salatstealer | hxxp://disk[.]yandex[.]ru/d/0n-flCGkwzFRDQ

Resubmissions

27/03/2025, 09:39

250327-lmydeszwfz 10

Analysis

max time kernel
528s
max time network
526s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
27/03/2025, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://disk.yandex.ru/d/0n-flCGkwzFRDQ

Score

10^/10

salatstealer credential_access defense_evasion discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Detect SalatStealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/1180-1040-0x0000000000D30000-0x00000000018AD000-memory.dmp	family_salatstealer
behavioral1/memory/5484-1063-0x0000000000140000-0x0000000000CBD000-memory.dmp	family_salatstealer
behavioral1/memory/3080-1075-0x00000000002D0000-0x0000000000E4D000-memory.dmp	family_salatstealer
behavioral1/memory/4784-1183-0x0000000000020000-0x0000000000B9D000-memory.dmp	family_salatstealer
behavioral1/memory/4784-1184-0x0000000000020000-0x0000000000B9D000-memory.dmp	family_salatstealer

Salatstealer family
salatstealer
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Downloads MZ/PE file 3 IoCs

flow	pid	Process
141	5448	chrome.exe
161	5448	chrome.exe
184	5448	chrome.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
3508	winrar-x64-711.exe
4800	winrar-x64-711.exe
5620	winrar-x64-711 (1).exe
4412	7z2409-x64.exe
2264	7zG.exe
4752	Fatality Client.exe
1180	scriptfatality.exe
4784	timeout.exe
5484	timeout.exe
3080	timeout.exe

Loads dropped DLL 3 IoCs

pid	Process
3280	Process not Found
3280	Process not Found
2264	7zG.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5436	tasklist.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001a00000002b3a7-1025.dat	upx
behavioral1/memory/1180-1031-0x0000000000D30000-0x00000000018AD000-memory.dmp	upx
behavioral1/memory/1180-1040-0x0000000000D30000-0x00000000018AD000-memory.dmp	upx
behavioral1/memory/4784-1041-0x0000000000020000-0x0000000000B9D000-memory.dmp	upx
behavioral1/memory/5484-1047-0x0000000000140000-0x0000000000CBD000-memory.dmp	upx
behavioral1/memory/5484-1063-0x0000000000140000-0x0000000000CBD000-memory.dmp	upx
behavioral1/memory/3080-1072-0x00000000002D0000-0x0000000000E4D000-memory.dmp	upx
behavioral1/memory/3080-1075-0x00000000002D0000-0x0000000000E4D000-memory.dmp	upx
behavioral1/memory/4784-1183-0x0000000000020000-0x0000000000B9D000-memory.dmp	upx
behavioral1/memory/4784-1184-0x0000000000020000-0x0000000000B9D000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\timeout.exe	scriptfatality.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\timeout.exe	scriptfatality.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2409-x64.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\timeout.exe	timeout.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-711.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-711 (1).exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scriptfatality.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
3080	timeout.exe
5296	timeout.exe
2680	timeout.exe
4784	timeout.exe
5484	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875419983377762"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\Registry\User\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\NotificationData	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000006d5af393110050524f4752417e310000740009000400efbec55259617b5afb4c2e0000003f0000000000010000000000000000004a0000000000f51b7600500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Fatality Client Update.rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-711.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-711 (1).exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
2532	chrome.exe
2532	chrome.exe
1180	scriptfatality.exe
1180	scriptfatality.exe
1180	scriptfatality.exe
1180	scriptfatality.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
5484	timeout.exe
5484	timeout.exe
4312	powershell.exe
4312	powershell.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4312	powershell.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
3080	timeout.exe
3080	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe
4784	timeout.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5128	OpenWith.exe
3720	OpenWith.exe
5436	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
5128	OpenWith.exe
3508	winrar-x64-711.exe
3508	winrar-x64-711.exe
3508	winrar-x64-711.exe
4800	winrar-x64-711.exe
4800	winrar-x64-711.exe
4800	winrar-x64-711.exe
5620	winrar-x64-711 (1).exe
5620	winrar-x64-711 (1).exe
5620	winrar-x64-711 (1).exe
4412	7z2409-x64.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
3720	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3412	3268	chrome.exe	78
PID 3268 wrote to memory of 3412	3268	chrome.exe	78
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 5448	3268	chrome.exe	79
PID 3268 wrote to memory of 5448	3268	chrome.exe	79
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 1924	3268	chrome.exe	80
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82
PID 3268 wrote to memory of 5872	3268	chrome.exe	82

