa17e9c44d2ae8db1c94ff6d54fd7a23be1278064f2c108f04862963cc7bacbe7962ee3ff8727fc3cf830088543ecc969fd203762e7da47ac875ba24ac9189
SSDEEP 192:M8rJQaXoMXp0VW9FxWnUvehzblnkDkjpzPcZaFyQXT2xJm:M8r54w0VW3xWUvehzpnkDkjpzUxT
TLSH
T15336835F7A301095C4EA9232ADE26F19183F71078A3676833E94256D4DE0723B96DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 b3b2341ce7778474fcb634b1a5ad56f5b7961b25601f51633c32af68d4346986
MD5 12bb61c1e307f8afcef4d41999c08275
SHA1 a0ebfd14e851ba371c6e30593cbca8b87da10ebe
SHA512 4d0319bac52f2518c64a9afa72804db1b368b7e33c19cafe1eca4e090a66c84bf07c73c6088b5d74a01ce0ff8aabd7be32f2f8170f96c5ba29c9dd311c5efd87
SSDEEP 96:xHrUTUmqGq6fzIX1zSgdSSlfdv9jgnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzIXZdSSO9NWBrODBw88Jr
TLSH
T18BE130789508CB6F74B677ACAC6488716AB2013BBBBF68C350B554C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 7KB
SHA256 50023d4e5066c85cad97d330f8b3b1b13bf7e851d51d4ae511720def174fe085
MD5 5c083f3738b26a6a0dc9d4ea58d98c52
SHA1 9a8f05f2704535064a2a1cccc2667e403821f2c3
SHA512 6ddd499ade1011112fba5c02badb20eb1f584e382d58f6b93045e36290abc95189add513665f761eec08d57b70f182c661f3fa434795f71f8c947e2b0725cd2d
SSDEEP 96:xHrxTUmqGq6f/IXObzSgCUmSSlfdv9jgnpRHNWyS9JOHBw88z8L4cnuFNqGS:1cR6f/IXqCUmSSO9NWBrOHBw88Vs
TLSH
T19DF100789108CB7F74B676ACAC6448316AB2013BBBBF68D750B554C8011CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 eb9f4c970cbc3ab0d73f83dd5a174b56200ef20b40c8828031abf95740763952
MD5 5cce7b611a8784b7afe389506dc6d18f
SHA1 1eb1cb8c82afcaa7531df97f6d182526f54f8c76
SHA512 e3a8a741086c75bb219da5c8a55913c360badad9d410e9e5f0b355cc0c27790ae08ac8eaf17ae4268e1d326b498e93d73c3703a8456fe83ddb0dfa40e9cd5452
SSDEEP 96:xHrUTUmqGq6fzUL1zSgdSSlfdv9jYnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULZdSSO9NWBrODBw88Jr
TLSH
T11EE130789508CB6F74B677ACAC6488716AB2013BBBBF68D710B594C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 3d73cff5db9b941fbd155747b9313cdafaf744d379e586e8ce831566677d6990
MD5 9a19edccde632354ec159f994c9bb233
SHA1 a4892f3d626e1768f571a5be1f13146922c519df
SHA512 0ccdbc614d3a9aa29eecd26b63114127eab1433ba129a4687d116205b8398f5bd6f2b9e954738f38b8e530733ac513ad69a65a87f64d8fce345ffe505deaf34c
SSDEEP 96:xHrUTUmqGq6fzUL1zS5SSlfdv9jYnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULsSSO9NWBrODBw88Jr
TLSH
T1B7E130789508CB6F74B677ACAC6888716AB2013BB7BF68D710B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 12KB
SHA256 f453b46fa75aff6df4b5973ccfabc12cf2380cb113a29ae071031848472d3c73
MD5 535bff61f986223ee02a0b4898a42d41
SHA1 22497b93c9400fbc0f2b189d6a25d80f20b59d63
SHA512 c9f5d16c4687553cdbc4588adf6147e48a871528be8579916ca257c2ba3007bb40a22aaf985a5eea8f1df950a42e507bfd29d65445c65a0c0ed8abce08204097
SSDEEP 192:icCR6f/IXqCUmSSOXLRMWBrOIOBw887dcFCf1F:XfRMWAjwxBtF
TLSH
T17D42CC7855458F7F25B2327DAC214DB069A20627BBFFBCD205F89895080CF2441E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 31e834a4574018b1f883ce0fef788849d5c36a6a02225f473a407fb6f406d8c8
MD5 de3b9ca35466a760d71c323992cfba58
SHA1 3ed6a184653fe6596cfe7d517f4f7297733c94f8
SHA512 08a9797326dfd6591b28922ac1ebb5b2487f789bd8685db9e1c98c9e73e2c9f1dde944da3ad995ea3fe9f91fd7b3fee589d4b58df56283a37b0240996fecbfea
SSDEEP 96:xHrUTUmqGq6fzIXObzSgdSSlfdv9jgnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzIXqdSSO9NWBrODBw88Jr
TLSH
T11CE121789508CB6F74B677ACAC6448716AB2013BBBBF68C350B554C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 8243bf186ee7565e9645067c41f4f567f45f022a5d52a755659f4542ebb4543c
MD5 a7d61c89139a88a9084b49ef2f5a0b94
SHA1 d8d289448fc012c732b5e20b00a8b0c7ccd381be
SHA512 5cea08b533f5f0e6c44eb6d0418e8ee8d6191a503f704901bc08ed4b2a1b081fd4feb534ac2c5bad048585f16a53e0aefa6e01e61a6397b83300955f94d6ac8c
SSDEEP 96:xHrUTUmqGq6fzIXObzSgCUmSSlfdv9jgnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzIXqCUmSSO9NWBrODBw88Jr
TLSH
T1C4E120789508CB6F74B677ACAC6488716AB2013BBBBF68D350B554C4011CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 12KB
SHA256 42b167b2979e015ca2ab2aa2cdcc8e5622f7abe24debb3e49bacbc6d6f9632d1
