salatstealer | c595218aeb6359a1efd4e5c57124d60b0f3c6da777c641fa60386641f9f2d2bf

Analysis

user interaction
yes
max time kernel
300s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-it
resource tags

arch:x64arch:x86image:win10v2004-20260513-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
22/07/2026, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
r6ragecheat.exe
Size 3.4MB
Sample260722-nfdfsaeb48
SHA256 c595218aeb6359a1efd4e5c57124d60b0f3c6da777c641fa60386641f9f2d2bf
MD5 7c522e9436bab58b7c102b1b1f37f89a
SHA1 6c700bb2e7012e10c6edcecce1d126e0fc7aa3f2
SHA512 5870b1692ae64c316e0b0c3d4f49fc5a503b08260ce663022d71eb5e74be769093ff4363914d81aa42dd2382939960a508d5ad223e8d8c6524fcdf168165f82a
SSDEEP 98304:CJmDtaMmVCSIcyhmZKCsBOQg7qMUNTBhKqWU4Y:CGaMjFhoKCsG2NTB8qIY
TLSH
T15FF533DE824E62E1D0D30D3A21BB31442DDABA49AF93AAC4D52C65D68857FD20377FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 29 IoCs

resource	yara_rule
behavioral1/memory/908-36-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-62-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-319-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-392-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-511-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/5004-514-0x0000000000DE0000-0x0000000001A35000-memory.dmp	family_salatstealer
behavioral1/memory/908-524-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/4512-527-0x0000000000DE0000-0x0000000001A35000-memory.dmp	family_salatstealer
behavioral1/memory/908-554-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/2244-558-0x0000000000DE0000-0x0000000001A35000-memory.dmp	family_salatstealer
behavioral1/memory/908-565-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-568-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-569-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-570-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-574-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-575-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-577-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-578-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-579-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-580-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-581-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-591-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-593-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-610-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-611-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-612-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-613-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-614-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer
behavioral1/memory/908-615-0x00000000007D0000-0x0000000001425000-memory.dmp	family_salatstealer

Downloads MZ/PE file 1 IoCs

flow	pid	Process
97	2004	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
5004	r6ragecheat.exe
4512	r6ragecheat.exe
2244	r6ragecheat.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
88	api.gofile.io
91	api.gofile.io

