041344a56eecc303e538698321e0d1bd4c0e765691300b699e8d89bcf39dcb4b

Analysis

user interaction
yes
max time kernel
356s
max time network
362s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher.exe
Size 1.6MB
Sample260724-22cchaef79
SHA256 041344a56eecc303e538698321e0d1bd4c0e765691300b699e8d89bcf39dcb4b
MD5 2bcf8f6eda4deab1666f98ddb6bc974f
SHA1 75b48b1480e7aada99f333684f78af61f2a2aa45
SHA512 1850bfc9fa97a07072297bce46afd148b7fd645b46c13da6c803187785082394584062c532006c285e4ad4b0e5d89f3670a4a999e48fdbe923eb8b6d6a623cdc
SSDEEP 12288:BBChVyzNndzFWPYhv/JBdBS4msNUCe65frHMnz2R9Iyev5whgC:BohondzFWPM/bdo4mz1U8z2MyevjC
TLSH
T1677571841A6AC913DA78C7FF8C6E39FEF2715C11B186D7DE0640B4A534D9E80A7812DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1820	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134294080989031614"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
5076	chrome.exe
5076	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	launcher.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe
Token: SeCreatePagefilePrivilege	4336	chrome.exe
Token: SeShutdownPrivilege	4336	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5248	4336	chrome.exe	94
PID 4336 wrote to memory of 4784	4336	chrome.exe	95
PID 4336 wrote to memory of 1820	4336	chrome.exe	96
PID 4336 wrote to memory of 4784	4336	chrome.exe	95
PID 4336 wrote to memory of 4728	4336	chrome.exe	98
PID 4336 wrote to memory of 4728	4336	chrome.exe	98
PID 4336 wrote to memory of 5124	4336	chrome.exe	99
PID 4336 wrote to memory of 3204	4336	chrome.exe	100
PID 4336 wrote to memory of 5124	4336	chrome.exe	99
PID 4336 wrote to memory of 3204	4336	chrome.exe	100
PID 4336 wrote to memory of 4136	4336	chrome.exe	101
PID 4336 wrote to memory of 4136	4336	chrome.exe	101
PID 4336 wrote to memory of 760	4336	chrome.exe	102
PID 4336 wrote to memory of 760	4336	chrome.exe	102
PID 4336 wrote to memory of 1492	4336	chrome.exe	103
PID 4336 wrote to memory of 4568	4336	chrome.exe	105
PID 4336 wrote to memory of 1436	4336	chrome.exe	104
PID 4336 wrote to memory of 4568	4336	chrome.exe	105
PID 4336 wrote to memory of 1436	4336	chrome.exe	104
PID 4336 wrote to memory of 256	4336	chrome.exe	109
PID 4336 wrote to memory of 4440	4336	chrome.exe	110
PID 4336 wrote to memory of 256	4336	chrome.exe	109
PID 4336 wrote to memory of 4440	4336	chrome.exe	110
PID 4336 wrote to memory of 2436	4336	chrome.exe	111
PID 4336 wrote to memory of 2436	4336	chrome.exe	111
PID 4336 wrote to memory of 5992	4336	chrome.exe	112
PID 4336 wrote to memory of 3256	4336	chrome.exe	113
PID 4336 wrote to memory of 5992	4336	chrome.exe	112
PID 4336 wrote to memory of 4524	4336	chrome.exe	114
PID 4336 wrote to memory of 3256	4336	chrome.exe	113
PID 4336 wrote to memory of 4524	4336	chrome.exe	114
PID 4336 wrote to memory of 4132	4336	chrome.exe	115
PID 4336 wrote to memory of 4132	4336	chrome.exe	115
PID 4336 wrote to memory of 3792	4336	chrome.exe	116
PID 4336 wrote to memory of 2108	4336	chrome.exe	117
PID 4336 wrote to memory of 3792	4336	chrome.exe	116
PID 4336 wrote to memory of 2108	4336	chrome.exe	117
PID 4336 wrote to memory of 5368	4336	chrome.exe	118
PID 4336 wrote to memory of 5368	4336	chrome.exe	118
PID 4336 wrote to memory of 5512	4336	chrome.exe	119
PID 4336 wrote to memory of 5512	4336	chrome.exe	119
PID 4336 wrote to memory of 5456	4336	chrome.exe	120
PID 4336 wrote to memory of 5456	4336	chrome.exe	120
PID 4336 wrote to memory of 2564	4336	chrome.exe	121
PID 4336 wrote to memory of 2564	4336	chrome.exe	121
PID 4336 wrote to memory of 2088	4336	chrome.exe	122
PID 4336 wrote to memory of 2088	4336	chrome.exe	122
PID 4336 wrote to memory of 204	4336	chrome.exe	123
PID 4336 wrote to memory of 204	4336	chrome.exe	123
PID 4336 wrote to memory of 2964	4336	chrome.exe	124
PID 4336 wrote to memory of 2964	4336	chrome.exe	124
PID 4336 wrote to memory of 2880	4336	chrome.exe	125
PID 4336 wrote to memory of 2880	4336	chrome.exe	125
PID 4336 wrote to memory of 1744	4336	chrome.exe	126
PID 4336 wrote to memory of 1744	4336	chrome.exe	126
PID 4336 wrote to memory of 3968	4336	chrome.exe	127
PID 4336 wrote to memory of 3968	4336	chrome.exe	127
PID 4336 wrote to memory of 4044	4336	chrome.exe	128
PID 4336 wrote to memory of 4044	4336	chrome.exe	128
PID 4336 wrote to memory of 4988	4336	chrome.exe	129
PID 4336 wrote to memory of 4988	4336	chrome.exe	129
PID 4336 wrote to memory of 4440	4336	chrome.exe	130
PID 4336 wrote to memory of 4440	4336	chrome.exe	130
PID 4336 wrote to memory of 6088	4336	chrome.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xcc,0x134,0x7ffc8155c728,0x7ffc8155c734,0x7ffc8155c740
