hxxps://info[.]sonicretro[.]org/RotSprite

Analysis

max time kernel
224s
max time network
221s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
03/06/2023, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://info.sonicretro.org/RotSprite

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
4372	7z2201-x64.exe
1592	7z.exe
3480	7z.exe
5024	7z.exe
1180	7z.exe
1104	7zG.exe
1116	winrar-x64-622.exe
4880	uninstall.exe
3032	WinRAR.exe
4508	rotsprite.exe

Loads dropped DLL 6 IoCs

pid	Process
3240	Process not Found
3240	Process not Found
3240	Process not Found
3032	WinRAR.exe
3032	WinRAR.exe
3240	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2201-x64.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2201-x64.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2201-x64.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2201-x64.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2201-x64.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240684359	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2201-x64.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-622.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2201-x64.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2201-x64.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-622.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-622.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2201-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133302636685139423"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	rotsprite.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\7z_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew\FileName = "C:\\Program Files\\WinRAR\\rarnew.dat"	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Applications\7zG.exe\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	rotsprite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r21\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r22	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	rotsprite.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	rotsprite.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
4332	chrome.exe
4332	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
516	OpenWith.exe
3364	OpenWith.exe
4256	OpenWith.exe
5020	OpenWith.exe
3032	WinRAR.exe
4508	rotsprite.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
516	OpenWith.exe
4372	7z2201-x64.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe
3364	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4196	3688	chrome.exe	67
PID 3688 wrote to memory of 4196	3688	chrome.exe	67
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4776	3688	chrome.exe	70
PID 3688 wrote to memory of 4772	3688	chrome.exe	69
PID 3688 wrote to memory of 4772	3688	chrome.exe	69
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71
PID 3688 wrote to memory of 3092	3688	chrome.exe	71

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://info.sonicretro.org/RotSprite
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xac,0xd8,0x7ffe95be9758,0x7ffe95be9768,0x7ffe95be9778
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5276 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5448 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5708 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3368 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6000 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6076 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3216 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3204 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5400 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5980 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5732 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3060 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Users\Admin\Downloads\7z2201-x64.exe
  "C:\Users\Admin\Downloads\7z2201-x64.exe"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2516 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=2496 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=3592 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6096 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6052 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6060 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=2496 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3108 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5572 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3228 --field-trial-handle=1804,i,17652812380662491599,6608481057554299442,131072 /prefetch:8
  2⤵
  PID:2128
- C:\Users\Admin\Downloads\winrar-x64-622.exe
  "C:\Users\Admin\Downloads\winrar-x64-622.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1116
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    PID:4880

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3364
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Rotsprite (1).7z"
  2⤵
  - Executes dropped EXE
  PID:1592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:2304
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Rotsprite (2).7z"
  2⤵
  - Executes dropped EXE
  PID:3480

C:\Program Files\7-Zip\7z.exe
"C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Rotsprite (2).7z"
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4256
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Rotsprite (2).7z"
  2⤵
  - Executes dropped EXE
  PID:1180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5020
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\Rotsprite (2).7z"
  2⤵
  - Executes dropped EXE
  PID:1104

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Rotsprite (2).7z"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
PID:3032

C:\Users\Admin\Downloads\rotsprite.exe
"C:\Users\Admin\Downloads\rotsprite.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4508

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4448

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
532KB

MD5
fe522d8659618e3a50aafd8ac1518638

SHA1
7d1b392121da91393f69d124928f9fe50d62f785

SHA256
254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23

SHA512
fbbcb853b77ac038e4b7f7668e9fefdc7ba3592c6899cddfd72125d68d0b2d6b858baa3987907d58a5333ea9a4d5eb0ab8b7535a6263738f96212a6146c49b81

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
532KB

MD5
fe522d8659618e3a50aafd8ac1518638

SHA1
7d1b392121da91393f69d124928f9fe50d62f785

SHA256
254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23

SHA512
fbbcb853b77ac038e4b7f7668e9fefdc7ba3592c6899cddfd72125d68d0b2d6b858baa3987907d58a5333ea9a4d5eb0ab8b7535a6263738f96212a6146c49b81

