Overview

overview

10

Static

static

1

setup_kata...5).exe

windows7-x64

10

setup_kata...5).exe

windows10-1703-x64

7

setup_kata...5).exe

windows10-2004-x64

7

setup_kata...5).exe

windows11-21h2-x64

7

Resubmissions

30/08/2026, 23:08

260830-242p6stxfy7

29/08/2026, 00:22

260829-an59wavtcz

29/08/2026, 00:05

260829-ac7nkaed727

05/03/2024, 08:25

240305-kbamjsbc9310

Analysis

  • max time kernel
    1445s
  • max time network
    1805s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 08:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup_katana_zero_1.0.5_(30035).exe
  • Size 175.9MB
  • Sample240305-kbamjsbc93
  • SHA256 bdcebe6b1337d638c2570d9781583fffff590c060afca21ede8493b7174de412
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
danabotbankerdiscoverytrojan

Malware Config

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 18 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_katana_zero_1.0.5_(30035).exe
    "C:\Users\Admin\AppData\Local\Temp\setup_katana_zero_1.0.5_(30035).exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\is-QF9H1.tmp\setup_katana_zero_1.0.5_(30035).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QF9H1.tmp\setup_katana_zero_1.0.5_(30035).tmp" /SL5="$50150,183845417,192512,C:\Users\Admin\AppData\Local\Temp\setup_katana_zero_1.0.5_(30035).exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe
        "C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2188
        • C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe
          "C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{AFC18081-DB6A-4488-ABEC-E1F3311D35EC} {D3C3956B-F9C4-4AB4-9F8C-AB4311EBA241} 2188
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3008
      • C:\GOG Games\Katana ZERO\__redist\ISI\scriptInterpreter.exe
        "C:\GOG Games\Katana ZERO\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Katana ZERO\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Katana ZERO" /productId="1557080015" /buildId="52336036425347663" /versionName="1.0.5" /Language="English" /LANG="english"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Users\Admin\AppData\Local\Temp\is-TRH56.tmp\scriptInterpreter.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-TRH56.tmp\scriptInterpreter.tmp" /SL5="$30198,572759,192000,C:\GOG Games\Katana ZERO\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Katana ZERO\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Katana ZERO" /productId="1557080015" /buildId="52336036425347663" /versionName="1.0.5" /Language="English" /LANG="english"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Windows\SysWOW64\icacls.exe
            "C:\Windows\System32\icacls.exe" "C:\Users\Admin\AppData\Local\Katana_ZERO" /grant Everyone:(OI)(CI)F
            5⤵
            • Modifies file permissions
            PID:1548
      • C:\GOG Games\Katana ZERO\Katana ZERO.exe
        "C:\GOG Games\Katana ZERO\Katana ZERO.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2156
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x568
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:488
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1252
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap18885:72:7zEvent3961 -ad -saa -- "C:\Users\Admin\Desktop\Katana ZERO"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2132
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap24811:72:7zEvent23404 -ad -saa -- "C:\Users\Admin\Desktop\Katana ZERO"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2708
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef57b9758,0x7fef57b9768,0x7fef57b9778
      2⤵
        PID:2792
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:2
        2⤵
          PID:3012
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:8
          2⤵
            PID:1232
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:8
            2⤵
              PID:1552
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2244 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
              2⤵
                PID:2600
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2256 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
                2⤵
                  PID:2416
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:2
                  2⤵
                    PID:2644
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1188 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
                    2⤵
                      PID:1164
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:8
                      2⤵
                        PID:240
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3856 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
                        2⤵
                          PID:2288
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2584 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
                          2⤵
                            PID:2456
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2748 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
                            2⤵
                              PID:2096
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:8
                              2⤵
                              • Drops file in Windows directory
                              • Modifies registry class
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of SetWindowsHookEx
                              PID:2488
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2612 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
                              2⤵
                                PID:2952
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2756 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
                                2⤵
                                  PID:1800
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3944 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:1
                                  2⤵
                                    PID:2088
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 --field-trial-handle=1212,i,3703027298189928938,8409736110854474747,131072 /prefetch:8
                                    2⤵
                                      PID:2216
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:2536

