hxxps://gamejolt[.]com/games/GoodTimeTrio/382276

Analysis

max time kernel
974s
max time network
1153s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13/11/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gamejolt.com/games/GoodTimeTrio/382276
Sample241113-2jnyks1bme

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
3732	setup-gtt-64bits.exe
2724	setup-gtt-64bits.tmp
4076	GTT.exe
5096	GTT.exe
2428	GTT.exe
4528	GTT.exe
4752	GTT.exe
5084	GTT.exe
4228	GTT.exe
2164	GTT.exe

Loads dropped DLL 24 IoCs

pid	Process
4076	GTT.exe
4076	GTT.exe
4076	GTT.exe
5096	GTT.exe
2428	GTT.exe
4528	GTT.exe
4528	GTT.exe
4528	GTT.exe
4752	GTT.exe
4528	GTT.exe
4528	GTT.exe
4528	GTT.exe
4752	GTT.exe
4752	GTT.exe
4752	GTT.exe
5084	GTT.exe
5084	GTT.exe
5084	GTT.exe
4228	GTT.exe
4228	GTT.exe
4228	GTT.exe
2164	GTT.exe
2164	GTT.exe
2164	GTT.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files\Good Time Trio\is-N6LKF.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-FU1QU.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\locales\is-RSR82.tmp	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\d3dcompiler_47.dll	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\libGLESv2.dll	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\nw_elf.dll	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\unins000.dat	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-B54RK.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\locales\is-H9919.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\swiftshader\is-EN6RF.tmp	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\swiftshader\libEGL.dll	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\ffmpeg.dll	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-SDFTI.tmp	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\node.dll	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-E2NO8.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-2KCKC.tmp	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\libEGL.dll	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\notification_helper.exe	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-OB8VG.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-A062A.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-6DPVO.tmp	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\unins000.dat	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\dxwebsetup.exe	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-4NKCK.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-LA6I8.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-7QUB8.tmp	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\nw.dll	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\swiftshader\libGLESv2.dll	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-1QMH5.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\swiftshader\is-JIAP8.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-63GV3.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-VGPUU.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-J087C.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-B6AUG.tmp	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-D594J.tmp	setup-gtt-64bits.tmp
File opened for modification	C:\Program Files\Good Time Trio\GTT.exe	setup-gtt-64bits.tmp
File created	C:\Program Files\Good Time Trio\is-RR822.tmp	setup-gtt-64bits.tmp

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\setup-gtt-64bits.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-gtt-64bits.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-gtt-64bits.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3973800497-2716210218-310192997-1000\{A550AB63-EDAD-41D9-8C97-D0C87E251F80}	GTT.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\setup-gtt-64bits.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 44724.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
2872	msedge.exe
2872	msedge.exe
4812	msedge.exe
4812	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
4744	msedge.exe
4744	msedge.exe
2724	setup-gtt-64bits.tmp
2724	setup-gtt-64bits.tmp
4076	GTT.exe
4076	GTT.exe
4528	GTT.exe
4528	GTT.exe
4752	GTT.exe
4752	GTT.exe
5084	GTT.exe
5084	GTT.exe
4228	GTT.exe
4228	GTT.exe
2164	GTT.exe
2164	GTT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4588	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4588	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2724	setup-gtt-64bits.tmp
4076	GTT.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1656	2872	msedge.exe	79
PID 2872 wrote to memory of 1656	2872	msedge.exe	79
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 112	2872	msedge.exe	80
PID 2872 wrote to memory of 4328	2872	msedge.exe	81
PID 2872 wrote to memory of 4328	2872	msedge.exe	81
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82
PID 2872 wrote to memory of 1064	2872	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gamejolt.com/games/GoodTimeTrio/382276
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82c083cb8,0x7ff82c083cc8,0x7ff82c083cd8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1828,16494347429917737838,4427282292502264626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Users\Admin\Downloads\setup-gtt-64bits.exe
  "C:\Users\Admin\Downloads\setup-gtt-64bits.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3732
- - C:\Users\Admin\AppData\Local\Temp\is-K677S.tmp\setup-gtt-64bits.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-K677S.tmp\setup-gtt-64bits.tmp" /SL5="$70268,58896883,58368,C:\Users\Admin\Downloads\setup-gtt-64bits.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2724
  - - C:\Program Files\Good Time Trio\GTT.exe
      "C:\Program Files\Good Time Trio\GTT.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:4076
    - - C:\Program Files\Good Time Trio\GTT.exe
        
