a459b109d5709f237b420ff0f33413e108e766dcee0f8fa8c1fa66ce2f35d7e7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nocturno-launcher.exe
Size 29.3MB
Sample260423-chpfaags4t
SHA256 a459b109d5709f237b420ff0f33413e108e766dcee0f8fa8c1fa66ce2f35d7e7
MD5 1a3199397ec355a9733fa1b8fde0006b
SHA1 c9519f4a64e5f8555c4f6f28cc268366fb194187
SHA512 d1315eb511f78cee53b90b6660303ae31c3e20ce98653ff266380c3889730aebd43f454dde37beab38eba837daac168c0978a09fc2894c0e119c75b4423de5e5
SSDEEP 786432:J6tCzp3caJbt//vcTo+wRNMnPfz33D1K1xFu:ktQsebBcTEToY5u
TLSH
T125670243F2A255E8D0AEC1B4835B9733E772B89D0920B2AB1BD45A313F5AF506F1C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nocturno-launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1244700385\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1244700385\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1244700385\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1696078692\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1696078692\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1696078692\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1692300529\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1692300529\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213835180409545"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3960	msedgewebview2.exe
3960	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3732	msedgewebview2.exe
3732	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4100	nocturno-launcher.exe
4100	nocturno-launcher.exe
4100	nocturno-launcher.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4100	nocturno-launcher.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3732	4100	nocturno-launcher.exe	83
PID 3732 wrote to memory of 4568	3732	msedgewebview2.exe	84
PID 3732 wrote to memory of 4008	3732	msedgewebview2.exe	85
PID 3732 wrote to memory of 4008	3732	msedgewebview2.exe	85
PID 3732 wrote to memory of 4008	3732	msedgewebview2.exe	85
PID 3732 wrote to memory of 4048	3732	msedgewebview2.exe	86
PID 3732 wrote to memory of 3084	3732	msedgewebview2.exe	87
PID 3732 wrote to memory of 3084	3732	msedgewebview2.exe	87
PID 3732 wrote to memory of 1208	3732	msedgewebview2.exe	88
PID 3732 wrote to memory of 1208	3732	msedgewebview2.exe	88
PID 3732 wrote to memory of 1208	3732	msedgewebview2.exe	88
PID 3732 wrote to memory of 3756	3732	msedgewebview2.exe	89
PID 3732 wrote to memory of 3756	3732	msedgewebview2.exe	89
PID 3732 wrote to memory of 3756	3732	msedgewebview2.exe	89
PID 3732 wrote to memory of 1316	3732	msedgewebview2.exe	103
PID 3732 wrote to memory of 1316	3732	msedgewebview2.exe	103
PID 3732 wrote to memory of 4756	3732	msedgewebview2.exe	104
PID 3732 wrote to memory of 4756	3732	msedgewebview2.exe	104
PID 3732 wrote to memory of 3960	3732	msedgewebview2.exe	105
PID 3732 wrote to memory of 3424	3732	msedgewebview2.exe	106
PID 3732 wrote to memory of 3424	3732	msedgewebview2.exe	106