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          Katana ZERO.exe
                                          • Path C:\GOG Games\Katana ZERO\Katana ZERO.exe
                                          • Size 3.1MB
                                          • SHA256 4957ec9e713f3b6d38a968ff16c80133517a9416b963f11575de425b14a88546
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Katana ZERO.exe
                                          • Path C:\GOG Games\Katana ZERO\Katana ZERO.exe
                                          • Size 1.9MB
                                          • SHA256 624cd8188b280dce74e8fc8d8ef167ead0562f597f4a94f8a0c0871f14b30173
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          vcredist_x86.exe
                                          • Path C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe
                                          • Size 6.3MB
                                          • SHA256 97b1ead68084e71a7dce3566cf2c460fff110eeea997d34018744d74f5568b11
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          vcredist_x86.exe
                                          • Path C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe
                                          • Size 7.1MB
                                          • SHA256 549dad0046f8234e43aedc7458afe5870e021c63d2cbf6d8fc01fe28e85e081f
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          vcredist_x86.exe
                                          • Path C:\GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe
                                          • Size 8.1MB
                                          • SHA256 df4e2296be1fb8aa1b2bc8296a913ed6a6b3b53c4a024fbc7d0e4d70cbe00aa2
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          audiogroup1.dat
                                          • Path C:\GOG Games\Katana ZERO\audiogroup1.dat
                                          • Size 3.2MB
                                          • SHA256 4a6b3b9cdd33cb6b9c363aaf6ac225d3d1b22018f296d3b894d9911a05faeb1f
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          audiogroup2.dat
                                          • Path C:\GOG Games\Katana ZERO\audiogroup2.dat
                                          • Size 2.9MB
                                          • SHA256 c46cca150a4b30faf7b629763ef3505abf637a129e60d121aa8605827122c3d6
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          audiogroup3.dat
                                          • Path C:\GOG Games\Katana ZERO\audiogroup3.dat
                                          • Size 2.8MB
                                          • SHA256 11354f5184031efcdd27d8d6e5d8b7a35c527055c7fa74287a9ef127248370bc
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          audiogroup4.dat
                                          • Path C:\GOG Games\Katana ZERO\audiogroup4.dat
                                          • Size 2.9MB
                                          • SHA256 4d85ee0556704fd59f32cabb7c3030b5138532e225a14bdd214e7fc9222245df
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          data.win
                                          • Path C:\GOG Games\Katana ZERO\data.win
                                          • Size 1.7MB
                                          • SHA256 b7a7d48f902ba72e75c075e393cfaf627650fc7a76558f03224bcb4ed6f5612e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          goggame-1557080015.ico
                                          • Path C:\GOG Games\Katana ZERO\goggame-1557080015.ico
                                          • Size 142KB
                                          • SHA256 63d735ce6cea5aceaee0f1eb6ba5ab01208a2e56046e895198fb576d89879757
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          goggame-1557080015.info
                                          • Path C:\GOG Games\Katana ZERO\goggame-1557080015.info
                                          • Size 767B
                                          • SHA256 94dd82645544adce43123cf3f1d741871969c81d4083ba1acc4889b6375d2c98
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          goggame-1557080015.script
                                          • Path C:\GOG Games\Katana ZERO\goggame-1557080015.script
                                          • Size 399B
                                          • SHA256 ed0d0692bf89808121c3bc32b6b4016ce3ba9e6a4d43e199fef802f83cbcf9d0
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          splash.png
                                          • Path C:\GOG Games\Katana ZERO\splash.png
                                          • Size 580KB
                                          • SHA256 0fa299a55845dac43756027498b37319dd17a5f7f1cfd7e603f0b23326b7be95
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          unins000.dat
                                          • Path C:\GOG Games\Katana ZERO\unins000.dat
                                          • Size 368KB
                                          • SHA256 892bc0a41af5a1d2a1a35627ed0235d31e332d148774c8a621c439682b000ac6
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          unins000.msg
                                          • Path C:\GOG Games\Katana ZERO\unins000.msg
                                          • Size 22KB
                                          • SHA256 e43d06ec2b3dbe3d81bcd6b7880d28d074dac54b38646a605cfc5c809939da16
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Katana ZERO.lnk
                                          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com\Katana ZERO\Katana ZERO.lnk
                                          • Size 1KB
                                          • SHA256 a4a65528af8e3afa54d2d9690f89c1fd0252e193c274a692fe5651bc1f7a2a62
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Uninstall Katana ZERO.lnk
                                          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com\Katana ZERO\Uninstall Katana ZERO.lnk
                                          • Size 796B
                                          • SHA256 13274cd9c02ee798c19829fa124f699a7795e430b47e431c8703bbd69993a426
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          f_000015
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
                                          • Size 62KB
                                          • SHA256 72d84e0126277ef39e8ac647c57330904b3aa34f238ae51b671472db6bfcea0c
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          000006.dbtmp
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
                                          • Size 16B
                                          • SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          data_1