        "C:\Program Files\Good Time Trio\GTT.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --annotation=plat=Win64 --annotation=prod=GoodTimeTrio-Undertale --annotation=ver=1.934 --initial-client-data=0x264,0x26c,0x270,0x268,0x274,0x7ff8289a7540,0x7ff8289a7550,0x7ff8289a7560
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5096
      - C:\Program Files\Good Time Trio\GTT.exe
        
        "C:\Program Files\Good Time Trio\GTT.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=GoodTimeTrio-Undertale --annotation=ver=1.934 --initial-client-data=0x17c,0x180,0x184,0x174,0x188,0x7ff6c0ccd0c8,0x7ff6c0ccd0d8,0x7ff6c0ccd0e8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2428
    - - C:\Program Files\Good Time Trio\GTT.exe
        
        "C:\Program Files\Good Time Trio\GTT.exe" --type=gpu-process --field-trial-handle=1684,2972511487074495799,12097495997614737469,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4076_30607" --disable-breakpad --start-stack-profiler --gpu-preferences=KAAAAAAAAACAAwDAAQAAAAAAAAAAAGAAAAAAAAIAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --user-data-dir="C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4076_30607" --start-stack-profiler --service-request-channel-token=16697751474103197941 --mojo-platform-channel-handle=1752 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4528
    - - C:\Program Files\Good Time Trio\GTT.exe
        
        "C:\Program Files\Good Time Trio\GTT.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Program Files\Good Time Trio\gen" --no-zygote --field-trial-handle=1684,2972511487074495799,12097495997614737469,131072 --service-pipe-token=11678646036337151723 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4076_30607" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=11678646036337151723 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2420 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4752
    - - C:\Program Files\Good Time Trio\GTT.exe
        
        "C:\Program Files\Good Time Trio\GTT.exe" --type=utility --field-trial-handle=1684,2972511487074495799,12097495997614737469,131072 --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4076_30607" --service-request-channel-token=4242776944699947570 --mojo-platform-channel-handle=3064 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:5084
    - - C:\Program Files\Good Time Trio\GTT.exe
        
        "C:\Program Files\Good Time Trio\GTT.exe" --type=gpu-process --field-trial-handle=1684,2972511487074495799,12097495997614737469,131072 --disable-gpu-sandbox --use-gl=disabled --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4076_30607" --disable-breakpad --start-stack-profiler --gpu-preferences=KAAAAAAAAACAAwDAAQAAAAAAAAAAAGAAAAAAAAIAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --user-data-dir="C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4076_30607" --start-stack-profiler --service-request-channel-token=5227361967659180057 --mojo-platform-channel-handle=3924 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4228
    - - C:\Program Files\Good Time Trio\GTT.exe
        
        "C:\Program Files\Good Time Trio\GTT.exe" --type=utility --field-trial-handle=1684,2972511487074495799,12097495997614737469,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4076_30607" --service-request-channel-token=6317962564681750355 --mojo-platform-channel-handle=2148 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000494 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GTT.exe