MD5 aaf81d3123601006cccb8cc388d411e1
SHA1 1ec0d3d8aee9e17e4bbfad795134bf5dea954c70
SHA512 c44c3d6ec45d18d4bb49ca9ea7800faa417227537a8f004a209a2975affd17c831409ac5aa6dd01c61e5c0ff32d3e1fce13874619084652291fbe9c967bae6a4
SSDEEP 192:1cCR6f/IXqCUmSSOXLRMWBrOUOBw887dcFCf1F:AfRMWAvwxBtF
TLSH
T16842DD7855458F7F25B2327DAC214DB069A20677BBFFBCD205F89885081CF2441E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 34KB
SHA256 3b7af5311d39e85552209aa5d8b6178785dfbac894bd561114793961b2850bc3
MD5 6d43c2138e7e13599051be06dccdf4b9
SHA1 dd2aebf2cacb9b3ac8df5cd0ff1957abcc00ec9e
SHA512 47541637303e9797b1156a965b54afac32c55cceaf941343fb656254b43eaad0ce4aacc5b4d2d38136432d6aa4d833906308cc56d1db4ae99e2193b5418954df
SSDEEP 768:J+ldJkmXBWeSDbEJgm4+fMcNSO5hHw+YP+PDXiwpes+AHw:gnBFyF+fMcNSqhjY2P+Vd/
TLSH
T155F2F11FCE3EBFFE56E0145B4407AED767B03C9AE2ADC169440DF14A0AB97E2A443160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 34KB
SHA256 69bea2d759dbcc705a35de800e217bb4fb251017b7726af067e5d0292ba08948
MD5 b130aee085b9b7323a5e357eed1c368d
SHA1 8a38547ce5067d6c1ead5ba8a774ae53b2127205
SHA512 f123d62850d0f0936a45329862bc77436ef41868895ae201b4b6483b03c50a8ad29f71b850ec8f215b0ab4ee4421268f6d161f43a12e7ce1009addedce31909a
SSDEEP 768:Vm+ldJkmXBWeSDbEJgm4+fMcNSO5hHw+YP+PDXiwpes+AC:VlnBFyF+fMcNSqhjY2P+VdH
TLSH
T1A4F2E11FCE2EBFFE52E0155B4507AED7ABB03C9AD2ADC16D440DF1450AB97E2A443160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 34KB
SHA256 21a5066f7c378c4194586781e319c556d4b61f93f5dc0e82accbaa2119a74b95
MD5 1be40dbca09914c4613423b71beb5514
SHA1 14588fcac617246bfcd2141f8723ffe76fa4d35d
SHA512 61079eb8803128ef1fb9f4c6e521ac0533636dcca28a08c2ce2a6579e47e850eeb4cc4b87e9b51b25a3c5fa8ed972c36eda2afbe265403334fe12cebb10b70d6
SSDEEP 768:V+ldJkmXBWeSDbEJgm4+fMcNSO5hHw+YP+PDXiwpes+Al:EnBFyF+fMcNSqhjY2P+Vdc
TLSH
T181F2E11FCE2EBFFE52E0155B4507AED7ABB03C9AE2ADC16D440DF1450AB97E2A443160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 34KB
SHA256 4bbfcb0580899e450cb5fdeae8889736af0ccf7f2b0e20740b57979197bb0f62
MD5 21052ded74f4d206376f258a01567f87
SHA1 84c26f93a6d37783ccac795bf6b145e4f580b1de
SHA512 a0e140941caded7f7024b470c097f52adaa4ac5a00a081a65939fa4953f226a5185b8383679a8b7027ee3fd0d72bb12bd2c97d704e068db546121a2df44330d2
SSDEEP 768:F+ldJkmXBWeSDbEJgm4+fMcNSO5hHw+YP+PDXiwpes+Aw:UnBFyF+fMcNSqhjY2P+VdT
TLSH
T1CEF2E11FCE2EBFFE51E0155B4507AED7ABB03C9AE2ACC16D440DF5450AB9BE2A443160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.jsonlz4
Size 34KB
SHA256 4894561f3ecaf9bb371fd2ac78454923759548af6f40ed8d33d09bb5d856486d
MD5 c7887797df2a1994d4dd0ccf29b19fbd
SHA1 de464b61a4f6db6e04fbe208ec21cdc1dcdb88fd
SHA512 1747010319da8bd2d07b22ce83b38fc6b632d384a64c169e8e7d8e4bb6998457fa715f206344cdc75c97b07b48e5baeb2487829a259adffdf4fd038531167ebb
SSDEEP 768:w+ldJkmXBWeSDbEJgm4+fMcNSO5hHw+YP+PDXiwpes+AHx:3nBFyF+fMcNSqhjY2P+Vdo
TLSH
T141F2F11FCE3EBFFE56E0145B4407AED767B03C9AE2ADC169440DF54A0AB97E2A443160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 2ed21c095eb26bbc054d9a65da6441a514230151acb1d903ee635d5334c12ee4
MD5 748b6d5d6bc2b6ea79fdf8be4a3f8c89
SHA1 4c52dd1688fd0b97ac15b98e5ebe87eb5573730a
SHA512 e5078450bdaaa7dadc2a0156f04727ba3692ea2d7d915a3ed81a9eb7f3f67285678c2a05a8e222e93700f90b4eb974732e48bfa0a3ae3cfdc36be492445a4b96
SSDEEP 49152:4ZdqxU2zaeUT6QC5zYYBAeWdzETeFFZ70sabupWCZiS8gDtRb7YzRggzBrZig8SZ:vPzBrAg8SrmBXNS1
TLSH
T1F8665BE420E29252F34140B3719A53EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 0fdd36bb2a8d5d0dfa5fdd1cc43ab4f98752d6691673abfc69efb2a782519dba
MD5 6baf7f7077145e517b63d89407add8db
SHA1 cb4d97fbe7549ea747248b6a2b63e0c71565aeab
SHA512 e1b78c1cb623237f3fdedf6ddaa0314f3c373d28e96830a2afbb169ced17f72767aa446b91f682d3087fe38d00e487898b063f5761de60b891863729e38fab3e
SSDEEP 49152:ZLZLyzaeUT6QC5zYY0ASJ5dzETeFcZ70sabupWCZiS8dD9qb7YzRggzBrZig8Sn3:HJzBrAg8SrmBXkSc
TLSH
T188665BE420E29252F34140B3719A53EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gamevia_Setup.gNVmrEEp.exe.part