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                                          • Size 264KB
                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Network Persistent State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                          • Size 4KB
                                          • SHA256 009babe27f1ec1598a9ea536f1fc3541dae91a4da4e7c57146c44e15f8e4f8fd
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Network Persistent State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                          • Size 4KB
                                          • SHA256 c071ec832ff2448aa530ab4117489fa3d3f483dbfe22d1ede5dc481393c6c6e5
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          TransportSecurity
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                          • Size 359B
                                          • SHA256 126dfb0b232d708adb4a956848ef3ec89391a2a882f54882f4768eba82640519
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                          • Size 5KB
                                          • SHA256 086591d3fd2d0fc766790747819fb0403ce21ffcd442d70195b8a4af4601773c
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                          • Size 5KB
                                          • SHA256 9cedbba23d4de08d061333ecf92615c7a002b0218b28ec8c48ae8de2561e7ffb
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                          • Size 5KB
                                          • SHA256 e2a47a94b184029f665967631cb9aff8110284a2f6197c4a8383701fd661d846
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          000007.dbtmp
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
                                          • Size 16B
                                          • SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          1207658714_english.jpg
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\1207658714_english.jpg
                                          • Size 124KB
                                          • SHA256 8f6df008e27df617376646721d5389139129436c52d68cc64f4ec0f5a2b1805d
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          1439474400_english.jpg
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\1439474400_english.jpg
                                          • Size 176KB
                                          • SHA256 238b1588b7d66ee14cbe0d411bc5cc1fa59591cb2c00c7d52ee75658e8fcf701
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          BigOK.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\BigOK.png
                                          • Size 3KB
                                          • SHA256 59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          EULAAccepted.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\EULAAccepted.png
                                          • Size 2KB
                                          • SHA256 0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          EULAShow.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\EULAShow.png
                                          • Size 1KB
                                          • SHA256 6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          GOG_new.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\GOG_new.png
                                          • Size 3KB
                                          • SHA256 0804b385c1736e009fe8c3b1b14085b9b9abb40ce487360002ab4a8f3505f4e0
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          OpenSans-Regular.ttf
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\OpenSans-Regular.ttf
                                          • Size 212KB
                                          • SHA256 e64e508b2aa2880f907e470c4550980ec4c0694d103a43f36150ac3f93189bee
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          background.jpg
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\background.jpg
                                          • Size 383KB
                                          • SHA256 4bb388de79ab74a81ffdab24b6969d63245fea259043ff3d8da44969f78d03ed
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          btn_md5.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\btn_md5.png
                                          • Size 8KB
                                          • SHA256 b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          error.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\error.png
                                          • Size 726B
                                          • SHA256 142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          error_icon.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\error_icon.png
                                          • Size 1KB
                                          • SHA256 acdf96ee4261fae138e6350a0ad50b367022ed5b908fa168baad92644f566ee8
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          ok.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\ok.png
                                          • Size 1KB
                                          • SHA256 0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          progress_center.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\progress_center.png
                                          • Size 1KB
                                          • SHA256 2b9dae87340e66b67ab1d8247d4a137628e324969f92fe1098f95a7c5bab2f43
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          progress_left.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\progress_left.png
                                          • Size 1KB
                                          • SHA256 85e39d909a7300fa2043ec42818582867b981401264b14fc5408e477ae0b4668
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          progress_right.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\progress_right.png
                                          • Size 1KB
                                          • SHA256 396a3351fe409328782ab138282cf9cec061a5a9540a3506700a620db1f54e7d
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          slideshow.ini
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\slideshow.ini
                                          • Size 261B
                                          • SHA256 3614059e549ae87a8130e785bdcbf88e44754c6d1ab458969fbce119a4eda6cb
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          track_center.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\track_center.png
                                          • Size 1KB
                                          • SHA256 794f9eeca7fd99846968376b76a296c927532cef1271325cbf555caa0d0d5860
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          track_left.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\track_left.png