Path C:\Program Files\Good Time Trio\GTT.exe
Size 1.8MB
SHA256 04d603fa003fffc3972b21edf1932aa07d74ef20246ba5fc1ba63ac8838413e0
MD5 3bb787dd429cc7955c0b9afd26c38ac7
SHA1 561173ac4623b12533a5fe03e972c39ff6d6cecb
SHA512 b2c10615296d315053d8f10d5c06904a1aab484e482a41556999c7515a51410fcdaac51725a8e4b977a57b9e5e73f3d68ccb56f89c6657083ab40ed511428016
SSDEEP 24576:5+B4wTJxQTvhjK2wMtusvm7h19Eqi+c8mNanNOj4EVHgACUTZAKOiMI9:ITJxQTbwMssOXEqi4TnCJNCUTy
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Program Files\Good Time Trio\d3dcompiler_47.dll
Size 4.1MB
SHA256 4432bbd1a390874f3f0a503d45cc48d346abc3a8c0213c289f4b615bf0ee84f3
MD5 222d020bd33c90170a8296adc1b7036a
SHA1 612e6f443d927330b9b8ac13cc4a2a6b959cee48
SHA512 ad8c7ce7f6f353da5e2cf816e1a69f1ec14011612e8041e4f9bb6ebed3e0fa4e4ebc069155a0c66e23811467012c201893b9b3b7a947d089ce2c749d5e8910c6
SSDEEP 49152:D5EfJYiVk9w6hAPqzag2At6i5K/8Ub6Lg3MEq/NHiQTtVr+5kb62QgdD6zoodr7P:l7iNPWHYE+Bnm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Program Files\Good Time Trio\ffmpeg.dll
Size 1.3MB
SHA256 c5aaac60a832b992b107596403b89a3185981df4025b4b1b43c9acb1d044d214
MD5 255d0b61f88349ba589690e5133dd374
SHA1 027683b335ae1dd84b20be4684b000727f88fb84
SHA512 ee422e1d2259766f69519c631878ffb03ff087cd7d22892f713fe063a40ff0b008773e263efe4734e533c8fba0031ede1e30e735edb7f67ad8da21cf272c2ad1
SSDEEP 24576:4RNSqxJVrD0i1GsduYtN5ekwNbNO89lStG1jnMtV:4R9D0i8itN5e7tlNZnM
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Program Files\Good Time Trio\icudtl.dat
Size 9.8MB
SHA256 75b9d0e6c2ce9d8f8abd53c7198f614ab77af4912b39cb9a0ff272a7c2093b95
MD5 59e21005a68ed37eb7019091301b2c6c
SHA1 0161c874d50f245238b8683381b3c39ced4873f7
SHA512 40241f90bf4ef435a0449acfdec416c8a86c9db9219a532b27ec7dc265d731809dd1932f97b8695d425b4597d5c9c08149ea8bff8324a4a27077e4ed60cd881e
SSDEEP 196608:77UPty2AZ+MTiliXUxR0jHz93WhlV6pxwPb0W:s12Z+M+liXUxR0jHz93WhlV6pxwPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Program Files\Good Time Trio\libEGL.dll
Size 107KB
SHA256 3b8b07fed4151844b03da084025683d5af46bbc089f13749f3fa25cd2d6fccfb
MD5 ae45849eb409b4c6e1336f919215e830
SHA1 62f2769912980027e51186e3552aeba200608d3c
SHA512 713bc3617aa686aa60e1e77ccd2ff6140b0b02661dd2990abbc43391c7970ee5c3528bcc2c841eca273118ade94ab901e65fd16462ae624b17c0a8f601adc053
SSDEEP 3072:3ZQ+GxcbEtuxoqhgc9A08aOdttKc27YFdLIk/Oe:37wcbUuxXT9A0ewEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Program Files\Good Time Trio\libGLESv2.dll
Size 5.0MB
SHA256 df4f6e2004ef0231a7b70af1236c8cacf2899ca61a50cc36ed964f7b46961c40
MD5 a3e01573229c4582e9f5db79859b1346
SHA1 9677fa06b5ff31f623347c2c237e52668872b70c
SHA512 5012582c96c14de36f8b48cd9d1bf278c49b4bfe5193bcbdc7ae5d7294bce02f47cf68776e94e116c00271d4f8d4872f7b67aae20590d5549844585e8b260635
SSDEEP 49152:0M+6svgR5AauF2l1lbxssX7HGCqmT32ObINvEow5L9WZyTKW1prub9A6/HmUftfs:oO9l1dxo2prjxU9Xw
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Program Files\Good Time Trio\locales\en-US.pak
Size 180KB
SHA256 bc1a09ef4a2d3cd3a8e1cb5f53a3084d4784dd08af9bb77b7db192b50a33dbc2
MD5 04401732451f77ad1987f25c8d1361be
SHA1 270fb5000804cfde8cf84ce6a6e9000e157f7ff0
SHA512 b0e824208681dc6975286df88a33acc4e70a10880ceaefb78cb75e660e8b4f7cad5d31e5ad7d3afbd22f54ef8ee9e0cac0488166ff6ede0bfba51f7ec2b85d41
SSDEEP 3072:c9Z69Txu4KDYCdrZbh6wBHrM89eBCMhjWwSQ/TQr52EphW7N0w5LgglYsn6Bn:WMXdCdHrM89eoMhCV5dw5nK
MD5 SHA1 SHA512 SSDEEP

Submit Download

natives_blob.bin

Path C:\Program Files\Good Time Trio\natives_blob.bin
Size 90KB
SHA256 05620c1db015ddfbbc7dfe39afb14c250f20090a61d9aba8dcd55e6a1a649223
MD5 ee8117cf109aa1e47599b6b6bbffc176
SHA1 5860d98d47084650ace3847b956686df01a32d14
SHA512 49cecab0c2657e5c9811d90bc65bc8b9763bf51b033c27b6db159354911865729e62f47dcde8598c854d2d458296cddb0de76697687925892a94e9e45edd6730
SSDEEP 1536:7Px2XqE+cR+L8gDpKD0rrr/4or06mGsY3csV3+BT5SnofgINTK62M3Twuw5phV5b:79qTBTAnofgWpwE9Xrlu9
MD5 SHA1 SHA512 SSDEEP