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
532KB

MD5
fe522d8659618e3a50aafd8ac1518638

SHA1
7d1b392121da91393f69d124928f9fe50d62f785

SHA256
254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23

SHA512
fbbcb853b77ac038e4b7f7668e9fefdc7ba3592c6899cddfd72125d68d0b2d6b858baa3987907d58a5333ea9a4d5eb0ab8b7535a6263738f96212a6146c49b81

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
532KB

MD5
fe522d8659618e3a50aafd8ac1518638

SHA1
7d1b392121da91393f69d124928f9fe50d62f785

SHA256
254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23

SHA512
fbbcb853b77ac038e4b7f7668e9fefdc7ba3592c6899cddfd72125d68d0b2d6b858baa3987907d58a5333ea9a4d5eb0ab8b7535a6263738f96212a6146c49b81

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
532KB

MD5
fe522d8659618e3a50aafd8ac1518638

SHA1
7d1b392121da91393f69d124928f9fe50d62f785

SHA256
254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23

SHA512
fbbcb853b77ac038e4b7f7668e9fefdc7ba3592c6899cddfd72125d68d0b2d6b858baa3987907d58a5333ea9a4d5eb0ab8b7535a6263738f96212a6146c49b81

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
935KB

MD5
d36deceeb4c9645aab2ded86608d090b

SHA1
912f4658c4b046fbadd084912f9126cb1ae3737b

SHA256
018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45

SHA512
9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
668KB

MD5
5ab26ffd7b3c23a796138640b1737b48

SHA1
6dab8c3822a0cab5b621fd2b7f16aebb159bcb56

SHA256
eb775b0e8cc349032187c2329fefcf64f5feed4d148034c060e227adf6d38500

SHA512
2b40489f46e305f7e3455cac25e375711a6a1733861ee7bf1b800b86eaad2f40871c219924ddceb69b9748ae3cf9de59f0edffd7ed7b5e7f35d1239fe0333a78

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
668KB

MD5
5ab26ffd7b3c23a796138640b1737b48

SHA1
6dab8c3822a0cab5b621fd2b7f16aebb159bcb56

SHA256
eb775b0e8cc349032187c2329fefcf64f5feed4d148034c060e227adf6d38500

SHA512
2b40489f46e305f7e3455cac25e375711a6a1733861ee7bf1b800b86eaad2f40871c219924ddceb69b9748ae3cf9de59f0edffd7ed7b5e7f35d1239fe0333a78

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
14KB

MD5
0c77e99dd91d1cd536b6db9d1c70ea2a

SHA1
6d0a5e02841ed84a33518fdbb6bdc397d8a2f450

SHA256
266bf84cc110ed4b34aedf904b36b60e29de0901978b0aa10c7e58cc072c2444

SHA512
5f2b0a31bb1f34380e09deeccceefe229fedf5c9c6047c75b71934d170b06ec014a438ec7a041f668d3ea7e23e73edf1dfb32d9dd2e6641c00e411fc29f626c3

Download Submit
C:\Program Files\WinRAR\7zxa.dll

Filesize
228KB

MD5
983d226045bb3c63e0c1d047428ee17b

SHA1
6a0a74dd68daae4ba5fc8cdf2da963bacd17186a

SHA256
33656242a0d8cce56f6c2abb0ceffbced63a460755fad1dcee36490f904d4809

SHA512
9652fb0fc2666104ee17579df0bc65282d95dd509588a82d7aa1445078f2893067d77199c04d0c84bba8cdb361807efb10f014ddf9f14d07888719b341b87e27

Download Submit
C:\Program Files\WinRAR\Rar.txt

Filesize
109KB

MD5
18eeb70635ccbe518da5598ff203db53

SHA1
f0be58b64f84eac86b5e05685e55ebaef380b538

SHA256
27b85e1a4ff7df5235d05b41f9d60d054516b16779803d8649a86a1e815b105b

SHA512
0b2a295b069722d75a15369b15bb88f13fbda56269d2db92c612b19578fc8dadf4f142ebb7ee94a83f87b2ddd6b715972df88b6bb0281853d40b1ce61957d3bd

Download Submit
C:\Program Files\WinRAR\Uninstall.exe

Filesize
437KB

MD5
36297a3a577f3dcc095c11e5d76ede24

SHA1
ace587f83fb852d3cc9509386d7682f11235b797

SHA256
f7070f4bb071cd497bf3067291657a9a23aab1ca9d0ab3f94721ef13139ce11b

SHA512
f7a3937f9ffb5ebaac95bddc4163436decdd6512f33675e3709227a1a7762588a071143140ed6bb2a143b006931e5c8b49486647800f0de2e5c355e480f57631