C:\Users\Admin\AppData\Local\Temp\nocturno-launcher.exe
"C:\Users\Admin\AppData\Local\Temp\nocturno-launcher.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=OverlayScrollbar --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=4100.2332.11369305784234246984
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff9608eb078,0x7ff9608eb084,0x7ff9608eb090
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2380,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3580,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3824,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2248,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=752,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4920,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView" --webview-exe-name=nocturno-launcher.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4852,i,9305943692234045504,4868741480938198581,262144 --enable-features=OverlayScrollbar --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
    3⤵
    PID:3424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1244700385\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1692300529\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1692300529\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3732_1696078692\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 569f26ce5e22547a545602d924edb8b7c9a736634858daceb2d602a044feecb3
MD5 73cdcfe163cffcba9e36a9bdeb62b8b4
SHA1 dd4a4f024e1d447368b79e7e994b97b84c3fb5bb
SHA512 3859852dbca1b51d044d1c2b90c6a0bca53121a45da3ff40c6857f340f11d20061316cfabe11de5c658804f062da90947056653172a6ddcfa5b7ceecf7a0071e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 599e29a03f39869b6f1e5b6b7a442b9c9ae55bdab8d84a3bcb1bbba1037ee66b
MD5 c537091d437ba147a45aefb2480d61b3
SHA1 8279d7b39c27a931681daf8658b7783d8bb17611
SHA512 ec8dd5f60e17e535b82a20daaee9078effa58c4cac1f20bb4abe600b7246837efbcebf53ab73e427551e8269465d1f91968fb45b6f0777c851aa73d329dc5784
TLSH
T1D3D0121233021535C01131B31013A30C2D40C50F80158084A42C962D3A444501D02851
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b54f6e112315b5b8b8678acb66ff2c2834cabc6a0b00d63fe9e8c1b7d6846a91
MD5 761691a890ca369ad28b895cd4f6a39c
SHA1 bc82cfe0a8e74ca71ffc53dbcc4d2ebf6060f4d3
SHA512 786ed71a991f1a893788f9c512b863c11e1857323e3757914c69595d0be1707dfd7af89b498b31d4b75d89af4f493f9a4a4a1c52526930e7bf76194ad162d6fc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 4dfbd86f2a185f24389dc97bf8fabfa2ee6f752aadfbc0060ac97d3617eb5ed8
MD5 64b7b9ade5018f17799414acd2b2e7ca
SHA1 239d613a3a0b6ec85fa7541c1747f9103ce1a4b3
SHA512 41e1a6d973effbaac9dd3ed2de04c02108edfc29418b6905594aed0778eaba48915a7918d8a26caaa64c350e701ae1afd6fe25800493911fd7f71894975a0f31
TLSH
T104E08C340478C807FF2600708CD0C415307E48375B1B4E0637E7217C9CB5750D440024
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 dc9e3aa8e0bf15f85515059b3f54f6d44395d8da8d42170139f49b33d3ba4c63
MD5 8dc5680355746f9168620c42865c747a
SHA1 cacfcd77806dc23ce08e01c159e6834606c9155d
SHA512 80a49ac0d666f1e6c330ff450ec14ef304679bf961b4dbb364ce1d649cdff4912169931c0bb0943001c6b588f3a88453454178f53c719e5e9e3bdb065d1650df
SSDEEP 3:LstlNllkll/lpMKl:LsX3lEtp
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 f6448df6b7582c670f9e90534514a9fa6904b6d3e8220e77fc1eeacc058c8e66
MD5 8647d041014ed9ec9c687b2299c2a5fc
SHA1 df657a67663d96e433409d8bd5eb34fc00d00d37
SHA512 b41c073b03b269992b48e0d9ac802fc1fa61891f082e493404e324868642f104def1825221f394b6612e04d414b581bfb638a5a2896bc9937364d01d3e2d355f
TLSH
T12A21AFA2C2E4C77D8A5127F06A343817CD3E091992282E1BCDDBEBE667D2471D12150F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596caa.TMP

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Network\Network Persistent State~RFe596caa.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 326b3354a2fcd893b0ae827eb3d28b8e35e77bcfe0d0c9b3a76361c308971f0b
MD5 7315123ef6dc998ec905b3661922b3f3
SHA1 2ee57c3734b009bbf830b7530f769507071a8a64
SHA512 6b5468be345230093dbfb847e28c2143e060a613d25733580f80ff196eebe958aaed87243327a8b1537a03119897320e3437d271877349c3fc3466e26f0d4cc3
SSDEEP 192:std0OcfdZ8paSB/S+WiTpHQE8gXo5S3SMC:stGOcw7/VpQMtC
TLSH
T15AE1B7075E685AB74CC7E319B935FB66E2F6102225C41E88EBFCC60C08E66DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f354.TMP