Submit Download

node.dll

Path C:\Program Files\Good Time Trio\node.dll
Size 11.1MB
SHA256 954c0c9aedb45a408607b4f2f4921a5bd266066deced6b92855280008ea6cdd0
MD5 da1013c2c19014c262d3205334522d7b
SHA1 7de0246fd20a1c4da55b70d6c5be8510489117f8
SHA512 2698735e059c49723d5a865990099107290d95816c896aa3c930b1a646603913b3f85964012f7310af9df1f31f00ad0d1ab7a78bfc98527b2f8d74fb314a27cb
SSDEEP 196608:4b2RDgJ2oHEowEKvIxtqvJ0kIAaI5n41mN2LNIph:4avIxtqvikF5nbNkNIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nw_100_percent.pak

Path C:\Program Files\Good Time Trio\nw_100_percent.pak
Size 997KB
SHA256 4b722dfbba1c29e0b266cda8b2c11c06b8767d6f5eaa4275aea7b8fc0cc44c90
MD5 e62e8d6498334fbb45307fb1c7e35f34
SHA1 6229403b9aa9639b0e9ad68e9e5fb81bef5707ac
SHA512 94ee92369be264e25b0a79b4759824ce7358fb6ae16d31cfec8ec2b143d3d24c1b777b436f00093722b52547b4ab2709623744e6b28caafcd85cf09dd65483a8
SSDEEP 12288:Ha3PHiUeUZwusXA3BDes/WveB+S0gf1UEstK:6fiUeU+H+BDes/MeBSu1CtK
MD5 SHA1 SHA512 SSDEEP

Submit Download

nw_200_percent.pak

Path C:\Program Files\Good Time Trio\nw_200_percent.pak
Size 1.3MB
SHA256 21b218442314fcc8b2df115098b0f523bd60aab5a29c527049ce1715634679e6
MD5 ace858ac81bc85ab3bef4bd93c41b9de
SHA1 711057ad9d8b44fe4a73c3803f62cc0652b428d7
SHA512 9832d1d49c50d2abd20f506a6cfdbcd1f68e7125813de1ef7984ee8f7dec0b09730873ef10c63aa20e4fdc7944d19533489060e13d8dcd7534626192e992ed3c
SSDEEP 24576:8TA0NHx5gRqTdLsLEyJ+mBDes/mjtX6Hba2K0qoFy7:SlD5gRqtsYqBDes/mjtX6FPy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

nw_elf.dll

Path C:\Program Files\Good Time Trio\nw_elf.dll
Size 559KB
SHA256 c7b53649d69d5b82289eff1ee99acbb45225a37a39dde1a51f43f852ce7074c3
MD5 280840c61dd8d76ff795db37e63e1328
SHA1 9a44944f6dd280418a7b47ea28b377a712ebdd3e
SHA512 6048de620523f35aed3855025efc4e315359fa9a3037647c1eaa7502c059d4c2d0ab86dcc10a68f75a07b0a9bf5e8549aa4c14e01fc0b052eb1910a7aaf2d97f
SSDEEP 12288:d99TLhJummW1REup/l8emSV3c7IDBgoj:DRVmW1bmSVeIDBg
MD5 SHA1 SHA512 SSDEEP

Submit Download

package.nw

Path C:\Program Files\Good Time Trio\package.nw
Size 6.2MB
SHA256 9b59c0c15ca5b9d2027685ff188aa4f96c480ea8d9f9092e38a3ebd2182ee1ad
MD5 fb74331646ef02236a963ada82d603d9
SHA1 8e4678c8d3f7cb1f88dd00b0caaf71d8cc0d5192
SHA512 c2cb2167a77a2086e3c52b8d60349e84eadc4361d5871e3a3c042fd32ac9d7f47df7ca116f0dbe68cd3aea700af7c0d71d706f4d2ed8ddf66bc51c0962f8a489
SSDEEP 196608:2zvKa+i446Z8TnXPrTKnXstLiSHwzidi/LA6+jPu/fs/:H2zG8TnHKGV94LArTu/O
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Program Files\Good Time Trio\resources.pak
Size 13.2MB
SHA256 7d3bbf3358c50ea1e29d9589a14e35e2a30a23d45be9890fe75139a4415a5add
MD5 ef3d57cb0691f523a8b64959bf00c2b2
SHA1 13e586b9f7177d8493ff3dee53a60eda2c8e6a6d
SHA512 fce17bf6618518972b2df4548f243ecbb2b69c28d8c4261cfcdfb42397ca205e55f2f6d59da5d2dfac4a3260bd85f957d683cada6b63e4b4ca29388da691574c
SSDEEP 98304:b672T0usSen90yl0Q1pOEAQcGv6v11heqw2tMlwR:bA2H3en90W0G0PQ5v6vzheqw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Program Files\Good Time Trio\v8_context_snapshot.bin
Size 733KB
SHA256 9d85017ff3efe4b8a1cd1e01674810e9e158bc6773a24afcebb7426ffde1e662
MD5 da8049aab4eb4ad8b35d9a5699d3166a
SHA1 92063f45b4db9be2d733dd7d4f68eedb938e7344
SHA512 4d328ef947d392dd215b257d826669cf43e5c77e310ec11c46c96ad62f16e79c54116604a48dc103b0857ffaa5a52c209f48db7ec21b6598ccd1bf1bcdafbf22
SSDEEP 6144:tm9wOQvVIoGohBjr+kGhyb80hrV/sKgIrLI5xH7dWwz8C:QumJcxGHSR/sKDIXcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e85136a-794c-4631-9951-343260ed3fd5.tmp