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
103KB

MD5
eaeee5f6ee0a3f0fe6f471a75aca13b8

SHA1
58cd77ef76371e349e4bf9891d98120074bd850c

SHA256
f723976575d08f1001b564532b0a849888135059e7c9343c453eead387d7ae4c

SHA512
3fc5994eefce000722679cf03b3e8f6d4a5e5ebfd9d0cc8f362e98b929d1c71e35313a183bfe3ab5adbd9ce52188ade167b8695a58ebd6476189b41627512604

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

Filesize
317KB

MD5
11d4425b6fc8eb1a37066220cac1887a

SHA1
7d1ee2a5594073f906d49b61431267d29d41300e

SHA256
326d091a39ced3317d9665ed647686462203b42f23b787a3ed4b4ad3e028cc1e

SHA512
236f7b514560d01656ffdee317d39e58a29f260acfd62f6b6659e7e2f2fca2ac8e6becac5067bab5a6ceaeaece6f942633548baeae26655d04ac3143a752be98

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.5MB

MD5
04fbad3541e29251a425003b772726e1

SHA1
f6916b7b7a42d1de8ef5fa16e16409e6d55ace97

SHA256
0244b889e1928a51b8552ab394f28b6419c00542a1bbc2366e661526790ec0a7

SHA512
3e85cf46dd5a7cadc300488e6dadea7f271404fb571e46f07698b3e4eaac6225f52823371d33d41b6bbd7e6668cd60f29a13e6c94b9e9cb7e66090af6383d8b2

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
2.5MB

MD5
04fbad3541e29251a425003b772726e1

SHA1
f6916b7b7a42d1de8ef5fa16e16409e6d55ace97

SHA256
0244b889e1928a51b8552ab394f28b6419c00542a1bbc2366e661526790ec0a7

SHA512
3e85cf46dd5a7cadc300488e6dadea7f271404fb571e46f07698b3e4eaac6225f52823371d33d41b6bbd7e6668cd60f29a13e6c94b9e9cb7e66090af6383d8b2

Download Submit
C:\Program Files\WinRAR\uninstall.exe

Filesize
437KB

MD5
36297a3a577f3dcc095c11e5d76ede24

SHA1
ace587f83fb852d3cc9509386d7682f11235b797

SHA256
f7070f4bb071cd497bf3067291657a9a23aab1ca9d0ab3f94721ef13139ce11b

SHA512
f7a3937f9ffb5ebaac95bddc4163436decdd6512f33675e3709227a1a7762588a071143140ed6bb2a143b006931e5c8b49486647800f0de2e5c355e480f57631

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
37KB

MD5
5b0c0d429185ff30e04c93f67116d98f

SHA1
8eb3286fe16a5bee5a0164b131bc534fd131f250

SHA256
f1a0b957050b529afc0e94c436976326124ed8968183859c413986487623294d

SHA512
6295bcd662325172b15c476d26f23c8794c4f1454e0e8cfd43bca79b45aa03e1ae721ebdada1c52fe7699027fa97699156280ff259ce3cc476e322ccc0337902

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
5c98c80ad87f00afaaa8c66c31b7dd16

SHA1
dde03cd4cced9dccca4fc4b0771e11b5c3a8a5d8

SHA256
83a124ce2d1afe26d57d36c400658df87433dbebf939bab3402a235b45c86eee

SHA512
d612745f6a35d2a5a52d740bebff780f731b83910d37500b7ac5aae70a5f7779739ae41da06c973ae5bc16bcc436d534c597b3373177cd56efb214ecc8b31064

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
29cea8fa3e396a8c289a8003f5723089

SHA1
9bf5caeec84de0a29f1ba561934b9613fc679214

SHA256
9204195bdfa5c2bee2e72eb4190c7e93fc2d3792c641814144e4f23fed9c5fc0

SHA512
819226799ed9331ef70bf756a3b4c33c4a8aab679069faa184b39b2318c2b0b8a4b67aba56d6e7b1e8bacfc2a4c12c433f763c45fe37c6aab27fc3efd3659769

