hxxps://www[.]play-openworld[.]com/

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
124s
max time network
165s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.play-openworld.com/
Sample260930-rysj7saa38

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
36	4240	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4240	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe
Token: SeShutdownPrivilege	236	chrome.exe
Token: SeCreatePagefilePrivilege	236	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 2760	236	chrome.exe	88
PID 236 wrote to memory of 4240	236	chrome.exe	89
PID 236 wrote to memory of 5708	236	chrome.exe	90
PID 236 wrote to memory of 5708	236	chrome.exe	90
PID 236 wrote to memory of 5640	236	chrome.exe	91
PID 236 wrote to memory of 5640	236	chrome.exe	91
PID 236 wrote to memory of 5376	236	chrome.exe	93
PID 236 wrote to memory of 5376	236	chrome.exe	93
PID 236 wrote to memory of 2572	236	chrome.exe	94
PID 236 wrote to memory of 2572	236	chrome.exe	94
PID 236 wrote to memory of 4780	236	chrome.exe	95
PID 236 wrote to memory of 2108	236	chrome.exe	96
PID 236 wrote to memory of 5824	236	chrome.exe	97
PID 236 wrote to memory of 2888	236	chrome.exe	99
PID 236 wrote to memory of 2888	236	chrome.exe	99
PID 236 wrote to memory of 3848	236	chrome.exe	100
PID 236 wrote to memory of 3848	236	chrome.exe	100
PID 236 wrote to memory of 5008	236	chrome.exe	101
PID 236 wrote to memory of 1204	236	chrome.exe	103
PID 236 wrote to memory of 1204	236	chrome.exe	103
PID 236 wrote to memory of 3188	236	chrome.exe	104
PID 236 wrote to memory of 3188	236	chrome.exe	104
PID 236 wrote to memory of 940	236	chrome.exe	105
PID 236 wrote to memory of 940	236	chrome.exe	105
PID 236 wrote to memory of 3224	236	chrome.exe	106
PID 236 wrote to memory of 3224	236	chrome.exe	106
PID 236 wrote to memory of 5888	236	chrome.exe	110
PID 236 wrote to memory of 2532	236	chrome.exe	109
PID 236 wrote to memory of 5888	236	chrome.exe	110
PID 236 wrote to memory of 2532	236	chrome.exe	109
PID 236 wrote to memory of 5628	236	chrome.exe	111
PID 236 wrote to memory of 5628	236	chrome.exe	111
PID 236 wrote to memory of 2136	236	chrome.exe	112
PID 236 wrote to memory of 2136	236	chrome.exe	112
PID 236 wrote to memory of 4184	236	chrome.exe	113
PID 236 wrote to memory of 4184	236	chrome.exe	113
PID 236 wrote to memory of 4784	236	chrome.exe	114
PID 236 wrote to memory of 4784	236	chrome.exe	114
PID 236 wrote to memory of 5016	236	chrome.exe	115
PID 236 wrote to memory of 5016	236	chrome.exe	115
PID 236 wrote to memory of 3384	236	chrome.exe	116
PID 236 wrote to memory of 4128	236	chrome.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.play-openworld.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdd0b1c728,0x7ffdd0b1c734,0x7ffdd0b1c740
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,13651854439374832187,12436395486752005894,524288 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,16285979584286955092,7609500194684023706,262144 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,2462745006642720495,10330798895366783178,524288 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,16659023393452628021,15310557863625313693,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,17210588344681184348,16183060806522725976,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5008,i,9815363472277371783,7296201495351235559,524288 