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\5e85136a-794c-4631-9951-343260ed3fd5.tmp
Size 1KB
SHA256 fcf61cc4c7d60195993fbb9e0d05fa00a6dd9c0e8cb4fead66e3acc2cce12a10
MD5 7c42de295a973f52614ee0ffe0f666d3
SHA1 c319378aa84ef17492cb84e1ff18e874b8d63e69
SHA512 1ee554ff5a08b8d2ddaef41bd25f54c57225836c3469b9cf102397266578dad609db2bb6e9017960a780d00fa4a45764c5ca1abcb6177d3aaf60e23f6e8eb77a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Crashpad\settings.dat
Size 40B
SHA256 487c1722abb2285952df2af8d8e3c7ab3478ceb220df2d3aa3b0ca46ce79fc9e
MD5 56e3414c4df52fdbf2e4257cd029d9dc
SHA1 d2409c5d8eb6a2f6cd2bee491f6f4fb4d911a9d7
SHA512 dfb17ca93520c88b62636e3bff4096c3369db07cfeba28de10a5794a17c215c0f8b55e1d1833e65ad416f64db4cd549fd6a7bc84eae29ccad470abc6593da7af
MD5 SHA1 SHA512

Submit Download

747ce880-071c-4612-b35e-352129341b36.tmp

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Default\747ce880-071c-4612-b35e-352129341b36.tmp
Size 6KB
SHA256 1769a3b0f19be8ae0b51e818869dfd297b0643f2242856c6d193d3f84dd76b8d
MD5 548c47690b2d3d97f1aacacbd7c97996
SHA1 829b9c75cb75075e0ec0bc22b5d2c8da594f90d5
SHA512 54414b7d4562ac869575763cc210f5daa135067e399726defd973fb7fd0a118672046472aa1c6bb8f43f691c19dcccba73c75861271fa57196949e3ebd1ce0e9
SSDEEP 48:YcL7okkw4QIsbowLim1qroTwWdzHG68RWrfctgaJoBmeSnp2zlXmNMVEw:nLUkkwIsbowumk0wJWwdJor89NUEw
MD5 SHA1 SHA512 SSDEEP

Submit Download

8275d9a9-c2e9-4f3c-a6a6-938c4863bf13.tmp

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Default\8275d9a9-c2e9-4f3c-a6a6-938c4863bf13.tmp
Size 4KB
SHA256 15e026a3208397e2bff8bd6e1e2d8a860342b9866bd52e510881fabfd7081f3b
MD5 cc5f41be086dcbbe7e6674b79ad46bea
SHA1 2b79e022208a9993edbb01be311a06cab98ac3a2
SHA512 9d6caeb4a2c802860190bd20661a0022e5ee4c30f8ad010dc8de1f22418be8a33ac82a5f65a1b2d438151d52e38eb0641066e7218b296d517e448123522bcb21
SSDEEP 96:yViuVeqe9ViaTLCfrIt7m35y9cLt3jyql0Y4AzkTi:Y5tlfrAC35JFj9l09mgi
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Default\Cache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Default\Cache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Default\Cache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe59b898.TMP

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Default\Preferences~RFe59b898.TMP
Size 2KB
SHA256 17d238ff62ea9ab5ea2c6cd3c130fdc5c71afb0d1c4e60372001e2f0f488142e
MD5 8490bb2bf5134ae23b6708c88bf24756
SHA1 638517d456269a3bd9f2b6210be3cef9520363fc
SHA512 bac3eef48e21ef669ba0d6b3586bcfb53e7b6518a8cbcc552bb2edb06871b677358dc3b44ee06e380040b57911ea3b2606672e697eb15a78bebda21b6cd46f8d
MD5 SHA1 SHA512