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,6837758176557713113,7537680703685336575,262144 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,9671101758107822535,16603128647615332062,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,2037064685120958051,17540928224598394192,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11534304342740829268,9255179063934224508,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,15887025012993480435,4519149596059733345,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,13203577563379283989,14246648477915697431,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,14350826496126858115,8673090933523573488,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,15455488405493100681,4963695510923954022,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,5155857704363914878,11898295939980273812,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,6524601140419312910,10280128706144586798,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,1365455903864483345,3205785298612979501,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5824,i,11119958612099900974,3460290835862745139,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6012,i,15101119382757915936,162309231614533487,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6116,i,17455626526275407430,13590558012032225389,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,2181388053088536109,16988346158906938333,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6368,i,10391090745074838299,15911651753168001984,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6616,i,5050106156765184967,12869999472235561064,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5532,i,7097051244841651797,13496723011467728861,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6596,i,15259455716184874921,9565789005488380838,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6112,i,16710645323243182503,6934857771260928863,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:9
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4752,i,9431483023914999439,880811465012044677,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6200,i,3657381494808412643,5198953169025442996,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6752,i,8357814081987353805,15849705433826420556,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3664,i,1660174083804326494,7885029531132763097,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6312,i,17088289160751051497,18361499481030517393,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5676,i,3686713139227735443,422037967433623696,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6008,i,6216872890643083432,16429183629998566578,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3816,i,6933544155876874789,12111326212705699324,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5704,i,3727842326689837465,15918041557032776787,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5532,i,2850262752824826172,6625175142414359076,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6124,i,8575676731477496893,14313564229443216566,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6780,i,9596348383140217236,16208595427990727851,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5816,i,8360074162911386299,14240774986697882127,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,13752363069970821355,8841064456201561644,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6812,i,9079964043767029102,1065887311688250098,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6796,i,13079553349104631511,17411126600835102370,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6624,i,7158090708297622400,5950664411060999308,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6480,i,1627076201271736697,10962461221343043102,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=4504,i,11623535339091224798,15387548073209648042,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=3260,i,188477413984437374,2805422024085303737,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6820,i,6760171635670838706,6345009022521462724,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6712,i,12071173679051538796,11213488907066961926,2097152 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,4481837725674125297,10143147864177452940,524288 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5916,i,17112613169335752737,11836958296996180034,262144 --field-trial-handle=1788,i,3579820752020612605,5322868196731471406,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3996