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,10041285200296549510,4918528557511321182,524288 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5016,i,2959353186569537122,1734287699239232714,524288 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5460,i,18139356278057530015,16957645913206810137,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5468,i,3685345742536746256,17705423125108535631,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,9626304307180286116,12184270949540117897,524288 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5928,i,18399307534659935038,15867295771469703537,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5964,i,5857304650022905903,3956205716101349238,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5876,i,7689295630413137723,9095653902665068690,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5960,i,11647169836789471139,12934830913209832798,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6408,i,17966879190460320322,2441035817539979333,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5636,i,17483713456635201459,10470548150640561208,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6004,i,17927691194300385309,14741799605766013188,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6172,i,13141265699294383190,12752603335065010281,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6376,i,14608998843292600246,17634460246094279900,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6024,i,13502677801892581382,2769625800735012656,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6432,i,1701392116893264022,6427349421726840539,2097152 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6492,i,2607381014053205655,3773679275869919673,262144 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,9196904317945906480,17905296845013270648,524288 --field-trial-handle=2332,i,8863168702284588820,9868190550725409040,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:4128
- C:\Users\Admin\Downloads\Openworld.exe
  "C:\Users\Admin\Downloads\Openworld.exe"
  2⤵
  PID:5992
- - C:\Users\Admin\AppData\Roaming\.openworld\launcher\builds\8\owlauncher.exe
    "C:\Users\Admin\AppData\Roaming\.openworld\launcher\builds\8\owlauncher.exe" "--updater" "C:\Users\Admin\AppData\Roaming\.openworld\Openworld.exe"
    3⤵
    PID:5144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 d0e900c173fbd2e0bafd0dfdbf5c757247ced55e9b8062b7bbf65d2e992dcc16
MD5 a7d045b18e393665d11a7a1929d8bb72
SHA1 247a90826d432875660acc05a270850c4c31890d
SHA512 26ac47d084596b61de4cd7163ca81738f0c2a73a067c14cfb05c37cabd5b568e6ffd3228036d5fb2916d5929923d5aa18b0b7e558f1e588236226cfffeac3396
TLSH
T16C01A96059B1B4A0CFED003244E036B93030BA0E56532E01ABDD44B7BEBDB271741B03
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 8d520bcc6686efdc92a1587bff3ee2973155c3edd8ec17c5a6367b02ba72f98f
MD5 5a215221f1752db9539b11a892d3add5
SHA1 8095d9d35adba372e6e8a3f9de72dcc2568691fa
SHA512 d2586fd0be78e7e21cb4b7fa9d4ff1a566679d2b6a216d2466766bfa1c50adc18bfafdf0450da655b625f6cd5494fc53173a79b94a215e1af05462fdbc989374
TLSH
T1CBF0F26449F5B420CFE9117004E03A7930307A4A46636E4097ED40B6BE7DB270B52342
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1d91e257988616e160aafba71113c406622a162e9a033d2f07600c082ef8950a
MD5 9881c4824ba3536410be2ddc50d82d9b
SHA1 5d5c2a6d9959297fca42108f6d5edca3fe92727a
SHA512 e4053062e501bc3fc32bc223b2357fd0a031d482657eaa3401e66be6342746371d764b36d75f53b69270672d5576c6a5c7cec3f18e4cb1ec641e19c693f4ceb3