Submit Download

Secure Preferences~RFe59b898.TMP

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Default\Secure Preferences~RFe59b898.TMP
Size 4KB
SHA256 1ec5293d208f0b962873f9b43bfca3fc6e6c33fc2a58a5636d43cd10fe52f6ae
MD5 77a7fc496fa1ad0e79697e824e04a7b2
SHA1 89a0f20671dc207a38e1876c25b9d1c17947e1f0
SHA512 3e456bc6acfd592aced1e842806534ebb53deb358c217e01970f0d304cbf8a75ddf9096a51dc2fc9cc4b56195820c0cee7db62df333bf89e12faff996d44c3f5
SSDEEP 96:yViCeqP9ViaTLCfrI8mm35y9cLt3jyql0Y4AzkTJA:+mlfrD135JFj9l09mgi
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Local State
Size 1KB
SHA256 18a196ddce11e9de41b58897b7772ff517cc7a2c15b2d67c5dd1b6159af40b70
MD5 cdb7bf9b5c714120f6175dffe2c9a4b3
SHA1 907c32d11cd56036905519220317d6e5a0439383
SHA512 9989fb99be599627ffcfeccc1722918ef4872b9f54553377c5467e5c3041d3574ee36852c0eb062582c895326ff19d9edaee90e94b3a1ac894640ade4d5a1bcb
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\Local State
Size 1KB
SHA256 ef1f1e9bc98263026ab3f874cf2015a7aa25830fa40699f9ae1e6c64c1eda20c
MD5 b4ccc893e249f0dde3d43b1f81e770e2
SHA1 7a7067ec5e9498282b4fb63334ac01fc7bf66d04
SHA512 69731bd620e68ead378e5fb8f2ef498421f93ae8796488c5579a796f4c048d76a05b4a6e51766941fb19d0d093609c6c65ccba05e3faf3e7bdc9e12d23a3ab03
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

cac2db1f-4399-4538-ac78-8154a98b9003.tmp

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\cac2db1f-4399-4538-ac78-8154a98b9003.tmp
Size 1KB
SHA256 5453d54557037a30bf7a735e31bee990a28ea170e427b2f96ed957ee4407b390
MD5 9803b39409561810c54fed10e356c07c
SHA1 3807554cc70b9e1732d1b086a67b729a51827108
SHA512 9bd6546b98f1b4c92a2cae780df2d4d93dabc2a7f2e12cf638652a2ed754779dd9ad7026dc7eb3025ce228dc43f07ea627a6dad226bf3d624484d96cc51cb958
MD5 SHA1 SHA512

Submit Download

e817c847-1f8d-461e-bae1-cddc6c69dfa0.tmp

Path C:\Users\Admin\AppData\Local\GoodTimeTrio-Undertale\User Data\e817c847-1f8d-461e-bae1-cddc6c69dfa0.tmp
Size 1KB
SHA256 d676db587a5800d90d4903c19bbf873e93d77f60991a7162a7cf77a582639335
MD5 9eab44d6793c8c5e5099c8bf1a84dc11
SHA1 82baba45be09e8ce708d708f691bea2bf49b701b
SHA512 8147da8b62d15f2e61385581b832a31e17004175ae0b59dbbf5eb8dfe2b8830b8a6f96c0b6a8b23fea0ff5ec3cc2c1fd932fb1bf98d10bd880250ebdce20bf15
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb
MD5 c0a1774f8079fe496e694f35dfdcf8bc
SHA1 da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3
SHA512 60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0
MD5 e11c77d0fa99af6b1b282a22dcb1cf4a
SHA1 2593a41a6a63143d837700d01aa27b1817d17a4d
SHA512 c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3
MD5 SHA1 SHA512