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://disk.yandex.ru/d/0n-flCGkwzFRDQ
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8ee2dcf8,0x7ffe8ee2dd04,0x7ffe8ee2dd10
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2016,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2356,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2512 /prefetch:13
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4200,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4228 /prefetch:9
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4204,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3156,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3192,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4996,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5484,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5496,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5528,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5708,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5820,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5672,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=740 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5884,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5680,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6236,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6436,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6648,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5336,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4648
- C:\Users\Admin\Downloads\winrar-x64-711.exe
  "C:\Users\Admin\Downloads\winrar-x64-711.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3508
- C:\Users\Admin\Downloads\winrar-x64-711.exe
  "C:\Users\Admin\Downloads\winrar-x64-711.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6948,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=7216,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6788,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4872
- C:\Users\Admin\Downloads\winrar-x64-711 (1).exe
  "C:\Users\Admin\Downloads\winrar-x64-711 (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5076,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=7404,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6180,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7736,i,17464979946093281896,12167895103261058307,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4140
- C:\Users\Admin\Downloads\7z2409-x64.exe
  "C:\Users\Admin\Downloads\7z2409-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4412

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5128

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\fa03a1e6f84d49e1aea970a65eabe9b1 /t 3296 /p 3508
1⤵
PID:1508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3720

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4564

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\874bcad8409e4992a534fea75303883d /t 3172 /p 5620
1⤵
PID:5596

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4b09c947dc224282ba53092df7c33e4c /t 2900 /p 4800
1⤵
PID:1544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5436

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12963:106:7zEvent13956
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264

C:\Users\Admin\Downloads\Fatality Client\Fatality Client.exe
"C:\Users\Admin\Downloads\Fatality Client\Fatality Client.exe"
1⤵
- Executes dropped EXE
PID:4752
- C:\Users\Admin\AppData\Local\Temp\scriptfatality.exe
  "C:\Users\Admin\AppData\Local\Temp\scriptfatality.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- - C:\Program Files (x86)\Mozilla Maintenance Service\timeout.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\timeout.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    - Suspicious behavior: EnumeratesProcesses
    PID:4784
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4312
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\timeout.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\timeout.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      Suspicious behavior: EnumeratesProcesses
      PID:5484
  - - C:\Program Files\Google\Chrome\Application\timeout.exe
      "C:\Program Files\Google\Chrome\Application\timeout.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      Suspicious behavior: EnumeratesProcesses
      PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fatality.bat" "
  2⤵
  PID:5620
- - C:\Windows\system32\mode.com
    mode 119,25
    3⤵
    PID:3332
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2680
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5436
- - C:\Windows\system32\findstr.exe
    findstr /i "cs2.exe"
    3⤵
    PID:480
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5296

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4188

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
88518dec90d627d9d455d8159cf660c5

SHA1
e13c305d35385e5fb7f6d95bb457b944a1d5a2ca

SHA256
f39996ab8eabdffe4f9a22abb1a97665816ec77b64440e0a20a80a41f0810ced

SHA512
7c9d7bd455064d09307d42935c57de687764cf77d3c9ba417c448f4f2c4b87bcd6fea66354dfe80842a2fa3f96c81cc25e8bf77307b4ace1bbe1346cbe68435f

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
1b521598bc7be5bd53e5e663380c08b4