C:\Users\Admin\Downloads\CrystalLauncherN\Zainstaluj_Crystal_Launcher.exe
"C:\Users\Admin\Downloads\CrystalLauncherN\Zainstaluj_Crystal_Launcher.exe"
1⤵
PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crystalRuntimeBranch

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\crystalRuntimeBranch
Size 8B
SHA256 fe6d3468cf5c74d8ec2a95b40f2e05338c37a4202f8fad692d2b64a9cf9b468a
MD5 c00f0c4675b91fb8b918e4079a0b1bac
SHA1 f410e0466ae4b065bfa4d9010ad6056864ed4e50
SHA512 ab1a941f8f3b436262bad2fa7b5eb3d025fe25f54b137129fd733efd5c86b1ce97b587bcfa4986ada5530e25015d9001c819b71786e91ef4e4a33aee953b591f
MD5 SHA1 SHA512

Submit Download

launchlog.txt

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt
Size 1KB
SHA256 53a4aea0189945cfa433293c25983412505b0aff1dc252646a2418fcc368e777
MD5 fe6808bf87daeba433889e450bb5fc5b
SHA1 7c88e8e8c9302b2a5efc3bb56781e5bd211f95b5
SHA512 194de1168b6c88cb0afac171fbdeaeff31cd3bcce39902698b9dd74fe33589c4fcc4ab391b50ae8f1c5949baeac5061db6ba82f1734c70f61db544a29e57a4ed
TLSH
T10F11A530BB44E1A8958C27004499E6674DB86A782854ECBCF3A40C4DF5B3E2F4A7EF14
MD5 SHA1 SHA512 TLSH

Submit Download

launchlog.txt

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt
Size 1KB
SHA256 a5f3f6137282f84f4b3c3b4de681396b74b10ba14cab70be29a858aea2087486
MD5 1026ef8603985b03621fa3336aa73888
SHA1 058a3967f73aa32f1fc5eafe2a5b75947750d099
SHA512 8c90dce8df8d9b8d30f18cdcd42577aca941c016d78ae285acf615814a13ec0d3faa597346ebc3481c132280ed9bceab712c5199a952c997ce9aca10a46a4c69
TLSH
T182316E30BF46F069568C23115099E5B64EF46A382814ACBCF3A41C48F6BBE2F497EF14
MD5 SHA1 SHA512 TLSH

Submit Download

launchlog.txt

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt
Size 2KB
SHA256 34a65cd655375ddc7ab90fb6991d63eb69b87af36d0b8a4308dda1e45312cf56
MD5 dc3d0a06b0dd6a11a45755691e3be1e1
SHA1 a6d3a0bfd9b33ea5d047470e26a28b64ab8f72d5
SHA512 5f933b6b272a234140ad0475f8ee0c24f787ef48890acfe0996135265e705b2a4091fb71aed8a3b36b12e06fa6e87fd9b8d7ce4061838c4c8f5142454a529445
TLSH
T16351EA20BB45F069558C2301508DE6A74DB467782850ECBCF3A45C08F6B7E2F4A7DF24
MD5 SHA1 SHA512 TLSH