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/908-0-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-36-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-62-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-319-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-392-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/files/0x0005000000021745-467.dat	upx
behavioral1/memory/908-511-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/5004-513-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral1/memory/5004-514-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral1/memory/908-524-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/4512-527-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral1/memory/908-554-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/2244-556-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral1/memory/2244-558-0x0000000000DE0000-0x0000000001A35000-memory.dmp	upx
behavioral1/memory/908-565-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-568-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-569-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-570-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-574-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-575-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-577-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-578-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-579-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-580-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-581-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-591-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-593-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-610-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-611-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-612-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-613-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-614-0x00000000007D0000-0x0000000001425000-memory.dmp	upx
behavioral1/memory/908-615-0x00000000007D0000-0x0000000001425000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r6ragecheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r6ragecheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r6ragecheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r6ragecheat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2004	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291928431219506"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	r6ragecheat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	r6ragecheat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	r6ragecheat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	r6ragecheat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	r6ragecheat.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
908	r6ragecheat.exe
908	r6ragecheat.exe
2444	chrome.exe
2444	chrome.exe
4032	chrome.exe
4032	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3572	2444	chrome.exe	86
PID 2444 wrote to memory of 4188	2444	chrome.exe	87
PID 2444 wrote to memory of 2004	2444	chrome.exe	88
PID 2444 wrote to memory of 4188	2444	chrome.exe	87
PID 2444 wrote to memory of 760	2444	chrome.exe	90
PID 2444 wrote to memory of 760	2444	chrome.exe	90
PID 2444 wrote to memory of 2388	2444	chrome.exe	92
PID 2444 wrote to memory of 2388	2444	chrome.exe	92
PID 2444 wrote to memory of 3888	2444	chrome.exe	91
PID 2444 wrote to memory of 3888	2444	chrome.exe	91
PID 2444 wrote to memory of 4548	2444	chrome.exe	94
PID 2444 wrote to memory of 4548	2444	chrome.exe	94
PID 2444 wrote to memory of 4248	2444	chrome.exe	95
PID 2444 wrote to memory of 4248	2444	chrome.exe	95
PID 2444 wrote to memory of 5076	2444	chrome.exe	96
PID 2444 wrote to memory of 4700	2444	chrome.exe	102
PID 2444 wrote to memory of 4700	2444	chrome.exe	102
PID 2444 wrote to memory of 1780	2444	chrome.exe	103
PID 2444 wrote to memory of 1780	2444	chrome.exe	103
PID 2444 wrote to memory of 1808	2444	chrome.exe	105
PID 2444 wrote to memory of 1808	2444	chrome.exe	105
PID 2444 wrote to memory of 3700	2444	chrome.exe	107
PID 2444 wrote to memory of 3700	2444	chrome.exe	107
PID 2444 wrote to memory of 968	2444	chrome.exe	108
PID 2444 wrote to memory of 968	2444	chrome.exe	108
PID 2444 wrote to memory of 3200	2444	chrome.exe	112
PID 2444 wrote to memory of 1692	2444	chrome.exe	113
PID 2444 wrote to memory of 4068	2444	chrome.exe	114
PID 2444 wrote to memory of 3200	2444	chrome.exe	119
PID 2444 wrote to memory of 3200	2444	chrome.exe	119
PID 2444 wrote to memory of 3860	2444	chrome.exe	120
PID 2444 wrote to memory of 3860	2444	chrome.exe	120
PID 2444 wrote to memory of 2708	2444	chrome.exe	121
PID 2444 wrote to memory of 2708	2444	chrome.exe	121
PID 2444 wrote to memory of 5036	2444	chrome.exe	122
PID 2444 wrote to memory of 5004	2444	chrome.exe	123
PID 2444 wrote to memory of 4032	2444	chrome.exe	129
PID 2444 wrote to memory of 3224	2444	chrome.exe	130
PID 2444 wrote to memory of 3224	2444	chrome.exe	130

C:\Users\Admin\AppData\Local\Temp\r6ragecheat.exe
"C:\Users\Admin\AppData\Local\Temp\r6ragecheat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdd02cc728,0x7ffdd02cc734,0x7ffdd02cc740
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,15790814053913339394,18346861794669155194,262144 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,16020100078820052524,8082417107480068439,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,5616831008086425388,9782222926319000352,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,12084987300053476543,5859121458537256205,2097152 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,9423799134771600525,18329146988034745394,2097152 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4600,i,9922408266353051310,9500134852240293231,2097152 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,9896039584635537221,14849414672533669016,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,13538385918131485384,6268979836360605706,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,6613093705522184481,5737409254143849353,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,11880529091783623866,15417455007771496459,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,7989579265795704660,9910358108810909531,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5936,i,15505366092298284063,15516789937061469131,2097152 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5924,i,13226615445874973822,17667572532238300123,2097152 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:2
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,7827492334051594446,3681978777695056923,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,14194767411742848226,8538369887690382444,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,4937658697245928758,3109008699958171227,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6004,i,251037441468039427,17940030133822658656,2097152 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5768,i,269780898652035328,13903911955548173987,2097152 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3396,i,14699705450553165739,5654363574148385572,2097152 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,4538241839866373606,15696660360844061469,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:5036
- C:\Users\Admin\Downloads\r6ragecheat.exe
  "C:\Users\Admin\Downloads\r6ragecheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5768,i,2291279483497662372,11109379499088509671,262144 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=it --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,8157214024109042720,12137239711979654968,524288 --field-trial-handle=1992,i,516863264163198685,14778096776934495494,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:3224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4324

C:\Users\Admin\Downloads\r6ragecheat.exe
"C:\Users\Admin\Downloads\r6ragecheat.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512