SHA1
9214924e61782a0cdb958c7f16a5ea872864bc08

SHA256
24823f02c39de9057356c7d63bf475dad4eec0d3a3c9c2cdc794fbcf9fae86b6

SHA512
c50f186bc9a3b763f2334748557c420fd0f6bec48bdeecc3a47b51839ba5bd398bf3d2709b356dd2bb979dba1938ca671819f044428a3e376f0517478da9ac03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
38KB

MD5
9436affc97843765a966b3568fa7e5ec

SHA1
7bfda74bb30589c75d718fbc997f18c6d5cc4a0b

SHA256
7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916

SHA512
473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
72KB

MD5
7b85ce6d64312e6f0d8f712897a45a66

SHA1
431224de66f74e70ae5b37a67260b795352861eb

SHA256
03a79fc56e2b58121ca2fe5938be882582ca7c26cc4208ebf777de6220f59fe1

SHA512
b22d7680c82a5a45d0094dc16b0983ff59c5e3e0567d2854be14cde6a56af63729a1c4e041223fe26569e92961c49a80d603136e88d60f8f7b78ca1999b4fb3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024

Filesize
228KB

MD5
7b53acdd79c763604b8f5356825c960c

SHA1
30a57516f6e0c7e7a4c6f6f3cf2301f8f436608d

SHA256
949e1cf21d45f0ed99965541a7efaadf3958fdffb3c57eeff00d1d0d2056fc4d

SHA512
e1ae8f5cd5ea4cacd16e66c3e438c38c4e35209a7ce5117aba01c83de2395c41048ab374948a3e504d907e3b4ac5c5cbe6e9b0a9b5a229c5b0997ed69976bf8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Filesize
197KB

MD5
c8535e48efcced3cc1fe1ff78d28251a

SHA1
962e4d7ff0d8f68e5d8caced19eb636203567784

SHA256
e50247b6afbba4694d5f9e304595922ecff494b237b9a6eac37c2bede5efd964

SHA512
5e4b3ffa9058f3ce4dc4e8c10815f56c221cd8703905c641d6efaeb2a3341478e96bf99b6495759033ce0812d1bfe8cec5a306055fcb0b7b897bb2e1f2319372

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e

Filesize
78KB

MD5
fa758f192c606262af413cb142531efa

SHA1
ad3c8df670bad67791e2d086773d510415b5185c

SHA256
e2acaf8cd71d522ebb37dc44fdc57d07ec64af5d876d44d71a65025f90a5a551

SHA512
84373e09c97291e73254ed2f645d2f30ba68245dffeb673602b4554c59d62bedf908510b3c536b574f8250a512560960497961b15e894611a90e80fc8c9d39b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
528B

MD5
b2fbd68c0c6ce463b6f9e9f79eaefa1f

SHA1
d242ea44ea9e0eaa08695bed1efadd2217616dcb

SHA256
4fa10bf49f65b4e4b6cb71f976f46841ff6dc81b8bafbd40f6841ef2739d0a42

SHA512
528f946acf20582c041e8a806576dda389f7fcff47e7e76f7f309770792e3154cb73f34679cc214beed03f00e7aa5b90ad283f00ac50863b43748a1389377842

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
847d9bd33d3a556ed3446f39a2908946

SHA1
78c51fb7de4e17820d681316f51e2de900111620

SHA256
0787076fc6c1e85405ba0e712e364b1dbf72010ea79940ef5f0931015d6914d1

SHA512
315046fbecc164b1deaf2c0bdfea602e3048a35ae52d117c7afb8ae3897e8618a75a093349b14ebe3af2352831442c5b981aa273059eb27d23b07751bdcb0d2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8592127bf782a7f258c37305fd7a416b