Submit Download

launchlog.txt

Path C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt
Size 4KB
SHA256 07cad1eba63a69e06ebde0d2c8103ac46956d36a981bd839df074cddd14771e5
MD5 4d1697b29638adf34c31d4bba24ae329
SHA1 f02690e57f777644862f7743da77aef8a1db7cec
SHA512 a11c61e7194948ca4437b62a58249e3aa18450cbfdd18864e734d07f5e9396783bd71023e82afbaee7794f972878d57ed4a68ef1f9f5aaedc370b263cd027172
SSDEEP 48:QZlJZ7HAZSuZ/QZ737RqIoZQsAZ2ZS2NS9QYqzBrZlbZ7HiZSAZ/yZ7FRKI6ZQs9:W9XTso2uQvv/shff2X29drV
TLSH
T148A13825FE45F1A9558C221000ADE6E65DB066782450ECBCF3E45C48FABBE2F4A7DF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 100KB
SHA256 b643164fb1e483e409a737186b34e84b0fdb41753e9fdd737772600af6e60431
MD5 1d5372a89dcce7422ef33102b70f2653
SHA1 b617c4d74213c56ede2bafde84503a8a3ea2a859
SHA512 8c1a98ee24dd5f085834bf704b6c622d5204f4605d66af48fc68cde328e04c7442c23480e03e8670d965e1bdf9e693e8d8c20d486e892a62b65c2bc340647a00
SSDEEP 3072:uSST8lXlBOwidSaP7w8vcLw5yi6+6ZKqTvtvnz:3F/c7w8vcUFsKeN
TLSH
T1F3A3022E0CE1B957775F2A221052A742167BFA4C8C426E2DB87FB2760B1D288717FC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 33KB
SHA256 5c677af2d6e78de58c66b09577213d4b1c23cf0409822378053f1c457ff465aa
MD5 68eae8ae528b3cf4965c780505e8274b
SHA1 23eea22c5ced491f0933dbdc428503548ae48636
SHA512 7fb225df90deaeff597ea4513985545b5ca6d3b4478dbe5969554f15ff4b2c1652c6220b970304884adfc2860be045599130534f1c45586a7adcfb29a8e72ac7
SSDEEP 768:9jlkCoC13VkNqcPyuMGV6lChDWaLGn7XfTpaY3UGJ0:9J913Vk5YlCRU7b15y
TLSH
T1F8E2F23016BD271E0D371D51A11984A31D0A86E5764A4B23DB20B0FDDE706E16F5FF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 26KB
SHA256 153fc85b70298beeb1d61a5f723331649e7f23bb77302a66e61cb3e2fbdb5e79
MD5 7660bd9909fb097989b19471a75f1b7a
SHA1 a389d97de580a2d6a3723112234bd2b3839ce0db
SHA512 7bc82b1ce3a44194677166280ed864f9a389a7d6e8df630db42ca11ef42be41603c53d6b54771dd904e55e73f4048571a61673902817db2e1b4a58848c6b0cf4
SSDEEP 384:IMazUGXW1v0QxaJODxEG9vSTTZdxpUU/JzmYcNgITcay5S65C0a5mlAPXoAONIRC:aUGGGQ84KiSTld8UoxQW6ja5Fvtun
TLSH
T121C2E19F8B31F4BB89817CBDE67ECD049BD88005F277667C4E7C1571448AA2988491E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 881KB
SHA256 13da46f8e9749704bfff6b6f51a202c87facf593280dfde4127e5858c28aaeaf
MD5 e0edc621e4ffaa368d2e0677d3f137e6
SHA1 e374bb44d1834cf6eb688eabe1820aa5f7c827d3
SHA512 d60643fe87788d76dcf1cd941002ceef18390cac5eaa683bce2e2dbeaba684b6fd656a94187379b71105333590412d65b3466cc9c37cdaada7e009c1c9f8435e
SSDEEP 12288:ubjDzI8Psju4mzEetRorWpuJl48nnMtu9sHj3i8W0:urzDn4etRoqC4OMu9sHj37
