bb68113cfaba1def162b8a0df4b1d41b83ea34ce4fd5b23e0a0b75b259b62bfc

Analysis

user interaction
yes
max time kernel
1800s
max time network
1775s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GLP_installer_900223150_market.exe
Size 3.6MB
Sample261002-rtf1lszhkh
SHA256 bb68113cfaba1def162b8a0df4b1d41b83ea34ce4fd5b23e0a0b75b259b62bfc
MD5 0ac1fd602f5ec2d2231fe311777791e8
SHA1 52ca6ccd121faf4f3aad9e7760ee1a519b323d83
SHA512 10fb445ccf904c20b1b3736d02f53bc43a3b9161465c6915c89a06e978be9e988342f40d4c895acbfdabf236fbdbaa87c8470577626cbc2ba1838dba48e57623
SSDEEP 49152:808OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJXe9emEPGKOPkQThMYRMnm7LBg:808vdsGaQNgS1C6e6ngKpqM
TLSH
T15206BE12BA828472F5930271957EAB7B48BDFA304B3585D7D3E41A5E5D301E23B3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5292	GLP_installer_900223150_market.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	GLP_installer_900223150_market.exe
	\??\F:\	GLP_installer_900223150_market.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GLP_installer_900223150_market.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	GLP_installer_900223150_market.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GLP_installer_900223150_market.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GLP_installer_900223150_market.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLP_installer_900223150_market.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5164	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{2CD9CDF4-4896-4588-82F8-E90040340712}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5292	GLP_installer_900223150_market.exe
5292	GLP_installer_900223150_market.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe
Token: SeShutdownPrivilege	4208	chrome.exe
Token: SeCreatePagefilePrivilege	4208	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1788	4208	chrome.exe	103
PID 4208 wrote to memory of 1368	4208	chrome.exe	104
PID 4208 wrote to memory of 1368	4208	chrome.exe	104
PID 4208 wrote to memory of 5164	4208	chrome.exe	105
PID 4208 wrote to memory of 5308	4208	chrome.exe	106
PID 4208 wrote to memory of 5308	4208	chrome.exe	106
PID 4208 wrote to memory of 4344	4208	chrome.exe	108
PID 4208 wrote to memory of 4336	4208	chrome.exe	109
PID 4208 wrote to memory of 4344	4208	chrome.exe	108
PID 4208 wrote to memory of 4336	4208	chrome.exe	109
PID 4208 wrote to memory of 2176	4208	chrome.exe	110
PID 4208 wrote to memory of 2176	4208	chrome.exe	110
PID 4208 wrote to memory of 5668	4208	chrome.exe	112
PID 4208 wrote to memory of 5668	4208	chrome.exe	112
PID 4208 wrote to memory of 5132	4208	chrome.exe	113
PID 4208 wrote to memory of 2776	4208	chrome.exe	114
PID 4208 wrote to memory of 2776	4208	chrome.exe	114
PID 4208 wrote to memory of 2180	4208	chrome.exe	117
PID 4208 wrote to memory of 2180	4208	chrome.exe	117
PID 4208 wrote to memory of 1160	4208	chrome.exe	119
PID 4208 wrote to memory of 1160	4208	chrome.exe	119
PID 4208 wrote to memory of 5588	4208	chrome.exe	121
PID 4208 wrote to memory of 5588	4208	chrome.exe	121
PID 4208 wrote to memory of 1332	4208	chrome.exe	123
PID 4208 wrote to memory of 1332	4208	chrome.exe	123
PID 4208 wrote to memory of 4984	4208	chrome.exe	125
PID 4208 wrote to memory of 4968	4208	chrome.exe	126
PID 4208 wrote to memory of 4628	4208	chrome.exe	127
PID 4208 wrote to memory of 1180	4208	chrome.exe	128