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
56496d2faef7af4f6cf1ba4c3aa5cc4a

SHA1
756e480251ec12aaaf3260dc2c3556c8951ceea5

SHA256
b7c72981c65eba0ff26080fc3bb6e8c4e4c4e2f71421837fa350be848412e279

SHA512
b48e9ba18770f9dfec64b94b4fd77db92be08a70b654396ee3c0bc70e5043b408d3a72a9857eb05475cc60a0238318d43e675e0ff1ca975efe1bab2ce63ade7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
7c2ccfc6e13a7d833d3c33c398368b40

SHA1
cdd0223892a918126a7ab05dcc0b543ac73ae8d1

SHA256
c5cdb9a81364cce04ed39ef13afc6749f8997ed6ae8450081a51134b634ca980

SHA512
8ef8975b1b5eddc45f3af8a7d5a4b7308c3d634ad300ee355feccac75c4df4ba096877ea6fca66180899e96f6e37d0aa24b6acf299112663fe9f6c20bc27fde0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
56d7d6419ec9427e0ed6cd46a5ddd330

SHA1
6b097fff2c3a1881842a5bbc26fc5565e5deecc7

SHA256
4fcb5941f1cc083781458c8b2d9787f49c26d9db099b6d2f70cce431f527a339

SHA512
ad67507d1b785cee3eeb3bf69d9e1c030325779582f28ccc7fe5b2a050788d8be63bae250a0bbbabe31132d80af5f86a89d171cc180c6b27ac15319dcc183cda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
87b0aa90a21e77f5e50ee7a78a3f23c7

SHA1
9105c870ab25ac821cfc2becdbf1dcdd37306652

SHA256
cfffbbf8445f905f3e7b98783c4b29e9148ab424720d2e64943ac5795b900e32

SHA512
6a387d204072ce5d2aabd8eb47b9deab887b4787980a37bfd9368e9ef7e997d027c0607dcd3746951aa790810acb6f71a1a1036c52c79575a1f015399c4ae910

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9e7b5d433fc96cd230a2bcb2da6374e9

SHA1
61dc95bb2eed2233cadb785585c8d32769d3aec4

SHA256
fed9178f137d1fd9f54b612ffe8264c7008dbd71464614e689ea8023f73921ad

SHA512
5625e5ea7b453b97aa55a2b15b5880f1682a485ffcec33a5bdfddac53539f85f67a136fd408e46f4886bd5a5e4ab675e298fd7b721532cea0b32818b98abdd68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9fc0ad551a53fc03bd53e0f41e0c9447

SHA1
20fac6b39c5d24c2fd22e75fecaf7ffe72302a5b

SHA256
c9d2b160fa65cdcccae2622650cfd030927eb8483f2dfdfcf5347d35c4882dc0

SHA512
ac797b887a0c96e1c1f714482cb9a02199b90c5f6d7a9efa5120ebc926b3cd137cfb4e3fdb87367902966ec9dbb39232a61026c2f577cb37f4427d5219f321f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8d7922e3ebbc44eb51d85ea9826e4c94

SHA1
2b3ab97370d30595ab47fabde17c873e777d4e09

SHA256
e9fee8d7cdb82e1dc44ceca729d0755ecede9ca198576fc373bcd4284a3de600

SHA512
0bf8a472866e9c5aa13cf4b71c218e00a6ca2d6d76e545cc9829ac42024eb82cd2eee199b7ea3ef499f8e1d603426ae911b1a3e89a63ec7fcd71763919fc5630

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d886575b312a40c30919822683b19a22

SHA1
0f59db91dc93943629d38eff0731ba4898490e5f

SHA256
10d2efebc0539dbabe3349716668d86600dd36323937241ed176f56a2099b011

SHA512
e8d40fb29173fbb54beeefb1295c1dbfb366de42f5e6879b62421d8b7b4d87b412a4171e874d530483517fc9945dd9ef263d8d79048be50752ed9bf86abca4c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
21ab861edc99f9bb4b12d16a2ee50025

SHA1
1b5d2a8bceb69969ba16a2cae5f42b84b89064ab

SHA256
87817b7904756761fe0b6e1fea769f48e6ad08e12cce177ab9a401c80f546a1f

SHA512
c756a35b7af70dad5d195c062ce4cf6013f691d3192b4ac4f1ca501d326df92eb48c52bf4a62bc2902526ad7f5b1a3c08b405dfc66982ed23eb4832f37385fca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f8c995ea67d5fc54e6ef50eb1975daa0