TLSH
T14F51AEF7C3E88A3D890191F4BB292E1BCE6E0914932C3D47C5D8AE5F67E19B1D24054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 5ea7d6d240cf362a6f728c1b4ae4e0b90cc2d7aecfbba9073f35f781b1afca3f
MD5 a79162c34ffe35e364386baceffc429f
SHA1 3b079fb02b23819e1a6b43930397d81b4a5976e1
SHA512 14891e4ecb2c4aa63f7d451e9a0ee464f0cc36c02fe2dd5ef395aa302d1a2bb3234c9b9784e6ab5552f80a174d88508d95f55c96370ce45ecf3fc1d1e1320b80
SSDEEP 96:Dmw0L/BUKmRuU3mBmtsBmqHcEISu8rff7u1LemjA:Dmw0L/BUKm8U3mBmtOmqHcEISu8rff7/
TLSH
T172B19CB3C3E8CA7DC81556F4A7256E2BCE6E0914522C3C56C8DCEE4B63E19B2D25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 ea57158da1bf88944ab4002572752fb70d311272f5c5e702b0f1d9d697b48b59
MD5 63e485a63d05136ddd812507e8cfde51
SHA1 14f762ce1644b1c6d5c0658ae72b94942c1fc73f
SHA512 a304847dbb2d8aac3b88b33abd570f51eb57f572420b8cde7697d57a132eb2f41c9377a79ab25607452676280be8f39e7b4a38f76328fee3aff556dee09a89c4
SSDEEP 192:gRpyz8v7cvAPRp2AdwXsb+WNnnnuyOU2K72ADvskwXiyIsnAUgR:gRpyzoA6XQXwn/2U2EkiR
TLSH
T15A32752DED24B53B9CDBD22AFA267757E3F5002124941EC8E6F9893C11E79CC6227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c1f7a0c2b920eb1dab67e91a0b7500f9d585d6d24eed0dff6da544640d6f1433
MD5 72cd20e7071a9e19ee47a9286e029052
SHA1 39843e6c32f9a6cb69be379ccec06d1a6e4a8cde
SHA512 a5bb6a22d4f80a021fc1e2fd33e26483708bc663806d0d447b9a413cff2fc775be4b838cd1ad1c4d27467285c66612362ca7710a4b1999747fd00c8bfa693a4e
SSDEEP 192:TRpyz+v7LIPRp6AdwXsb+WNnavhyOU2o72ADvskw+iyIsnAUgE:TRpyz6qX8Xw46262EknE
TLSH
T1E942942DED24793B9CCAD22AFA267B57D3F5102124942EC8E6FD892C15E7ACC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b2bf381eda6a267e1fe88eb12d6a83826d3bf18a3f0926f66392153218cf8fcc
MD5 578ded0afcfdd48d01cd4d9d2ad482c5
SHA1 bc4b40fd750014cfa9af7a1f0cd4be9804c1c94e
SHA512 6c320f52e37fdc52d3d3c5f9255c4cbd02ad8ca8906caf92f7d00f2a7a0cb1dbbb4b035d4a6ee479301ddce1dc12d56e37056adfa8b5621dc2cc393c1b94990e
SSDEEP 192:gRpyz8v7cvIPRp6AdwXsb+WNnnnuyOU2s72ADvskw+iyIsnAUgR:gRpyzoAyX8Xwn/2+2EknR
TLSH
T1C032932DED24793B9CDAD22AFA267757E3F5003124941EC8E6FD892C11E7ACC6227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 25445a12113deb538527e352f3334abb3a6bf41d0e76d1fc2910f6c8e443c9e5
MD5 6f68c3877ec4e05dfe8d8dbe980775d6
SHA1 d1a420416f5525a05dd5eb389ff8cf7123b8b766
SHA512 e803caa4a3f0a8bf604554f1adc503fc6371de0c917db6e32e810a38d6ab511ddd534babda34c7fda30faa6a6779d38f7b1a1227eb081337c6c02b92cf54df2f
SSDEEP 192:TRpiz4v7LIPRp6AdwXsb+WNPHQ1AxEyOU2h72ADvskw+iyIsnAUgE:TRpizkqX8XwoiZ2l2EknE
TLSH
T17442A52DFD14793B9CDAD22AFA267757E3F5102124901EC8E6FD892C11E79CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0f251e0171462c65d61d6ef051d70ccafb4570493c7595b88b713eb7b35b8ec0
MD5 a1e33ef334731f74c88cfd2485280073
SHA1 bda197aa36045b53d1a511e0dbd031a8adf6c479
SHA512 eaf8fa2614d44c9203446ff9628189bb0a407565037800622388be244110fc276dcaa1cd5c2a2fc7581243b5fa71bb0401fa135c647daa55946d65633e301ef4
SSDEEP 192:TRpiz29v7LIPRp6AdwXsb+WNPJxACAxEyOU2v72ADvskw+iyIsnAUgE:TRpiz29qX8XwPArZ2z2EknE
TLSH
T16742A52DED24793B9CCAD22AFA267757E7F5102124901EC8E6FDC92C15E79CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
MD5 732de8cdfa44549aee916b3128c61ae3
SHA1 6201a4a55c97cdb8b57cb3f61ba893d5dd358b5d
SHA512 9eaa398ed23d1f4dae033777b1069636a7e8002d4594f290b2f598fe3e323c19011e7f57a6c16f1c0f5707f938b0c4452ee8efb283aab7141207038e04899ecb