C:\Users\Admin\AppData\Local\Temp\GLP_installer_900223150_market.exe
"C:\Users\Admin\AppData\Local\Temp\GLP_installer_900223150_market.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffed97ac728,0x7ffed97ac734,0x7ffed97ac740
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,3560825154550239391,3880306606064487646,262144 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,12608235302195569612,9905944469812173867,524288 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,14408504269404784875,11248771724421466782,524288 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,11251220994413927577,16812698310604501875,2097152 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,8141590665326562936,12172709814393862356,2097152 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,18104155075353000843,18022921649407683324,2097152 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,9074825008313597977,17838433452462613089,2097152 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,7259034920882010083,14140696567282242588,524288 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5592,i,14534436787046323472,13182865075764393660,2097152 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3932,i,4516625074854483359,8235216482616434827,524288 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3280,i,16108089234718070796,11383491795750400786,2097152 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6000,i,9373867687671792203,4785246629688345343,2097152 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6196,i,12940117874737529553,11407707546749298763,2097152 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,16742776857229404221,10336162252849608632,524288 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6668,i,8119167963989555493,4401452839942853383,524288 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,1507992421983662771,18072765917129999778,524288 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,7607197301502024525,17819941912126268329,524288 --field-trial-handle=2004,i,8604125625874152040,8259469898133913656,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01b3c784-5e41-4361-838b-f60d5e892048.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\01b3c784-5e41-4361-838b-f60d5e892048.tmp
Size 264KB
SHA256 388c528d5cf1d836a1ee33a7f17e607ad43f42f24ee010c42d74cb3e2ed9e5dc
MD5 0b1b513f06d14e805fabb10a1829c2ca
SHA1 5396716313ff2c41384f5ad8aed262c63a7fab27
SHA512 bc7c7b1f03ce9cb7a7cae40f3882e809be289e42ada1345f4f3caa2eed0675dde97385b41b046f0bde66b0cc7514e5bd7c2f6f68213518fc5144588385d5c070
SSDEEP 6144:ukJdaRmVrMQDUiSJhavF31Fz22ZL+hFD+7t56OD9ZfSApprp:nTa2rMQk4FFFDLyFSXD9ZfS4T
TLSH
T134441232FE969CA38DB83491F527FB505CA1E9ED01D62A0E84440FAED11FC8C0B62927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c06a966-30b7-4ede-b555-5b292f8e3b3c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3c06a966-30b7-4ede-b555-5b292f8e3b3c.tmp
Size 265KB
SHA256 ebb76650f81d1b790264ecc1db70a1da5823bc66483fb5c6bbcd61b56c1d754a
MD5 b681e394b59d311106c00ff066909b61
SHA1 722064c7e4c37fa0a4620c3a748d2e7c78d1f5d0
SHA512 08bf78d38f8a1402a3fb5055b17fe5467e086361e70a00088554c6ca1d4a53ebf3c9ffbf0b0e026ac4f17dc217971f90e3725169ff52fb9fa2a17655e6ec8d00
SSDEEP 6144:/BYJdaRmVrMQDUiSJhavF31Fz22ZL+hFD+7t56OD9ZfSApprp:mTa2rMQk4FFFDLyFSXD9ZfS4T
TLSH
T155441233FD969CA389B92481F526FB505C91E9EE06D67A0EC4441FAED10F89C0B63D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93703da4-ca7c-41fb-bfe4-17a317c80cb8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\93703da4-ca7c-41fb-bfe4-17a317c80cb8.tmp
Size 130KB
SHA256 ae0c882e98a03518e159bcfe394bfe495830de13f6027a4cbe364b19df526500
MD5 fba102c049f5c8db176e552c16a25e58
SHA1 0d36de605339952045609f08789e0675321dbb48
SHA512 0f9f995b671d00250cc5dd820374ad57b5e299c86bdf547ee73dd29b456f984d619792292b3b1d912c215ab6cbea5846b8ca3a75c90bab93b1ae27cfd185c674
SSDEEP 3072:UI+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UI+hFD+7t56OD9ZfSApprB
TLSH
T171D31232AA91D8BBC9BC6141B157A300DD76ACED45DE3A09444A5F8EE09FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d8069b59ba1cdc110cde92cdc89d02bd5f23941139d79e9234b63999b8afe6ef
MD5 6a6334d09d728c10bd68a9cb97982ddf
SHA1 f0d659e2a7c1287d00edaeb72438749e469f1890
SHA512 056656c470f3886a74d716bf81c288160bf3ac69376a27708f4da95384a73316cb4b9d2af34dba26cad840e42650a59aecb6ae282426b99d8431e86b75a96feb
MD5 SHA1 SHA512