TLSH
T1EB15E6C7A3EC5E8FE4113D3883806D0E32D6663896A58265FFC7595EC0B88E4C765FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 17KB
SHA256 88d0b1a2004056ca341acf1ead5dc45080933b4c4a3f3ae07b2f0aa753325c9e
MD5 eef0c56076e081054b8aa8b0ec8abf7c
SHA1 77f0df4fca2df3efd03a86ecabdee027902cec05
SHA512 6c0304983baeb528a941668d33a8260294f68aa8072839d2fb0459425463f529b490e8027936a1eb35509798fe9d0973ccb3d53ef12f089793ce732b0a4d9f36
SSDEEP 384:/ZOicMJyUjgOs8uOHzJm1IicS/aBSaGLSCcJ9vYiGzznN1Zu31yseE0U:/ZOPpr7uJm1IiFCJC2GzzDZul/eE0U
TLSH
T17982D0576A193DE5A0BAB71B4E29915B68E96613C70B3074CBDA58DF71700F036CC5CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 73604a91872e5a49c03d780a0f79d53774214a5aa303b0c423d68a8751ce524d
MD5 269d82cb495aa4dbe4e7a32c887eeabe
SHA1 80f46e4116c1ef40a07b3e4bb50f30b73f72ed10
SHA512 73091adddc750346c877b27e1770684ee8ba6a12f07cb2fd9feaa17dd88cc126ea36c1a7a9df611714c273b414575bbf30a3246f7dc2636065dcf0a24ffd7b90
TLSH
T1D611666BA5D0D06BEFE78D3414CB7C4933A11A7808521B8B58CC6ABFDE832D94951247
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 7cc8b75a8c2b990dea103bcecab0ce3aecac911bf2ba4e62d15eced83b3661de
MD5 3718f573a0fbff58b84891a21a7ee112
SHA1 9efac92f5d390921de686a160753a9ec792b24a5
SHA512 ba817c2330c1ef809f7819a053e743e3496e8dcfea80e4c6aa8d72f08411b8b03634441712190137ea5ef3f84725d04cbfa7c4fb3e81a25b80c7a4c15303f544
SSDEEP 384:DJRdBAMMmzCOpWACVUgtuP0JusJngyf0iVwHT8IQtjfC5nXJyZGLOILC9MPkujR0:+UtyMPcD
TLSH
T1EA62B1F3C3E8866DC92156F5A6247E2BCE2D0D68836C3D16C4E8AF4BA3E1431D24159F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 977445570bef31a02c07142dc3ed93abecb5b7ece6b543533b4e0b4545834f7a
MD5 0e0689dd29f5b0d0667e6b3e40433206
SHA1 0afb62a93e77f655eca2e6d5e24bcfcb70d85c9f
SHA512 8fea6cf6240e12c2730f25099e80de320eb1b1cd9f07b07ebda9fa09ac8f7a6b9e4485bf1ed8e1b0d82b1070eef332cdfb68bc45e7177aaaf920bfd6ae05d2f4
SSDEEP 192:UR1CaaBv7pAPRp2o9XxHsb+WNng208Z2reDnVyIsnAUge:UR1C9RAXjfwB0U2Ce
TLSH
T16C32752EBE14693B6DCBD229FA657653D7F6102125943D80EAFC8A2C15DB5CC232701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 13e7cc7c9e3071b6ada3f48af04b910e459dfa28816a7dbe44734df18176762b
MD5 19bf3249da16142ce685dbc919ab68b4
SHA1 eeed5858e4aefae16ae0f6dec7d790a102d5ebe0
SHA512 fb04ab0bf74fffdac800ab14f8d80167a2ce241048aaec7d8586ca56f235f73135c917e8e6a2196ad05fd483419d827a9ff4d405bf8bf8977e446da3420d4f3c
SSDEEP 192:UR1CaSBv7qAPRp2Rx13opmyiNh9XxHsb+WNX5iPG3p6g2E+s2SZ2reD/VyIsnAUU:UR1CFRXXWtfwJ8m222+vP
TLSH