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN902A/gkoPn:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFQ
TLSH
T1BE32F92BA48D9A3F4FD8D51DDC136F4FACB502966228092497FB9C0803F978E514A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0ace3b5625087234a0b805f6ea4edca0500866cb6625673719bf2d0c77f1845c
MD5 1c08144ab906ea3c9b26cb9669adab43
SHA1 9c9cadca2c274e443a78585c3f86b9b35e3d22a8
SHA512 0816d0351bfb56163aa97ba9b7bf2bbb9646591d4846295f51e668ebc07d7df43f22f39185d77a7e50f69e2d16b259c0a850025f914e521ce013113489738eb3
SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUqJdXSl8h4otop5I8pIDMB6+PGtvteZMWtM2:At0oWqNVVxi+9oPIiU23+AY+ZMWttdQg
TLSH
T1AEC10A31A86D9CAB4DF6A585B0032D578EB8606F6919AF98FDEA1D1C01E34DC4383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 b6456814acec78d20431ac02e445456fcfc4cbe78f0f2b7b0771c57c02e18007
MD5 fa3c55e2a555cb641d627e76bde63405
SHA1 58726cc6026cc4969b2006579e36a2aea1f935ac
SHA512 33823416a4a4fad7a287791a68eb53738e378fdf26d99135af9242ea0b800a4a37edef87e9e66019fbfceb1404cd71a53fd7341d33218f0abe38c2184ebd7a78
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5I8p0cDMB6vGyvtBWG0cQ3bOv4a:CC0oWqNVVxi+9oP8DUD30KADeW9cQ3bQ
TLSH
T161A12A31A87999B789F6D585B1462E538FB870AFA521DFD4E8EE2D1C20B349C0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cca15a93c551d0520b3aece64a61458c7e69bee92b87b4d0d5aab1d4122b7ce5
MD5 b6b6714ec3380d0bdd0f36f4f700a338
SHA1 c6e52e0b2ba0d92d35e8ebfc3ebc23b3f0ebfc17
SHA512 82211e2f5a8b91ea19f64db80a225d2efff84f1c5a67bbcbb0f598b4c67e9c1ada0f37d4f3d8359c5ba4142a3f41796f4beafa334bf13381e25aa0e3ea5731e1
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUqJdXSl8h4otop5I8pVDMB6+CGyvteer5AuzH:CC0oWqNVVxi+9oPIiU23dAVtMzbWtLdS
TLSH
T178C12A31B87D69B789E7D555B0023D538EB860AF56259FA8DEFA0F1C01F309C1382923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bcc214b3305afbd91453c17f97ac5415520b237ed249befdffcb51559ee087a3
MD5 d84d32cbfd53679ee964f4dc8359a5aa
SHA1 c0b17832fa6646b0bc716fc0e0c34020c12716a3
SHA512 850182319427e309661d432fafe55810a6c16e73661d8a8cf4f515a532290e6422878f5d7a54bc933a38340ba69347cd7a73e6a910ce1e180bd4b80dc7508ecd
SSDEEP 96:CbJ0d+TWqN/K890wxi+9M7fX3urjUqJdXSl8h4otop5I8pVDMB6+CGyvteer5AuL:Ct0oWqNVVxi+9oPIiU23dAVtMzbWtLdS
TLSH
T195C11A31B87D69B789E7E555B0023D538EB460AF56259FA8DEFA0F1C01F309C1382923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 dfa9e35b6d5783c1ca6db3ad8c5066119a33fbb26cd796d2d13991c518f9b2a1
MD5 08382a1940dc4fcc778486369f760ca3
SHA1 39d5a04abf14de7253953d60835fea6e6f09ce34
SHA512 47fa52ed98aa8a760a60e73f61ac7f4213a2bfd025fb8fe62751cc17057c7165c4bc55391fccd39fb85463194b393641a16a529feff3c672a6a5f4d4576116d7
SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUqJdXSl8h4otop5I8pIDMB6+PGtvteZMWtBX:At0oWqNVVxi+9oPIiU23+AY+ZMWt2dQ5
TLSH
T159C10A31A86D5D6B4DF6A585B0032D578EB8606F6919AF98FDE91D1C01F34DC4383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 59ff56a998c2dcd84fa81b6c63a6373a4ce204788ca7744dc725194e890164d2
MD5 0cbf3ad8d64980ce41a78ce7c7830787
SHA1 8275baa3df47aecf92a6446f0bd46fc2e4d62ecc
SHA512 76272e5e32ccaf040cf9563578fe75741538e97c88a0ceaef2af7ec58f0fe99aa2e5b733404412088d256cce43a598c679e7dae51be0be9fa091c60ce4ec3ce4
SSDEEP 96:AbJ0d+TWqN/K890wxi+9M7fX3urjUqJdXSl8h4otop5I8pVDMB6+CGyvteZRWtb6:At0oWqNVVxi+9oPIiU23dAVtZRWtwdQI
TLSH
T1C3B1F931B8AD98B749E79555B0063E57CEB860AFAA159FA4E9FA0E1C01F30DC1343927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.json