SHA1
3437a435028d5fcf2f590fde14a32f6b573da242

SHA256
8463b6d8a70cd38370cda85bef761b95b370bcd2d1010bd047965d4062a1dc69

SHA512
e50852aa3cb7cd51b64483417c362c48754fc8245d2483a8aa0b3f38dcdc344255f1320c75b0ea26c1ec0bba4c89844fafad3ccd56ac5014658541216ea9f9b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
04f4f982bb772b56126d909cec6039ea

SHA1
dc6aa63ec3c9f54ba8566f6d126dfb028eb9b88c

SHA256
0301278cb18ad705f8b32895f1408d253466044a781fa9e94d19749889c4fb72

SHA512
ca8860faf176741e1fcde2ee8770964bd97fb5a124ad8394bffa558d3730d8568cecaa1ae40decd3d154856ee28d921378d5635f280f0106c4590327356bcae0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
36KB

MD5
24164e4d9e355e906a7427eac0f5174a

SHA1
9d4081280716dd8e9910e9822ac7890da9fec4ee

SHA256
66c2a2eba15923ed000ab8fbd36994452dae3f789c935608931bb7d159dcd911

SHA512
44b101baa257ba33a09e69f80864c8256fb08278ba8408473e7acda11d7a006b636b60c2dbf3cfb53fa39e86a59f558399acada4eb328af319a890ff963d83fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
457000222fb05e4c858ecf746dc618dc

SHA1
27f81ac885738526a022741925992eaf6f03ee35

SHA256
e1e200f3f7975dbac05e62e1b15c18f8fb68a75bd322198d3e49f002c0b3b699

SHA512
699a5e2998a44840d217ae95ce13ac17eb61c1dba22cca16200882ec6231a28500f7e84a9fa81b9537fa26b9835db06098edad9034952b35969905b6e63823ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
65354e7f0d5894b6a7f83632e6d4d94b

SHA1
221b894d9bd9c40bce2f40b7e665ff316b3bae8e

SHA256
3ef3d359a2a4555fbb17bac363e284f96e1d08d0b702dd3e8c6ff9f64cb89213

SHA512
3da71767d42ef644384ed64f1b306e95e5d77d724691eb960aba3f372dcd0d923debac7a026b93bd5e2d1fbd3eb4d5b7a814a6865f08ec4f5181d1e110ef7610

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
4d7351fdcbaa528e992533fd2317a6e6

SHA1
4067ad9fd1b191156eec18fd53a73a362cc2ac74

SHA256
c19c242de72ede7760f074f9051014ccc2553c8ec21a30c9508f502c32c219cb

SHA512
ab4bfdc2b3acbeda615621c256333d791c3bafe3806a64062ae87a1ffda6033b01b4f6c8a4c5174709c33313e8bde7671592e0dfbc8ed167481f033df8398d2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
59cfff1eea85fb2c787fca71c7f11bc7

SHA1
6092d67ac7b37ecf4b2ec329514bcb5cec6fcea9

SHA256
7e53c8a918d7c9e90f2b2ac45177a14dd347e34b74d867bf5f796edba6c5634e

SHA512
fc96f87cafa9a6061c3097852db1bd325361d1c7359bac420adabf3dccf0ee942dd3033c9a53d6dfd02477c38b0e14bb9e4675f11e6590571794bb7a334a3ea4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
b9202320cc1f763604f64b1da3f3a2af

SHA1
0fb96e4a9361f278ddcd2759a84ae3dde6723b7d

SHA256
b40ff0841b617ff5a38afa59b7e35aaa229235db51e36509e7f799aebc35bd76

SHA512
a99667fd4dfda27218e2a9b59a46fec91cd12225a6552d295223417d9d9396205c8e03c332a45e6dc2565e42383e038107c5e99eb0990071eed560fc75e349db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
cfdafca6f80bd029aaedd350756f684c

SHA1
585b451269d04fbeac61e1b2933180a9c05dd0ea

SHA256
29fc0422b7325d5dc53f88fd9a42dce3d22dc49a02da261382e37bb482a4dd41

SHA512
9accb5ec8bfc553ce4747382be9ee92480688f6805b3f07b0c4cedb1fad36747ea6ff7d51aeaed60a83a0a6c28f38e2b2bc77113d611e68ae36b248f0f02e904