T10552A66FB960197B5EDBD229FA617756D3F6202265D02E40EBFC8A2C02DB6DC2317407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4be6d152c2550cf30eb22b7e8e20611c5a1adec8bf36a4d0a506b8ebd8d4d3d6
MD5 2fae6b1e5a858fe0395e1cec996e7351
SHA1 2e791617facd16bf0798f4d44ee6d6b1b3d0b7a1
SHA512 f5751e4d40a9103476449bc17ad46ed13d889a0f53953813b6f620d53b669a776c7a7b39731c4ce2394d12ff32aa268914f25b68e3f064e13c350370fc5dcfa8
SSDEEP 192:URKaaSBv7qKPRpmRx13oVmyiNh9XxHsb+WNZyUyiPG3p6g2E+s2lZ2reDNVyIsnM:URKaFRpXmxfwZ1y8m2r2qvP
TLSH
T10452A56FB960197B5DDBD229FA617766D3F6202265D02E40EBFC8A2C02DB6DC2317407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 027d9755605cdbfbcd8dbbe062f8c90c607961390a6030dcd278ec5125df75ed
MD5 c236a4b7ae59552e25144d50fac3f4f3
SHA1 5eff067cab29930d27f496151d1a2b6ebe3c5294
SHA512 2351e7746ba058a882de05f07b64a74f43faa07845a708ef75f237aeefcbeab2bce4822bbbd0f91212683ea4fce7476367b57a0a4a21ba805d55f344f1bad8cf
SSDEEP 192:UR1CaaBv7qAPRp2RxbZV/yiNh9XxHsb+WNviVG3p6g2E+s2+Z2reDnVyIsnAUg5P:UR1C9RXXW9fwv+m2S2C5P
TLSH
T1F352956EB960697B5DDBC229FA617757D3F6102265D02E80EAFC8A2C01DB6DC2317407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 94dc22887355591a63834adbd3f515ff6d97f4e140b6bb1ba941bc9001e0d424
MD5 162755ebbe655fc2e93cd2a3592b5fbb
SHA1 7ac51807e742913e3a0e1e04718d1c916f0f371a
SHA512 fd67abd4fa94f758ed87668a9344f054b30776bfba8395f59084534e4557282ebcce11543f544052c954403395cc41c9849fa6f14dfbafb6d1710e58a0839fab
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU3owHGSEM8pQ:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4e
TLSH
T11652F827684D9A3B0FD8D64DDC176F8FADF60146A668092497FA5D0803A97CB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 92a15ad3df69320c29ed33604ad8e67a90ef0b2324fc98461d34f536b1fe2010
MD5 f457b09fbc0532df7ad08ea31ed1cd67
SHA1 6d3967fe5eba5c2c3d19bd2c94b4401b3cd27469
SHA512 4c9059092276d434e2879b857a360263b542d29e71f93955aaf31e7b23501b17629ccf6ae8cc7227adcf67abfb11ef6482704cb39a6d5549c98c39e41f7c9369
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 12a7fe9d4ef3cbfd055c0857bb2a2ca30b4f6075de6f7115f123bf4158866853
MD5 5352a298b82462fb83b0144c4b242b87
SHA1 6cb363887729691490b882640d3e7202eea7f980
SHA512 1c2bcb68a285af972dddade5f60e9f126fd22c59ad754fe97f3997136f4bf1e5bcfb5b8602181d2b43ed918c3b0f8d2b134f8f007d029f1f6c6c0daf3da75d67
TLSH
T10CA0022441C00893ED01437064E2654136A28D382991572368A50584CC9F2D2410510A
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 d0e9f930841879223127a94e76c73c93c2e09df361290907deca7c9a5a319c8e
MD5 d3b11248de767b46f89b512434c0673c