SHA1
5d9ecda4874e58ff4babf7bd2619535690ee3e73

SHA256
49f42de48d34c7aaab67ce0f57f95b7445487a91df8e0bd9e5e94dd54f105a72

SHA512
2ea2f9596431dc9147b3d16c8b9c08116eebc21227d68fb8deb8399bc158061aa7e6ab8733aaf3302faf09faaf58dc7d5251d4a4363b721a55757a746a50ddb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
779a80accb13ab05491d23c880cc37bc

SHA1
92383fa13759edbcd38f63a83c405b55e12c8111

SHA256
794982d5b674bb36c0c3fcd48b42b85af05414b4c54b21571609efcb73d30b97

SHA512
0f3c947221517eed697385897823070de17a183abb6e396184ab5648be491bedf7c6c797918e1bce043a34ce20ecbb111b0b948bddf6bdb74923962e048dcbfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8f25c244d71cbaae9a4739b725b20908

SHA1
90a8e54e194d0a2cd095a5e42a19838c77e7305a

SHA256
68efd195711330a1c036d1a944cc6d79780205115082a0b454568fd5161013e1

SHA512
adf103953ce2416168879724a1386b5cbc82f6fc3448968c4d7b7d829616a10ca81116715096d13280bc36891bbfc0c13807a6353ff0255ae26ce4c2672ce97f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
5cedba8a21667bae18890418f4943aa8

SHA1
f7a3b29eba6c0e5c15267462c96d1f731c649214

SHA256
3d0ad57238f47db010c9e4d14629ed4d93b47a2d0bcd3870a7f4d34104407f17

SHA512
e83200dc7e7d09d17f8e99e9f337ff9b443932388146529afa6aa31b3747c11294802dfa294ee4720be5f2eeaf2b833605ab7dc19d716894522efe119e4d02b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
158KB

MD5
000f9e66e1ce082907b99fba665204d8

SHA1
f0b731a9db203b088d3e6baaa0087e150cb56575

SHA256
67d183df28c9a27f9d552986d59e0193d9a2e8c1837c85d76dc37f85b5762709

SHA512
ca511e2045557be9b67c7b94a8e733869c60e26567893f19c69567a2eada5260f119742adc428194e57ba86ef96b3d750c68ca5d9d5b3b58cf24f55ed97499b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
158KB

MD5
a02e5127263f6a1a64a409bf8fd52d8a

SHA1
4fa37e12a37bdcf709f853e56fe6905afd086bab

SHA256
78275de4adcb7f0ba66cff5e3b9420cac98b15466232855bf5f0746950f6457f

SHA512
4df054c838fdc0ddb544c8b0f80ea1d2ffdb0390626250b55034ce1259efea32f293c6fe780d45341b30ce164ca5177e8716982d079b894e0370b7d8897d4e6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
158KB

MD5
f36a523db3ac31df2600bf59dd2e8f12

SHA1
b248da0ee8abcc1d4761f970e1a74a0ad6ce3d4a

SHA256
c774ccaf2fc67d2cc7f6bc3835b928404d3f550d8cf64ae333b5788222d6f138

SHA512
9cf62f3cc8b95ff8d8abf6b7b13325276b131e0388d41c70311b9e9fedee87d078d62c304b7eb5e9a2abde804b3ab0ebdb31debe3a666053e8ee8f226d063d81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
158KB

MD5
c8702059e533a3e8cb20ab087bf7d41f

SHA1
3ea5f929d4b4bad5ddb70b11e6e52c1ec1ed3f6b

SHA256
60799e741b80fa52f1c01f752dd48f90385c8df88e0f176a3453e3ab3fdc162f

SHA512
6728ff5e4dcff5c2cbc52ad1e8250b3dad5ef13cf98f37d893787c73a1c58ee5cc301655af3a47eb9b7e7145a45b53ac2d3c31c6c29250d32cd83d984a9ff935