Submit Download

08ba144f-9589-441c-834c-2841e10dc49a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08ba144f-9589-441c-834c-2841e10dc49a.tmp
Size 7KB
SHA256 0b28c8c19367d01ea943576ee1677b1efece7f1ce2dbe1a0bdbc3b5b22452513
MD5 37cc9c53de7f1417a1341bc0fee86df9
SHA1 db41a966df3891b23d3f4761158fd0344d05867c
SHA512 089fe762dc87734e5f71e7e41009a22cf2b5354c62ac5a9e3bb950751234a7f3d2134fe69a4dacd9ec1c86256bc3e2cc3af02522284e042f9987535474612fc5
SSDEEP 192:nXk36fkLqv0MMwEw30bkYGyviHxc2IgzALe93:nXe6fku0Xw7QgzAC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Size 105KB
SHA256 1dbec4678c58d74c39b84bb950d3b8582395a770ea9560b43e0202d9b501d83c
MD5 87f5ddfa6bc7729f4999f46c3be132f7
SHA1 0447411052734c4d33979d57dc12917a547231af
SHA512 1f4376d95b150f778570182fbdd10210eedf3e6031b7c6cd8fe248cd035a6dc5558956af438bf0134371a908cf212871eb4c218fbb7abd3488aabd8c860df323
SSDEEP 3072:8a7YB22dRQ+hp784Vvk3gCj3YtSd3fzETefgLgDhu:8IYg2dRJnZkwCj3YtSSQU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 27857bd203e2999739d958ec3981055080d5fafdffa45d66352f8bb0e9de299d
MD5 32276bccc7887f2c40d3e05c84287b58
SHA1 cec386a6be411f0ec055c91439ff4bfdf49ec43a
SHA512 a4609c5383e98a8206859d52403e6db654b807e1732b82e02ecf6b399532f37aa4cf2d7474a5d8543b9fe95b8c6627e881d47e3027c373899a97026b9230763b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c19477d71eb6e3a10fbad4b9e5222fae454113460065e1f210178aca6ff11667
MD5 a1929c26d6769ef437284c8864c827a0
SHA1 ef0cefd6ad3fbd96c2523255f31d0ff853017ded
SHA512 54b4f572e8483d6dfd26ec4584b5337d6c46638798f418127deb0aa72f84c22192cf3f6fae2a34658697e19be18c784ae90add6de14708bdafad41f05c25aeae
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 abc513ea9fed3bb9603d147bffea47dc7031069fa5960387b6656f7a2f7b1531
MD5 7d42ecc36783cdc51198bfd5b6f0c3f3
SHA1 73b8f5dec82fa2ca7a5b2c2c8195b93dcfa38ac1
SHA512 9a1e0a54083c7cb1169d485e1871136d6c47e12ca43532e4a82f474f7f50ca192568f47871e82a74e72fef978f9b9fdb46bec28ab272b319551080f76ce91325
SSDEEP 96:J1xu0RfbDIabk+4NuQ6KpSmcqAGikGf8GOGMaGdyGWGLGImJGDe/:J1xu0RfbDIek+4AQ6KpSmcqApkE89ScW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 80ca3771ec051cfc94c76fd6412b9dd3ebfdb4fadb1de7c8d6865d84686080de
MD5 ec39efd21857fa221f0c195e70c847ec
SHA1 202213eb557ce651b89b036fde5dd6dcad13cdef
SHA512 8f375d262135c4dc70f7543ba700693f5e579c9c6469d43b250a5433de87f0718c40ecc461d9d10a313ae28c6630c27b2ca64457d213b46ef8d4222a2ad5d8f5
SSDEEP 96:nXk3nJWfkLqwSv0MoiVmdHISJA0WQyV+VuziX3wI3:nXk38fkLqv0MAI4ALM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 199dd6c23fe3b5ae388162a12d9595efa5ddca9e94451f46794b529509945b33
MD5 f71b3a970765ee26aea47bc104f4f28e
SHA1 7293cd8e0a4a27a1f2fb62afc8f674a8b6c77f97
SHA512 05a99d41b61e4e7cd3743b139d18f2685839f440e2b6f9d135a88139d15f93daac4efc454324e6441905f0d8cb0a9a99fff8670f3b2bc8c5801b8e81c9b5bbdc
SSDEEP 192:nXk36fkLqv0MRu/Y30bGvHxc2IVzALH93:nXe6fku0rYjQVzAL93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 466c6e716c231cc10671ab8cd8de28390bd83ceda9c7499b23e1656974316fc6
MD5 dca7f9eff546cdb78468bcf99441f8ac
SHA1 50cf2b3f27b0d6159e4def6bc860294435f98e38
SHA512 4bf720613471870c4267b0f3864dc9e21ff9084e1ab4238fdedaa60fb9b3a89d1fa415f3c1cd88bdc2f59109abfbe50f64462ac3ddb79143b176fe5d5a170730
SSDEEP 192:nXk3lfkrqv0MqiwEw30bkYGyviHxc2IzzMLe93:nXelfkO00w7QzzMC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 537B
SHA256 d3df6c53dee40f04897ef552c703f3de3c8b39b3bafc33693c0a0fb729b38e73
MD5 e012f9f69006d1e7baa31903ec2ebc2c
SHA1 7412cc455bff0ad79fa8e281cbf686162b906d48
SHA512 1b6daafa74608b302ade1566427baeb6c6545ec3e3e71ee8c537e3450f1f419e0247081158f3af1f5e021e8ab3848e083c0a49fd3705072738a78d9af3dcad8f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582cb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582cb8.TMP
Size 539B
SHA256 cf8c74f2c3bf9c885b17d80fa4aed55aec2025f12cdbc166d292b05cf48dfe2e
MD5 5243f398a383a9387a8a89754aa2338d
SHA1 2e222a20f8e22626ded049f9069c1cf5a1c8886e
SHA512 7f153764c2973a9460d3fab66b76a8bf62742fe78500aa380ffe3279e33cf46b6a9f4fd1e4a5cb3375a9d77380c9162ff818fdcac225238dfa441b7aade42b3c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 98e3fc5c384384bafff6ea5d9e37b2023d5c33ce065071cd097d9836660df096
MD5 ffe86e9e4a6a84306506a0f9c6dc1296
SHA1 bffe1ee626c2896efa3f340a2082c9cd7a6e8ec0
SHA512 15c1df23529a5df5e0416aa508faa2452550c90ff84b012961f184665ddf42f42a2e5042bc07047ff904248dbe3de371045854a8136622f0d53c41f843962953
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3Wf1e2RUiud/R1cUYqjUws6wOw:M9iIxuERzA83h09RZxA3W5vudTcUYqzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a9532be9fab69c916071392f09dc1df9d84f350ba1c7009d817f79c7d1cc6754
MD5 5102d1d936508dda9afa789706ed9c6a
SHA1 44caa694705460223962cbc557b744a0c75d2efd
SHA512 e6bac8d113cbd1f856caafdf09913c4901f6664fb2c1d575808b3487217339c2fe929fdb86d4741d2eb56cd2638763c4cb60fb3eab13ea4cb13db2a87d80e984
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG9f1e2RUiud/RskUYqjUws6w9:M9iIxuERzA83h09RZxASG95vud6kUYqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d0aa8c8c2caaa81e71ed49e19a0bf25650f30ea4cfe077ee30f82d02549bb2b7
MD5 2d5deb2cef412d9effdead6d4a871c66
SHA1 a54f515aab04bdd922e9776db7f1d81929d6450d
SHA512 9c4c77c8274fdbf041940aece1fddfe36bf8fa53b8db901effa7fae7b0092ae09e252f7a5a48bb7c47e4d6259b75a7eda274d044b1bb6d532a296966741c356a
SSDEEP 192:moCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG9fIe2RU93d/RsrUYqjUws6w9:i9iIxuERzA83h09RZxASG9Oe3d6rUYqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup-gtt-64bits.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K677S.tmp\setup-gtt-64bits.tmp
Size 702KB
SHA256 3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
MD5 1afbd25db5c9a90fe05309f7c4fbcf09
SHA1 baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA512 3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
SSDEEP 12288:XqIRz+f+ui8TrPO37fzH4A63RRwDFtuXUZERmhrNh4dT9TaC+IGNbDtQPuFyxyR:aIZg+uiirPO37fzH4A6haDbcUZEbdT9+
MD5 SHA1 SHA512 SSDEEP