Submit Download

0ae55df1-42a9-445a-8efb-d66c97efc5db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0ae55df1-42a9-445a-8efb-d66c97efc5db.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c1c5fbe-5f78-49c9-a452-dd1be21ae663.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8c1c5fbe-5f78-49c9-a452-dd1be21ae663.tmp
Size 649B
SHA256 751f0ee823ec69d7ee43346a7d9d48cd3af86707a5dee83e1fad58f0b3affc96
MD5 97bbaf803fec4dc2f418a54db8eb4aa9
SHA1 c2346ca42a1b7841f88a493c23e4ba6ddb312ff6
SHA512 a40ca843adb694fc3b1be885bfb71a1338a440c25340ba3725552426a6e5687fad42a8a7f500f5c057eb2cb405ce7f103fb10efd686152b4fa0e77eca99e3088
TLSH
T1F8F02DB6CD21FC7718FD1B2D20544B87E74513573640855F3A3D410D8FB9A3B458581C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 9f0c480efe74bb2145201d8f5e3eb4b9842ccd10168305a5ee9add504e47b9e6
MD5 7856120e9a7850887edc074998ef90b7
SHA1 9f21dd10edccd47df5699c8d5ec2d9367ba10e3c
SHA512 291568092732e75c90f7fbe945ffd4cc7db3749eeeb0e6e0ba1a9295ceccd2db054df149f6200024cc3fa080ca079a38f358df0f924d8ec6e44b410b0dfefb70
TLSH
T17051712893C462B8CF84EAF114A50CECAE603B95701A0B4BDB5754B03D93EE8916B3DC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fc6f7aaa0d282295fd1738d65df5a16d40cf2943900d7720c74462db8fc70fa2
MD5 8e8a8419d38998e6991215f964f9b9eb
SHA1 17864dddf1aee1b16a8396f28ffb43f3852be92b
SHA512 c3c767dfeb050f7890136f762ae4b5fcff42b915d118e9c3b1e4a1ab78a84feed3ac35b1014dd8939ed0c744047ca2a3cc20ad5cae505ccd6741be812879da48
TLSH
T16E618339A3C456B8CF55EAF159950CDC9D20379438460B4BDB5B00B43D93EE8516B3CD
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

41c88014-7363-4a0f-869a-4c6ca5e92699.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\41c88014-7363-4a0f-869a-4c6ca5e92699.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

66f5a6b4-e519-44f5-a9df-842d4e29dd80.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\66f5a6b4-e519-44f5-a9df-842d4e29dd80.tmp
Size 2KB
SHA256 8f041aa60d58040da8d08e66aa0f8d1c13e882a5c2ff0188e1f0a29372b9199c
MD5 619d2645181569f460a792c194f0bff2
SHA1 6f0089313641edab135548d809926c7a637a7eaf
SHA512 e18cedcdf8cacc04c7c748bf38fe7b7fd35b30f392a7964920eaa37568fce0008bdf3fc417e0584189f01e7a7640dfdd222775349078a51c66209ec2490526e2
TLSH
T17651CE9BE77EB42B103949B71D40BC0A25FAA836199178F8DAD7C16CB0C6DF31B56027
MD5 SHA1 SHA512 TLSH