Path C:\Users\Admin\Downloads\Gamevia_Setup.gNVmrEEp.exe.part
Size 39.6MB
SHA256 6a81220a87adf7a05824a6524079c053668ba9a216134b7522f485c552e4d046
MD5 dff7ff406c1adc7bb6b0b2a606e82fdc
SHA1 cd04b2d265b4e1592542eb1954822ecb1f6278cf
SHA512 e334ec50f4305717b99cf14e7429f607656bbe43fb2de0ff657358d6838c4b1e2931f1f667f95f76f22e82be550c9d1b774e73b52ae6f562f7ead00de769f060
SSDEEP 786432:tWrZI7vmjEB70wNB1JwCIOllRI2InZhX7eRFuOlR7OweTpEQuy/:tWrZI7v06XwCIOzRI2IZhXiru0R7Ow4P
TLSH
T151973388FE9D5D2AC58DB9B01619CEC03F3B4BD0EA9A63725FF0D43BE459501E2E5224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1472-1188-0x00007FFBCCCB0000-0x00007FFBCCCB1000-memory.dmp

Download

memory/1472-1182-0x00007FFBCBAB0000-0x00007FFBCBAB1000-memory.dmp

Download

memory/3092-1256-0x00007FFBCB5D0000-0x00007FFBCB5D1000-memory.dmp

Download

memory/4208-1140-0x00007FFBCB5D0000-0x00007FFBCB5D1000-memory.dmp

Download

memory/5004-1715-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1710-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1720-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1709-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1708-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1714-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1719-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1716-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1717-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download

memory/5004-1718-0x00000249905D0000-0x00000249905D1000-memory.dmp

Download