Submit Download

icon-128.png

Path C:\Users\Admin\AppData\Local\Temp\nw4076_30607\icon-128.png
Size 2KB
SHA256 0f6894d0a404e4d920b3248250c69b6bb61b2219dfb863871b484cbebafe9587
MD5 1787ce002aa4980dd8dd756ad24c50fb
SHA1 d8219da9916d6892bb5130230e574dae8416d090
SHA512 f4bf8db7c9dbb2ff8ba4ad51482fee11d8f782e67f4e87df2caf309caad9b111e13c68c68597fa43a45644e86367ded851af73c1455a5a8942e11fbeef874861
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nw4076_30607\package.json
Size 617B
SHA256 4d0bd4ee1d44227cde2abcb6ba08269ede289a6c59d55e542567d91b2ca27986
MD5 cba53b649bb9439d11bc466258cf1b18
SHA1 6734330aedc3732e51743fa6d7e90d5d5de1b01d
SHA512 b70a96a85491d12bd9d393cf024015943be55a882fecde762f72ce884eb2392a67a6c8dc236f165e666668450f26c6e4c3196d9482bb7238d791055cbfa7d1e4
MD5 SHA1 SHA512

Submit Download

setup-gtt-64bits.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\setup-gtt-64bits.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/2724-596-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2724-424-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3732-423-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3732-286-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3732-601-0x0000000000400000-0x0000000000415000-memory.dmp

Download