Submit Download

9a8a1e05-0937-473f-9c29-0c57caa70db0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9a8a1e05-0937-473f-9c29-0c57caa70db0.tmp
Size 11KB
SHA256 ab0bf07561be26813dbefd2cbcab729477efb83b5daf4d6796c11a855b022e7f
MD5 3cf3c253f78e8c710501d6c87c244ce2
SHA1 96488f6900f6063f8fbdbcbe237d6be63e909f82
SHA512 58723417d929c09ca0868e67a08f27a935a1897daa2ffef08ac2095856b07225be6d7a3ad1d9c9bb4417dad46e33b1655b8afd04400b320871029b83ccd43224
SSDEEP 192:Da2m7pZq2R+UIkqevCNDpr9PsN0v+AIiIjIpNPaaPrfPdvqPNGMu9XfOrH80jdEA:Da2m7pZq2UpkqevCNDpr9PsN0v+AIiIR
TLSH
T1A732BBF7C3E9C62D89115AF49B15AE1FCE590A28031C3C66C8E5BF6B93E2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff5a6329-22d5-48bc-940c-80b4e2b7337c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ff5a6329-22d5-48bc-940c-80b4e2b7337c.tmp
Size 10KB
SHA256 608532570c7236e847be2bcf902b956fa92f2bc9c9f01fce7165a5fe0d957ced
MD5 f8639d5e13da648dfe60ce54de4a99a5
SHA1 f4f94f49729f524c148e8989f41c96d123219861
SHA512 cb672d457da96a60dca786cc312f2f7163ab5e8cc481443acf87807ffe2d22c337dd24fc8d886c5784599c489b337b7212d59e6a343079b69a8c2c358b1a7f65
SSDEEP 192:Da2m7pZq2R+UIkqWCNDpr9PsN0v+AIiIjIpNPaaPrfPdvqPNGMsHxu9XfOr2QT8Q:Da2m7pZq2UpkqWCNDpr9PsN0v+AIiIjY
TLSH
T1B532AAF7C3E9C62D89115AF49B15AE1FCE590A28031C3C26C8E5BF6B93E2471E24175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 a339e6ca0e4936603a36f5a6a1ad1d9cf2f79c11b9b2971efe4fbf75282d5dd5
MD5 bce7765b291bb0f4ac91a3110d03fdf8
SHA1 01b40dc7f648104ac03612f4f6a13a1622c19123
SHA512 45e34e002322cfeb5db954242223740392ca315fb79f6c24411e3a91b9227d9f4b454683685c83842f7f8d838de10995a81415bd6075e6e2cb31048b0ec94424
TLSH
T162B0120680413701C442137211A190A4BB608F38E112138542E01D129831261411B148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 166b4a325cbab0913bc675f84bdda0181dd194bc0b6531923bc1e32b409f6365
MD5 18a425739ce53a94f93b1e065141bc62
SHA1 799338846b90496999fa8142d957db3e99e11d63
SHA512 4262e55114ea0550f5c7b8db66becb34095b87d7002b9d72b1990cd52adf02432b93b37becef98c2baf0f10f06765c9fb8058c392b3741ee1b2f610ab8bfb7a9
TLSH
T130B00256C5536312C04227B039D6A5D87665DF25C603129296E01AB7EC25F71C9362A1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 4ae66aafec2bb91357367582b8fe3f944a84e571f02c7f616bbd15ca6e2e4af0
MD5 7f0a6a3ecdc55d15e8e0d9c82c9ec103
SHA1 da5991d281de8155231d1e4eb4f5abc0df0821ff
SHA512 9ab5d195352ff9486a3d6ce8a14b36313cd106b00666e2b77ed30cbb6bd1e6fbb51d131de34a01c51fc7347c427be1f442f3af14ac0823e71ea31053aac0554a
TLSH
T1CAB02280028A0C03E80023F0E3E3F8803F3AEE0883C3B00200E808CBB8803A2C2822A0
MD5 SHA1 SHA512 TLSH