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
112KB

MD5
642fd182ecaf8cf4f372ef8dd93af5c6

SHA1
38519cfbabd2178948021cfc1963c79451127b61

SHA256
1f0aa82e7012883a98ebb0627101302e6467dd7be0f9af8a870e4718ce49541d

SHA512
ef913f79340d2003debf63b3d16a43d9c192cea5cb48cd36e4f0147b1439bbd257c00722110990febb31be34bee137ea68974a80626dc45c5a819365aae20011

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe56f031.TMP

Filesize
110KB

MD5
7629b5f271b81b81e95a2c2e100212f3

SHA1
3b84362be94d41d319392282368ca32e5ff93d12

SHA256
20a96804dfa7c93cc899ad09ecf747c422853804563f06af3761956746c90c81

SHA512
4422025189d58e89596882d2ee522f3fe7aa11dfc7fd5b9a9e16d731f833c47d49a41c762b25303792b26724a2051daebbbb53899503261d2262c7998e5bf53e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
56KB

MD5
b4a0619870ce78516d1a63d51b0b746f

SHA1
8ab475836c76c590b58767071e0aa58bcdcc3306

SHA256
b0db1f925874d11b7cffa540ca1f972cc2bd9e4ed1b4ec1c59ac6b8321d4571c

SHA512
6f8a7d7c81665f0277b3069139faaa854311be2d1857f2cf9184223110c06bf9d372ac1b551f3ef5f348091cb3783c3ed4df55da9adfd0cf38d60f00e91376ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
af3d853d5329239ddb1b1f9a7214d401

SHA1
2e30c7a1fae62dcd2af59235b212dc279287e6f8

SHA256
423054f7e488dd0e80de4b11235e93ef6dae8a1502d5bab3d2dbe9448812eeef

SHA512
d230dbc8e9a26e0167b77e148ab351f420a89109586f2aebcb9bcd8cd694beeb8f00741d2e6ac0479e440751d0a97660393ed2531a3f9ddb0e88110e7f475a53

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\Rotsprite (1).7z

Filesize
42KB

MD5
6b61e19848d05d3bffbd8f84191d71be

SHA1
7fbfc8c7864885a1ccfc59ec219aa74d2bd639dd

SHA256
b0ede8affc4ddcb88855edf89a5b5f3382b5ba9dff4c2cd98570c6145b593623

SHA512
6ecb4807e3ea1080bad2d5193a02bc4bf138293908f22dee3871e2864f38da12d944455d119bf3d37a6a5217c2586ba4c1a13016f436698f6d4e56942a73a4f2

Download Submit
C:\Users\Admin\Downloads\Rotsprite (2).7z

Filesize
42KB

MD5
6b61e19848d05d3bffbd8f84191d71be

SHA1
7fbfc8c7864885a1ccfc59ec219aa74d2bd639dd

SHA256
b0ede8affc4ddcb88855edf89a5b5f3382b5ba9dff4c2cd98570c6145b593623

SHA512
6ecb4807e3ea1080bad2d5193a02bc4bf138293908f22dee3871e2864f38da12d944455d119bf3d37a6a5217c2586ba4c1a13016f436698f6d4e56942a73a4f2

Download Submit
C:\Users\Admin\Downloads\Rotsprite.7z

Filesize
42KB

MD5
6b61e19848d05d3bffbd8f84191d71be

SHA1
7fbfc8c7864885a1ccfc59ec219aa74d2bd639dd

SHA256
b0ede8affc4ddcb88855edf89a5b5f3382b5ba9dff4c2cd98570c6145b593623

SHA512
6ecb4807e3ea1080bad2d5193a02bc4bf138293908f22dee3871e2864f38da12d944455d119bf3d37a6a5217c2586ba4c1a13016f436698f6d4e56942a73a4f2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 669162.crdownload

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
\Program Files\7-Zip\7-zip.dll

Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
\Program Files\7-Zip\7-zip.dll

Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
\Program Files\WinRAR\RarExt.dll

Filesize
664KB

MD5
608f972a89e2d43b4c55e4e72483cfd5

SHA1
1b58762a3ae9ba9647d879819d1364e787cb3730

SHA256
dd989631b1b4f5450766ad42aec9a0e16718a0d23bc694fa238a4d54b02be417

SHA512
3c410d19aaa780e4fe25b331f85bdd8ccd0a9f585d538afdf216dfcd5c3a6ee911924bcca9078af689c4610f23a31e5a89c7c84144356e8dedceac7fb020960a

Download Submit