C:\Users\Admin\Downloads\r6ragecheat.exe
"C:\Users\Admin\Downloads\r6ragecheat.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a07c91d4d0adf78bf213c72938ee4748911b4689c202a4a91980e6bd25096fb
MD5 9703529b35b230e0012e71f7a37e2399
SHA1 366b30dd617348c3d69f19d6e1c175b7e2a16978
SHA512 fb8c75fc2e5a21e3380cd735c4b3f4c805ba9c4b99bc48ece516592b53f88ec5b37852012178ad67b98d708bd02cbbe31f22e7f0296ef322f0238d0d25b385a3
TLSH
T165E02BBAC961DC7B29FE071860614746E614135B2B81498FB63C860CCFF4B3A5745C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 2206ff5c02f93add04fc807f91de4b9d37311adff39d3e6ff2b207ea499ae3f8
MD5 97c3a52ea5a3c4f7268b181190bf2cfe
SHA1 b20bc950048420113214a62d6420dd7e6413c1bc
SHA512 89ba0968207005cf658ce92dedb241faa45746d5add01b91996ba1f1cf7d1bd2d3983f23892514e49bc72375fb2391bf7505b9367df6147eb953766e7b599574
TLSH
T190015572B49B9295F3506B38E2DAA160313A9334C503CE27F083C1BC582478824057E8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4b2320aaa922c68dc3a9f1f5458e02ddd336b140eb9f228f5a6a69f219ad3213
MD5 cb3c62720fc358f7109d36a553f7ec15
SHA1 a66fe040496f959c04287891e2b6a2097e5bdaf7
SHA512 ddb8fcac5ad8ae8088fd63972517d6c25397d842e3797c70c015e27b762ac6eda5ebe5584b7e9ab4fec732cb5a97ae45974a601df5f3bf37c6ec4d5cfd668d67
TLSH
T116619CF3C3E8956D891166F4AB117E1FCE290924432C3C6688D4AF1B93E3972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5ba1ca06ef659285dfd9e11af11e2dabde1ffe415d31faffeb4dfdca0e144a37
MD5 7b6114b12e241ae8ef3b173a29ddc50a
SHA1 ebbf619dbce2545c2684e41a4f915aff655f59cd
SHA512 355c002bf2d6c12b0c8655d76282f4b07e037972f8f609d77d8a13e7ce9dd8335cd88d2be4d1df815ce1eeea8b84b3f86659712d950d1f87f84e64cd83f966a1
TLSH
T1B8518BF3C3E8956D891162F4AB157E1FCE690914432C3C66C9D4AF1B93E3972D24438E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c3c627424f176b1ae9848c030197775fa9e119e234f43f1f36346617326c3d40
MD5 54d5c3e4a23ec891961d78cba1d3a86e
SHA1 4ecd54b7b58ea362caf20ce790e5728caa60706a
SHA512 f5acb7179597e51c20014706d6df4a5bc4d52ee9598e963438c78dac0a1022d656cc914e6de570066ee6317643940e789e207f930bbb8a8260470840bd38d3d3
SSDEEP 192:GR+EH+0Av72HAPRp299THsb+WNnb40wN2KaAfVyIsnAUge:GR+Ee0cCCXuFwM0A2KRe
TLSH
T1EC42D72EA914693B6DDBD22AF9217727DBF6103135D42F84E6FC8A2C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a10bff2875636b4dbb573f92dc01af460aa9e6a7a37387e6396a8d9d0dad5e4a
MD5 b149b41ad20b28fb127d51759f66fca4
SHA1 fe7a191d1e06fc845ffc06edd8daad55bc174bfc
SHA512 674561d387f52874e55c2d3683bab25618f4982ec0e0fd35f456c6c31db65c94236567808d01df85b67ba10d82698f7170183bc8f561e9b472c394298d36c9a0
SSDEEP 192:GR+QH+bVv72HAPRp2/lK9THsb+WNnb43Q32GN2KaABVyIsnAUgvU:GR+QeblCCX7FwMY2C2KfvU
TLSH
T13A42D62FA914697B6DDBD21AF9217727E7F6103135D02E84E6FC8A2C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0a4ed311d3d1da10293622f67b72289649c145d9f6211701a9ddff266a219740
MD5 ac104da4882412314bc1441ae032da99
SHA1 94d558cdb29399444df2aadb94a6f5ae6ef9422f
SHA512 28fe043bb15c7390e74acde62d01ffa0434c2c6a28238116f1e27d49c61d98ee876f1c79d8be5c55f34e0cfa058c0d689634197f3ab27a70b8033199dde4843b
SSDEEP 192:GR9Qa+bVv72H+PRpM/lK9THsb+WNnb43Q32yN2KaAtVyIsnAUgvU:GR9QNblCgXpFwMY2u2KjvU
TLSH
T13052E72FA910697B6DDBD21AF9217727E7F6103175D02E84E6FC8A2C19E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 40345460c380f99c7fc11db280c568592e0b5263e90f2bb9a8df4ff48a1ead2f
MD5 dba56a71d2118e8b8471336df3487a9d
SHA1 96479a46786472c4f4fba3dda47dc5ecafe6301e
SHA512 233856182133bfae85b8d7f0d9d5e7dc5c8e91f1341808e195238e111922dd76220505fa59f89b2f294123ccfe0b2af77024e30c47a4169e219b431e31ef5407
SSDEEP 192:GR9QH+bVv72H+PRpM/lK9THsb+WNnb43Q32yN2KaAtVyIsnAUgvU:GR9QeblCgXpFwMY2u2KjvU
TLSH
T16C42E72FA914297B6DDBD21AF9217727E7F6103175D02E84E6FC8A2C19E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4dd22167676c259ab7aaeabeba6770f871b7611e3d2bf393695731e97926929b
MD5 141c224b32a1856fc58822068caa7ee4