Submit Download

a62f2085-90ee-409c-9e17-2b545f14f79d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a62f2085-90ee-409c-9e17-2b545f14f79d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d2b0f112-f34b-456c-af4f-5652116f626f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d2b0f112-f34b-456c-af4f-5652116f626f.tmp
Size 14KB
SHA256 2585be1d30f94fc795a6c213aef054f686f566384ce1e752a2cf6b630c3dd4e0
MD5 1e82757b376ff557dbc3f7b010849caf
SHA1 2d81951242a77e0e32aa79de1065c256532963fc
SHA512 2e9a46bff82eaaac2393fffbd79df43dc750a3cfe877601c8f86b2f079d0a539283f5560177daeedca7e6b6e4a2a75b55fc8992646e47e204228be5677153781
SSDEEP 192:3Rc1cBz0o4qXY1oZ6v7epbPRppDDG096Hsb+WNksQ6pmK4GtDhO8hx2C2kwL0aSK:3Rc1mz0pqlWShX1swT3o8L25rme
TLSH
T18562D62ABD10397B9CDBD22AF9517756D3F5202620902E48FAFC8D3C14EBACC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6dc68e5-7870-4782-99af-7cba9aadfff1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d6dc68e5-7870-4782-99af-7cba9aadfff1.tmp
Size 14KB
SHA256 db067dd486d332b01d1dea0d7dfbaf829b060995f63e064011833ab1a25a84d7
MD5 0c9e98a8168afa21b9d9a2dad40def09
SHA1 b92e53d16930ea0174b75b582d5d9146cd0c6282
SHA512 0acc8ac6479f91b4cd5c345452ac86f367e64d03152f5996c93093f83d9889ddd31b8247f7de02f1cf281a7880d4bd6a7188853aa57ea63a62fdbfca293cbcde
SSDEEP 192:3Rc1cBz0o4qXY1oZEv7epbPRppDDG096Hsb+WNkV6pmK4GtDqponx2C2kwL0V8yr:3Rc1mz0pqlgShX1swL3wox25r3e
TLSH
T16952C62ABD10397B9CDBD22AF9517B56D3F5102924902E48F6FC8D3C14EBACC6217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da89fc71-848f-4c4c-99d3-e7895ad5b8da.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\da89fc71-848f-4c4c-99d3-e7895ad5b8da.tmp
Size 12KB
SHA256 70f78e5d15d285685d71a4c74c03737f4d9f8ceede98a7acb143d80f3b76d598
MD5 4f19a426cee40a65f141507b618dcf12
SHA1 19be1ba6770fe6f2f979bac6224a15bcb4012e1f
SHA512 50b098e08a116f8a7e19bd5dfbf4773b4781e9af4acce0c4109bc9678a2d64848a85fe6e1ab1386c2d5750fe36800d069962788b0dc1cfc41d74b2618b52f404
SSDEEP 192:3RcWcBz0o4qXY1oZEv7GpAPRp2DD796Hsb+WNn6pmK4Gt2Gx2C2kwL01VyIsnAU/:3RcWmz0pqlgCUXyswg32C25r68
TLSH
T13142B32EBD10797B5CCBD22AF9617757D3F5002924942E88EAF8893C14EB6CC621B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 4d1cd63a16ece6df7efb9b935a34d2e487da59964b01a4576aa495bbd3a9e899
MD5 50d4424f8ed251660ba21037b96e581d
SHA1 d9baf82300d63fbcd4edbfde9481a33d429d2b22
SHA512 2e381a180dca661a0c0b3f62b94b670703b76d65663f5b07b710c4b573e404687dd6172d34da4102a41344c798a64d4c548fdb4e282fa3793b502a5d0239cc21
SSDEEP 3:MsEllllkEthXllkl2zE/lgOu:/M/xT02zxX
TLSH
T1024404047FC00547C5011131C051D3503370DC1007135743345144337CC57431C04440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a32267cb-fecd-4e5c-b573-803415900212.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a32267cb-fecd-4e5c-b573-803415900212.tmp
Size 265KB
SHA256 59239d1fbeb5a3b1abab158a28747cdccdb1e6951b3aa80decdc5fa7fa2bd882
MD5 ffc1df7cca5ba0e70d05d6e40cb5c18e
SHA1 81e83f5bc3bc62a85d145dbed7294ad6d29596cf
SHA512 7c5ffb4ba1b4f35b15a6873ff32afb7aacf499712d1e7b0cdb185ffedc8bce2a5069c9d6b83d2db97950cbda4d3924fe38f9f330cfddf44aea26a053516bf088
SSDEEP 6144:/KAJdaRmVrMQDUiSJhavF31Fz22ZL+hFD+7t56OD9ZfSApprp:dTa2rMQk4FFFDLyFSXD9ZfS4T
TLSH
T118441233FD968CA389B92481F526FB505C91F9EE06D67A0EC4441FAED11F89C0B63D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d11f3965-0d6f-4bdc-9d97-be43a6514960.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d11f3965-0d6f-4bdc-9d97-be43a6514960.tmp
Size 264KB
SHA256 49ad80b4e320949cec25cf49095478a0cce958e555fa2bf380e1b1aad47cc6ad
MD5 a075dad81b193998b5de7a8e4b3e51b4
SHA1 2397148baa99c418b7207a23a19d1853c5a8102e
SHA512 8cd77a6ba0ca1c5fe95d6128938ead84434379af9a00152a235c2a7bb4846fa7b719c0926bd3b76209a4cdca55e9e3dab6a3b440aac463f4aaca144ddc660a04
SSDEEP 6144:/kJdaRmVrMQDUiSJhavF31Fz22ZL+hFD+7t56OD9ZfSApprp:cTa2rMQk4FFFDLyFSXD9ZfS4T
TLSH
T19E441232FE969CA38DBD3491F527FB505CA1E9ED01D62A0E84440FAED11FC8C0B62927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.dll

Path C:\Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll
Size 74KB
SHA256 5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
MD5 2814acbd607ba47bdbcdf6ac3076ee95
SHA1 50ab892071bed2bb2365ca1d4bf5594e71c6b13b
SHA512 34c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498
SSDEEP 768:2fqePMS8NxKDSYkK7U0H8zAqaMRmnJD+7OX4ubjJJYIn8n28zaTQ8PfcQWZcRZip:sPMS8NxpYZCrFiZbmnzIQ+cQtfiqDVQ
TLSH
T15A737C472A1540F2E2C66231B6A5BB3196F5ED610F5A1683C3EF82DC2FB6787E211207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download