                                          • Size 1KB
                                          • SHA256 a8340fb5380c922b60ea40043590dba067dcfed6e22636851691df38156a3aa8
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          track_right.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\track_right.png
                                          • Size 1KB
                                          • SHA256 f54cd6e42f2b2bc5cb8a15f6a28f1499abf094a519ebdf39f4c4e167312c9c16
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          scriptInterpreter.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-TRH56.tmp\scriptInterpreter.tmp
                                          • Size 1.3MB
                                          • SHA256 58ad7a547fa9eb89919070abe14cd50c84cf319157a22c887a8995d648e91c0e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          logo.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\logo.png
                                          • Size 1KB
                                          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Katana ZERO.7z
                                          • Path C:\Users\Admin\Desktop\Katana ZERO.7z
                                          • Size 51.0MB
                                          • SHA256 278e1745f74e281e9cda5577fac57328ef8f56435918cc0526f3bd9099de24da
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          dfgdfZERO.7z
                                          • Path C:\Users\Admin\Desktop\dfgdfZERO.7z
                                          • Size 55.9MB
                                          • SHA256 84cc12dd9ec5889a021d1a7cdace2f100f7014926e0b81b8de1c11eb712ae26b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Katana ZERO.lnk
                                          • Path C:\Users\Public\Desktop\Katana ZERO.lnk
                                          • Size 1KB
                                          • SHA256 a211273c5a2542d8aeca146ea133956eb77ecde7b55de6698036bacf082437e4
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Katana ZERO.exe
                                          • Path \GOG Games\Katana ZERO\Katana ZERO.exe
                                          • Size 4.1MB
                                          • SHA256 7bee169b6154c6a239243014a0c2028a09451bbb66f54c36c36f17eb090743f7
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Katana ZERO.exe
                                          • Path \GOG Games\Katana ZERO\Katana ZERO.exe
                                          • Size 4.9MB
                                          • SHA256 146aeebd06751b977cc167ea83f9f851413a21dd4ce6bc82a92837ddc8c0f17b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Katana ZERO.exe
                                          • Path \GOG Games\Katana ZERO\Katana ZERO.exe
                                          • Size 4.1MB
                                          • SHA256 cdb1ae42507a425eeedc32559c84387b13934e8fe8159686b8064e1a5e8f756a
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Katana ZERO.exe
                                          • Path \GOG Games\Katana ZERO\Katana ZERO.exe
                                          • Size 1.6MB
                                          • SHA256 ce814c17da4ec233a4ba52b89ca1c666364e4c496c5419060cbb0d2c8dc5f649
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          scriptinterpreter.exe
                                          • Path \GOG Games\Katana ZERO\__redist\ISI\scriptinterpreter.exe
                                          • Size 1.1MB
                                          • SHA256 b895f6999c4b7ed7eb3f85c17af9167d12017cd1f5ebc8755adeb969ef4b7fb4
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          vcredist_x86.exe
                                          • Path \GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe
                                          • Size 6.5MB
                                          • SHA256 4d3393f378264a42e90d5ec8e32138bbb505ee37fc519b97f1fe0ccb1def1b20
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          vcredist_x86.exe
                                          • Path \GOG Games\Katana ZERO\__redist\MSVC2015\vcredist_x86.exe
                                          • Size 6.5MB
                                          • SHA256 661d0aa5a4b31b58e95f908011855b172613ceb39dd630d2737bbb976b78bced
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          botva2.dll
                                          • Path \Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\botva2.dll
                                          • Size 35KB
                                          • SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          crcdll.dll
                                          • Path \Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\crcdll.dll
                                          • Size 69KB
                                          • SHA256 23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          innocallback.dll
                                          • Path \Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\innocallback.dll
                                          • Size 63KB
                                          • SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          uninstall.dll
                                          • Path \Users\Admin\AppData\Local\Temp\is-JN3FM.tmp\uninstall.dll
                                          • Size 691KB
                                          • SHA256 cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          setup_katana_zero_1.0.5_(30035).tmp
                                          • Path \Users\Admin\AppData\Local\Temp\is-QF9H1.tmp\setup_katana_zero_1.0.5_(30035).tmp
                                          • Size 1.3MB
                                          • SHA256 87c07a864e6608f629d76350d65b6f43b603512ad2c8b2f8a2d3fb97d82d1e8f
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          uninstall.dll
                                          • Path \Users\Admin\AppData\Local\Temp\is-SUK01.tmp\uninstall.dll
                                          • Size 712KB
                                          • SHA256 d88bcf910e7a5ce4d76ca48b263ef226911b455d3a8db80c9fa69aeb2b3898a1
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          wixstdba.dll
                                          • Path \Users\Admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dll
                                          • Size 118KB
                                          • SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          memory/1252-1067-0x0000000140000000-0x00000001405E8000-memory.dmp
                                          Download