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Preferences~RFe58f354.TMP
Size 6KB
SHA256 01e456b9430684995abd7033abe75e6d75a8ddb5464a14ee356685c2ca94c9f3
MD5 11a2a0a2cd99d04c4df04c246f298b0d
SHA1 3db9eef6960a670bbfe5b283c29b0824418dfef3
SHA512 795e6b43decc8da84891959e3196e0ee8965318fcb194cc585a7236b8f8f62d7fbfa724b1a0f78b1dd524fba1e9d85163ac4c77228721e21930eab495412030d
SSDEEP 192:std0OmfdZ8paSB/S+WiTpHQE8gXo5SwSM8:stGOmw7/VpQMC8
TLSH
T1A8E1B8075E6859B74CC7E31DB935FB56E2F6106225D41E88EFFC861C08E66DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Local State
Size 1KB
SHA256 7200d74371de8f503e43aec40db0634980d6a5c44f8194319d6dd84742759d23
MD5 5a7906c38863215b0002c062de95efcf
SHA1 b33ac6b1ef7ac410248ab4a90be77bc6fcfbbd39
SHA512 26d0b277daaa548f3cbd5bffbabbcca3620031bb30dd7a3bfa9ce65992c4a7c680859bd170f333a815e357b206532c02200f4136ef00e37242527314a80f5354
TLSH
T169318273E4905FB36981A282B186FBD35D310066D1507E88A2CF4B1D02F739D663AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Local State
Size 2KB
SHA256 ffd929999fd02075402bf00f22c157e567f6d10728947db98d3f922ab5cf9e5c
MD5 1d5d53015b0ded1e49deca34713acf0d
SHA1 f6f5ca140ee19f003a386c23e0db9eb813fac235
SHA512 5e555ee7e155571e3a966eea422491871b5ace0f56a71488867ab309db87d52aa0dea646219e9643e133f47c6410fb2a193d82820e8a9a27ce865ffff2111f02
TLSH
T1BC51C873B8049BB759E39641F84A7F639A764161D6A13F949ADE0B0C01FB35C2312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Local State
Size 3KB
SHA256 0177c9b78997387f703ba11893941d877b626af51920d35a7da9e094aedba80d
MD5 7fb775f88a5f437eaea2b7a5696f1365
SHA1 5998032f0813f89ce5d01d0ca0e2219dddfb6e2d
SHA512 b96f297ba140d06221e0a38e81c41e622282c3463e7f91f4f0b51383997a3d331bba90dca87364a0f3dc5f63fb84e0525b867eb7b054a9d470b0e4a569eb3713
TLSH
T1D8718537A864D9674DE29A41B8856B53B6B64133D5D13F98CAED0F0D01EB39C1352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Local State
Size 16KB
SHA256 bfc3f1ce3b799fb04486186c7bf7b4a651a12c008b8078b86838aaabf72d321b
MD5 80fa5eb0294e64f1f1fe7dc83c9545a3
SHA1 678a5001082f24040050001caf4ff69ef8594e72
SHA512 dcbb605a8b56c06ad373880201aadcfd6c557c7ff9859cd0533175489a4f894f8ab332d34e9271f0b89bc8253fde6ae4b25cf9dceec3d72f568224888407c733
SSDEEP 384:zJfRE5BdEZfr0kuh9Rt/nP9yVNbTMqg1pDkQF:RRkurqhNsrhKpIQF
TLSH
T13D72AF73863099776CE69106790A6B03A6F5C05AA1913EA8ACDE1F0D0AD7BD91363D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585407.TMP

Path C:\Users\Admin\AppData\Local\cc.nocturno.launcher\EBWebView\Local State~RFe585407.TMP
Size 1KB
SHA256 c9bccf9a03c37a1cf5cf2074aebcf91ebb0174e22c3b41e5d92630ecc6ff728f
MD5 daa115a25328ad37643cb838324c5e41
SHA1 265d99e67084488cdd93392317e3e778f2d0f266
SHA512 ef83abc53333ef34e2e01e53685301aad54f12dffdea5dd85463efadb197d70fa5727a07d0b206db5c441cf0511218b214534e80f396a22125eaf7f1adc7b665
TLSH
T1E6214D73D4949EB36A419192F196FBC72D604066D250AE4CE2CF070D02EB6AD5736C32
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\.nocturno\config.json
Size 166B
SHA256 14cd165c269bf55db26f44fe7609c229ad84edf0155c061c3e3a175166cbfb71
MD5 5502de20a8a7258a0787d22a3ca0d128
SHA1 481ea47a4e66b5da1b1d60bb0f794b0811ebc7d2
SHA512 00c688bf33c836e0d28b272926ba0e6d665ceb18d022eeeb9c495328d71fbdd76b16b2b8ddc0e294cc35ecb469352f8a4c46bbf430e4146a52f640693df01977
TLSH
T1D8C08C02D0200CF93180362A8E2542D9A714804B1F023C2C369C140C0F5E41C08B37B6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1208-128-0x00007FF97ACC0000-0x00007FF97ACC1000-memory.dmp

Download

memory/3084-47-0x00007FF97B410000-0x00007FF97B411000-memory.dmp

Download

memory/3084-48-0x00007FF97BD90000-0x00007FF97BD91000-memory.dmp

Download

memory/3732-262-0x00000220E04A0000-0x00000220E04CC000-memory.dmp

Download

memory/3732-261-0x00000220DE400000-0x00000220DE4A9000-memory.dmp

Download

memory/3732-264-0x00000220EA8F0000-0x00000220EA917000-memory.dmp

Download

memory/3732-265-0x00000220EA920000-0x00000220EA95B000-memory.dmp

Download

memory/3732-263-0x00000220E04E0000-0x00000220E04EC000-memory.dmp

Download

memory/3960-467-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-474-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-466-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-468-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-473-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-472-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-475-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-478-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-477-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/3960-476-0x000001DE8B470000-0x000001DE8B471000-memory.dmp

Download

memory/4008-25-0x00007FF97ACC0000-0x00007FF97ACC1000-memory.dmp

Download

memory/4008-282-0x0000012831F40000-0x0000012831F70000-memory.dmp

Download

memory/4048-283-0x000001EFB6690000-0x000001EFB6739000-memory.dmp

Download

memory/4100-260-0x0000015D6C100000-0x0000015D6C1A9000-memory.dmp

Download