Path C:\Users\Admin\AppData\Roaming\.openworld\launcher\builds\8\install.json
Size 170B
SHA256 6d436c437ce40dad6dd7d8063918e0c56df4dc1c1f9376348f768d864ca57a73
MD5 5b901bb031f777e333e61c51cccf9fd5
SHA1 604c2c64a9185f176cf428f9783f5d7d5bece3d2
SHA512 8ea4a912675864da762a0e3870c31429d406e52bf38bbe4b611960cf8d6893a97994be9fb15e4770f6c5737ef8c765efff3864159c38971feae9cc1f4ce26376
TLSH
T16DC0C0E206232C703529139183461020868730A12C407E88521C0804522302F0024404
MD5 SHA1 SHA512 TLSH

Submit Download

owlauncher.exe

Path C:\Users\Admin\AppData\Roaming\.openworld\launcher\builds\8\owlauncher.exe
Size 9.8MB
SHA256 efa47b29e0b5a293ebc49f9b421ef0e0edc694fdb0ef325b6dad66c3f0948f47
MD5 941330cc82960605e0746b6a7147948c
SHA1 7a39ba88271e3b2adfe8127e1b2cb1e2ee721e75
SHA512 0bd55cd73ce82d7b3112c2084c045c4e02e98d0b404451f5057d9fbbcfc141679387fb0beee2519624d2957bf35fc7b9221e592bc2ec0ae2d31c3415f96b3e1c
SSDEEP 98304:y3p+MFQ4BYIFjENwBnw95YOIZ/8A6Sz2465RMPX/cqZYWWQhVRpjWxfJtus9PMSP:y30natpYtK4YkV
TLSH
T17BA66C4BE2A360ECC62BC174836BA773F631785801247EBF56D4DB312E21E505A6EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

current

Path C:\Users\Admin\AppData\Roaming\.openworld\launcher\current
Size 2B
SHA256 aa67a169b0bba217aa0aa88a65346920c84c42447c36ba5f7ea65f422c1fe5d8
MD5 c30f7472766d25af1dc80b3ffc9a58c7
SHA1 136571b41aa14adc10c5f3c987d43c02c8f5d498
SHA512 0354672b288ac5ccd92c7336f24c3b5a9e669d95bf3036241d3919bae5aadba2c312742d7b422cb04347d6ce98151019baf81a3390e12de140365f17a9cf9afc
MD5 SHA1 SHA512

Submit Download

Unconfirmed 214044.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 214044.crdownload
Size 6.9MB
SHA256 b3910dfbff35318e8dd493aa06d4f5f6dad1160ad9dd1aba8cdd4be69a5ec637
MD5 1c1435ab10c0b1f4cde892a4705a58d2
SHA1 c62f6e1f1c4385469131f2910619ab5bb13df6e5
SHA512 4f3068b99a973f2b55377c0b5778793d41f02d4ecd6fe606e94039d45819edeb11df752ec4a85f58bb4a90de4908969e11da154576212aef87662c925730553e
SSDEEP 98304:iYE7hi3uBhaBJ87tI/QZYvEM3i1LBJfA0GaMiDZhWEkIT0vt9dr4OmnhiAg6Sw5B:xb4HXh0iOmhiAtT5B
TLSH
T155768E5BE2B350ECC627C1748267A772F531786C0124BDBF5AD4DB312E22F905B2AE25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5144-510-0x00007FF7D7600000-0x00007FF7D7FE1000-memory.dmp

Download

memory/5992-515-0x00007FF734B60000-0x00007FF735246000-memory.dmp

Download

memory/5992-535-0x00007FF734B60000-0x00007FF735246000-memory.dmp

Download