SHA1 33b2a3836ee8b8618f93ca8e10f228de3cf3a035
SHA512 6ae7634410a170914cf784edca69c85f930688d950aa06d31f66c697e30af32e50ef3bfb7650875139d22b108ef80e59e0a877ab6b785939409c9bee17e887f5
SSDEEP 192:GR+EH+Szv72HAPRp299THsb+WNnb405N2KaABVyIsnAUgE:GR+EeSLCCXuFwM0j2KfE
TLSH
T17F42C62EA914697B6DDAD21AF9217727EBF2103135D42F84E6FC8A2C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9d988ba768fec7f1f12beef8d30a4a79db0d72d3c9a170b02f4f1c88136d1797
MD5 7556cb83524fa274e549808c9c2756a6
SHA1 d7dc0fd01a5c426e28025cc07375b755111996ed
SHA512 17030e6788fea1e8091353fbae7f5d0aa0938012d6b14c10ff5e3892d10d12844c765cc678f196457db4a37493c30f31c50ee7e034c37ee400a70c021dbf4a7f
TLSH
T1A3A0021445D11AB2FD01537170E159A637A25B5C15A1431755E214468BDB5D0FA12545
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bafaff69840aa591c0b5d44e8ff0002bceb368456286c8f23fe0e522264767b9
MD5 1328e306b285fbfb905f73ef9010b30e
SHA1 9e21bb848ac964f775baef234419f1d826144f6f
SHA512 b321109a3d59eba1d9fe72006ca59d4e94841e322487263abd0578402c7e20a8bcfc1c72cb72fd65bddd4d451359ea994e519766c0309e407d3e221791aa3af8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 6485c4fc7191df47e0969cc9ccd96e56b1f2165d62d6e0ec0af35be9434abf39
MD5 30678e19dd70f09040dfe0678db7aad3
SHA1 a06ffa70ebf1ecfbdb418d6d09ba3b68cd74557f
SHA512 3fcab2d007a9459175e25b7da3ac353e30a0c7538f1edd34a73baddc579f612f080fb1d9c4f66d4dc0de2cbbb2462b4cc88569a5b6eb6e1b112b7b866b3f5df7
SSDEEP 6144:Sb/TZNsaR62d66GkEFGjcRm7Rkm1tYpBeh2BAoM:OrZLzfyGjt9oBGcAoM
TLSH
T1D73423275F6D7EBA5979E53D340C570F2DF10AE3EC78CDA685C819080AD8A881B48C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 88b9396b8540f10fbd58cdccb67cdbd6a420e3b28a54ae9b09176c7bdec26d45
MD5 da9b3be2973323def62f03b31bdbe415
SHA1 d68ac20028ad0d92fdadc7ddc61ce94db5590fe3
SHA512 f263d0bdfd01d88bea9ccde3b540a459bd619d48845d589e760d3426074fae5c1950cc0d88721978ee2ce293705635c4c13d0f16c0c3840c0db78ff72a233dc0
SSDEEP 6144:DB/TZNsaR62d66GkEFGjcRm7Rkm1tYpBeh2BAoM:9rZLzfyGjt9oBGcAoM
TLSH
T1CE3413376E2D7EBB5979E529300C570E2DF11AE3EC78CD9689882D0856D868C5F48C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 eaf16a93897613d50a112578536f05b77d41a13fc51cfe3f0047f542b68ebc47
MD5 cf1871db2d9f7bbfe2ab0fcdd29ed8c2
SHA1 3c0c28470fa16e08d9204d3c3760ac38298b5ecf
SHA512 3923bc08437cb43459f7bcdc9399c3275330c8a68b6221f2ed83bd6e8f0978728030b2e6d8e6c9d89e5981783b185af7d3af070197dbed0b3b8398c0009702d6
SSDEEP 6144:7B/TZNsaR62d66GkEFGjcRm7Rkm1tYpBeh2BAoM:VrZLzfyGjt9oBGcAoM
TLSH
T1293413376E2D7EBB5979E529300C570E2DF11AE3EC78CE9689881D085AD86885F48C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8ac807c4f6bf080750cf442dfa57453300e8bb921f9ca1ae421aff52d254a60b
MD5 6a70b5eb63e516f3180a8b006e6cf2d4
SHA1 96838f345d23299e4f9b2d1778abdaa768705cb3
SHA512 c6e6e13b76f62f0b688a10c8096bb83b79e31ec5c1d253e385d1594c3d3476ba384e48989f32f4f33b9b151c265ac9d52e9df5b24e738ce131097f9960ab052c
SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:rm7Rkm1tYpBeh2BAom
TLSH
T183C3123B5E70E9775979A74EB08E0B1F1EF14AA2D930DA82C8D85A0437F97CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5be542bdbf9294024e5bce8cea58b4f0e881f45538255a77c668adbe88d8829e
MD5 c934a1b55684b59b79d15e943dba4ada
SHA1 9625f84682af6db6749616cbe0c0b29d00e80ff4
SHA512 9f619622e61dab8d09c4c29646a64e13cb6dc3e0606a1826fffa872e9403838d2ba8f02d039eae2d92c93658dc6773a31461c4bb73074f8a5e872979013c13cd
SSDEEP 6144:hb/TZNsaR62d66GkEFGjcRm7Rkm1tYpBeh2BAoM:trZLzfyGjt9oBGcAoM
TLSH
T1463423275F6D7EBA5979E53D340C570F2DF10AE3EC78CDA685C819080AD9A885B48C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60bf069f-d869-4d66-8eba-a1ca0a93bcf5.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2444_808991455\60bf069f-d869-4d66-8eba-a1ca0a93bcf5.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2444_808991455\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Non confermato 104176.crdownload