                                          memory/1252-1069-0x0000000140000000-0x00000001405E8000-memory.dmp
                                          Download

                                          memory/1252-1068-0x0000000140000000-0x00000001405E8000-memory.dmp
                                          Download

                                          memory/2340-1-0x0000000000B30000-0x0000000000B69000-memory.dmp
                                          Download

                                          memory/2340-1048-0x0000000000B30000-0x0000000000B69000-memory.dmp
                                          Download

                                          memory/2340-136-0x0000000000B30000-0x0000000000B69000-memory.dmp
                                          Download

                                          memory/2364-930-0x0000000000D10000-0x0000000000D49000-memory.dmp
                                          Download

                                          memory/2364-865-0x0000000000D10000-0x0000000000D49000-memory.dmp
                                          Download

                                          memory/2484-535-0x0000000003550000-0x0000000003650000-memory.dmp
                                          Download

                                          memory/2484-138-0x0000000000530000-0x0000000000545000-memory.dmp
                                          Download

                                          memory/2484-914-0x0000000003550000-0x0000000003650000-memory.dmp
                                          Download

                                          memory/2484-8-0x0000000000090000-0x0000000000091000-memory.dmp
                                          Download

                                          memory/2484-742-0x0000000003550000-0x0000000003650000-memory.dmp
                                          Download

                                          memory/2484-614-0x0000000003550000-0x0000000003650000-memory.dmp
                                          Download

                                          memory/2484-877-0x0000000003550000-0x0000000003650000-memory.dmp
                                          Download

                                          memory/2484-146-0x0000000000090000-0x0000000000091000-memory.dmp
                                          Download

                                          memory/2484-140-0x0000000000B70000-0x0000000000B7E000-memory.dmp
                                          Download

                                          memory/2484-896-0x0000000003550000-0x0000000003650000-memory.dmp
                                          Download

                                          memory/2484-139-0x0000000000EE0000-0x0000000000F97000-memory.dmp
                                          Download

                                          memory/2484-137-0x0000000000FB0000-0x0000000001102000-memory.dmp
                                          Download

                                          memory/2484-12-0x0000000000530000-0x0000000000545000-memory.dmp
                                          Download

                                          memory/2484-135-0x00000000005D0000-0x00000000005D1000-memory.dmp
                                          Download

                                          memory/2484-59-0x0000000000B70000-0x0000000000B7E000-memory.dmp
                                          Download

                                          memory/2484-16-0x0000000000EE0000-0x0000000000F97000-memory.dmp
                                          Download

                                          memory/2628-871-0x0000000000090000-0x0000000000091000-memory.dmp
                                          Download

                                          memory/2628-927-0x0000000000230000-0x0000000000231000-memory.dmp
                                          Download