SHA1 989ff1d5a28bc745d7dcd05eae9301627143743d
SHA512 7333cc406c868b3c108f57fa1d376522016c9097ca252fe0e95d2962588c109402180c10eb6e2bd9d8357f6f996f2f664ca1c0bac515780ac375bec4b590468e
SSDEEP 3072:3WExyks/ENI32xKPYMR2Vfys7hvosCnDfHQ/5XEnHke:GWGENI3249RqfZgtnDfHQ/5XmHN
TLSH
T151C3130070E96DDF9BA7C5627622A19C4CE5C07B2824FB7CE99C6A421D773EC7746831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 fed2c1190c18bbfaa6ac3d4b92c4c7b77cd9a9b62fca729fb46f7fa8847d53f8
MD5 5b33fd144923152c30619679a2f45dc1
SHA1 e52aaf186a78022c7c3fa0927b03877f421f26ec
SHA512 df5166b8ebdc7ff5a6e2cdfaed08103a6f1d2611d4d30779aa8348af682015e41449a46a1049bfd2960ce74f1e699d7acafdd92865d97ea0fb53732b56eed3aa
SSDEEP 3072:hWExyks/ENI32xKPYMR2Vfys7hvosCnDfHQ/5XEnHke:hWWGENI3249RqfZgtnDfHQ/5XmHN
TLSH
T1D4C3120070E96DEFD79BC173B736A1AC89A580752424FA78E9DC66521EB33EC3356831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 98c1ffa95d9a28fb751e1607dae9feff9e784f6ed5b885971feb4308f6150f90
MD5 4b217c0a38a3262b870ff69af2a0e6c9
SHA1 0a311c20f20744ddf02f95ffa60b518d485a48b7
SHA512 6ec0bd10ada5521a10ad7c9624292cf989b1204ac1adf77e86353396641e660b015f90bde8d2749b2cbd1dda543fd666ba97d17c30e547e2bd43d8ecae60ba22
SSDEEP 3072:8WExyks/ENI32xKPYMR2Vfys7hvosCnDfHQ/5XEnHke:8WWGENI3249RqfZgtnDfHQ/5XmHN
TLSH
T15BC3120070E96DEFD797C173B736A19C89A580752424FA78E9DC66521EB33EC3356831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a0ee6762ad41e3242dd266244489215c547e4c0eb6c1db219c459f879d987a99
MD5 78be94c40270624c4578bddd62e97574
SHA1 ae50aebdcb2de2ace2d1d322a878480f3e2a0b8a
SHA512 8d4fb7f96b141813b4b818823c1a43a91e2d87edee4b4696ca69de7d783524fd6971f5300ee5b7da26198ac506de2a6ecacf5f8dce4d0692b713024f1787256d
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok52mDPB6nGyvn0b4T8tybJv4a:xC0ITo+TQ0InDUD95PPb4T8tybl
TLSH
T154A10836A0684DB74476D44AB1622A43CEB97067E972BFD0EAED0F0D15F70EC1351A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 5c0da121c98bae74138395a231642cbe587c387555cef047edb9ac03366ea61a
MD5 9c640985a9d6c7a482e5451ecef9d47c
SHA1 8f4a557db8a4d97f9de26d7eabd0acd9ee98a511
SHA512 68c2fd508ac0e87d1f869cb46827452db2cbd97ea4a2ec83b7fd775bc9c17b437f8861975613b2a03675c7f4cd074b2ce5128ad90aa9e5c6c773cb708ca7a2c7
SSDEEP 3072:BWExyks/ENI32xKPYMR2Vfys7hvosCnDfHQ/5XEnHke:BWWGENI3249RqfZgtnDfHQ/5XmHN
TLSH
T14BC3120070E96DEFD797C173B736A19C89A580752424FA78E9DC66521EB33EC3356831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4336_1946234818\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