Path C:\Users\Admin\Downloads\Non confermato 104176.crdownload
Size 3.4MB
SHA256 c595218aeb6359a1efd4e5c57124d60b0f3c6da777c641fa60386641f9f2d2bf
MD5 7c522e9436bab58b7c102b1b1f37f89a
SHA1 6c700bb2e7012e10c6edcecce1d126e0fc7aa3f2
SHA512 5870b1692ae64c316e0b0c3d4f49fc5a503b08260ce663022d71eb5e74be769093ff4363914d81aa42dd2382939960a508d5ad223e8d8c6524fcdf168165f82a
SSDEEP 98304:CJmDtaMmVCSIcyhmZKCsBOQg7qMUNTBhKqWU4Y:CGaMjFhoKCsG2NTB8qIY
TLSH
T15FF533DE824E62E1D0D30D3A21BB31442DDABA49AF93AAC4D52C65D68857FD20377FD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-574-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-591-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-36-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-615-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-614-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-511-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-392-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-554-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-613-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-612-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-565-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-568-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-569-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-570-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-0-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-575-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-577-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-578-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-579-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-580-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-581-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-319-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-524-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-593-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-62-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-610-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/908-611-0x00000000007D0000-0x0000000001425000-memory.dmp

Download

memory/2244-558-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/2244-556-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/4512-527-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/5004-513-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download

memory/5004-514-0x0000000000DE0000-0x0000000001A35000-memory.dmp

Download