.crystalinst

Path C:\Users\Admin\AppData\Roaming\.crystalinst
Size 47B
SHA256 f7b96d33e37ab4efee43ea4a9d4c872a2194d288954553c6e3bb7926e2a7287c
MD5 2749fa9b45b9755eefafbf5517c74614
SHA1 fb0b300aa4bb371f71b4fb0e7092d1911a1f976b
SHA512 ad1ea746af6e8ef14edd20ecc17304fae591d3696a0f0fdab264b7a039e600f50add376356c68813c72376160c6c89ec1af2e33a9a7cc185a896b85d8d7e0180
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 7KB
SHA256 7fe7ec6d16dd6886895621a58ce6e9e4cae36458af95640a8507d35101f7a663
MD5 bfcebb2463821a2a6b100abaeb4e07dd
SHA1 f9ee34195961ef20e13c47ca04ddf743c7f763fb
SHA512 0fa603c47496f4fc8c4e80eb43bd3df4dce467503b9514ce5da017c1bedb65033f5458d7503eda80038c915c73f4f4542014391b6caad8e56e504e31b967d96f
SSDEEP 96:Jgu3cBRC9PvCzH9gskOcKEeV9R385V9glaNh:Omc/kPydDOze7pc7nh
TLSH
T1C7F19B0167FB1E1AF1F38E3659327B610F7BFD064918CE5A51C197081DB1210AAADBB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 3133487a517b4c8bcb2746b6981528abbb5199e50e9df61293b9c4300f12d1d0
MD5 39d4a3c0f0c9f2ba776c8d761e630d82
SHA1 bca5d323ddee964ac3cecc2bd9ae86d28a7d5c01
SHA512 142f82278b6da40abdc54c1e03adcdb37c59feb6a2a38536e075a2af8df19a06f079e07a4498b1f704403cc26a1c9d150ac4be3d9678f2a97da75bc2003e1ea1
SSDEEP 96:J9u3cBRC9PvCzo9ON1+0HFC9gskOcKEeV9R385V9glaNh:Xmc/kPyiO5FkDOze7pc7nh
TLSH
T17812BD0567F61A1AF1F38E36993277210F7BFD068918CE1A55C197081DB1310AAE9B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 d59966342a7150844d9f80b514379ce3e1b949f976d170e5877095d068be0041
MD5 ab5e6f200eceae2620b5c42120011077
SHA1 d9989ba58f4a39f1e0d51adbea38efa35cff708c
SHA512 83b19555e910952e6e227301787d7ab4db1de3be481ed886189624b52b71a441e4c501ede19d68f78e9af0a0f95f12c89017b2654fcbdbb22a003395bdcd534c
SSDEEP 96:b9u3cBRk9PvCzP9C3+iHFk9ON1+0HFk9gskOcKEeP9R385T9glaNh:pmc/WPylC3FWO5FWDOzelpcBnh
TLSH
T12022DE056BF7191AF0F38E36A932B7210F7BFD028A18DE1A55C197181D71300AAE9B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 c91748ea66bc3f0d5a690073de2703a8d2fd73590fb3f9ac78c88d0763599c41
MD5 3809c5bf9047d5d950fc7f3b2e2b11fe
SHA1 fa328b9e29ebac89fa3e0a9dbdec52d67ec1221b
SHA512 bc53f53641a01d14dc5082b4f9f22c60beccf688e373415d42a0e0a77396ea73da945af47021ca6c9cea4b99e3e04f20d78cd9fe53bc4451501756785d5b2edb
SSDEEP 96:b9u3cBRk9PvCzP9C3+iHFk9C3+iHFk9ON1+0HFP9R385T9glaNh:pmc/WPylCHFWC3FWO5FlpcBnh
TLSH
T18622EE056BF7191AF0F38E36A932B7210F7BFD029928DE0A55C197181D71300AAE9B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrystalLauncherN.zip.crdownload

Path C:\Users\Admin\Downloads\CrystalLauncherN.zip.crdownload
Size 1.6MB
SHA256 5a36f6ee5358fdc5b7d7f7a915c51fe0458bead1ba96509f91c9a0799e761a2c
MD5 5877baae1d94e775f58c41935e1c1287
SHA1 a5802c6e0f0ea01f6082c5b312b8df3e1ec27f99
SHA512 99bb2050da2bf075abb2ef245b3bf4fa5de3d82305c45551d40334c65bf7f85935353aaddf69755aa89eb1a3dc4839b5b99fa6094c6420d4f1186748b8fcf0f2
SSDEEP 12288:PBChVyzNndzFWPYhv/JBdBS4msNUCe65frHMnz2R9Iyev5whgCR:PohondzFWPM/bdo4mz1U8z2MyevjCR
TLSH
T13C7571841A6AC913DA78C7FF8C6E39FEF2715C11B186D7DE0640B4A534D9E80A7812DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1900-18-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-20-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-24-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-19-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-25-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-21-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-17-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-22-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-4-0x00000217AF690000-0x00000217AF708000-memory.dmp

Download

memory/1900-5-0x00000217957B0000-0x00000217957C8000-memory.dmp

Download

memory/1900-16-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-2-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp

Download

memory/1900-0-0x00007FFC6847F000-0x00007FFC68480000-memory.dmp

Download

memory/1900-1-0x0000021795000000-0x0000021795192000-memory.dmp

Download