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
53a8af45e628ca909bcc200ef5beaab9

SHA1
0421fa2593cda8e42e89a2bf5e1192e85bcacb5a

SHA256
0c2d945651e727c8670f5a439d4a73496cb945e35dc6aabc9885afce9615500e

SHA512
49756dcafc42cf4f4bf526c6269cc990ee5c7fc7704d540f68a58a7b8a9531461af35fe168ea3fcb6fe7a12a290b46454a67cbffe84ebbe72a96d4544551f340

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
8822fdd584cf9d2fa14fc56458db32f6

SHA1
aaebe64b8869c7d931c8638475837c2d6bab6fee

SHA256
5ab921b531e7238235fb4e9d0da0e5dc46f65dd54143ff5691df407f3916e48a

SHA512
247db649c5dc579c8627dc7ae3737a81f680d83d15eadcc5ac0be71adbc543321e3143fc646e2c7321122f5c536fcade897b20b93fae2135900f25585817b896

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
e62be545d098f8be04f999a81f357dde

SHA1
47353749f80dddccb4861d15aa65741e331a750c

SHA256
90ca989a2f7fc36f038e2132babd221fdeddae9ce0a1c52f662b6964a3f87ec9

SHA512
b1c6a498ba3a57aa381876b30f84f649086db03ca572e11372923d8dc7dc15e209e46e7803493ea1c575d2e4b206bd4025c3d3de70e73d3d8eccf2c157f3c91e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
02c2445fc32d5ac93e8af65a60e26f94

SHA1
96c737fc7f505d8d0ad98d0506e7bba23e33d257

SHA256
6e25c2024e997a96daf7449dbe307c804e5abc801b1105af2af6a0e4448339cd

SHA512
1c55761cca4bc604593365ad0fc005677274c56b6169c1837caac2982a86829d2ed6a82609d6936a5e59222ad2f7d2c6d289c931a3eed2ef1e27bcdba53e9bac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b58b1ef9194348365214b511dac7594c

SHA1
82ca6c32408c1706ceb733695dae1550376781cd

SHA256
6956b01b5c6863a116badc25840440a6d4a762961c8e77bb7339f06340ddf4fc

SHA512
ecf3cab4e3bb07cb5c16071a938aa1cc19af9997212518a10864bd4d883ed2a40562def389bfbe76166fc8d7014553538c81e12750cd6fbfdaf3af25bca12831

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3825bc17e7024997a51554647ddbc344

SHA1
2c2e002bea974045373b5604095cd72c5a85f853

SHA256
3dce23e32b44f5fd2ad46bf49f49dfd561afd71728bca98557fb72bc1551487f

SHA512
fa41efa31ec068ade1dab54f98bee304e5ab8776f727bfd1c29645dc77f06baf0c1a24912f19a14e5ad05718bef0892bbca4e7bf0d5397613148d6c921e3a297

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57cbac.TMP

Filesize
48B

MD5
bd50347637f1bf13544164d20615da5c

SHA1
0cf876869d2b422d8939f73056740ba91539b1d7

SHA256
50d318aa325ed02ee3471cbdd485380f79e2c41e93d99cd3393b5d8e51f84a1b

SHA512
bc24448be76b5b844cb6c5242fc49934398698577a98cd147a62340f7014860b294b7d7db25840ec53de61a62eb2224878df8447bd37131d3f4b3316ff8e4d7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
130KB

MD5
24da3cc63ca2d0c40c631a9e06f70ddc

SHA1
746b7bc685bb35dfe58954d5e7f4671da6b3ae75

SHA256
ef3b10a29cc9dc998b12314ff222c7e60af87ecfcb0b3b974be5181a1d698a16

SHA512
e1275b2fd00d0733c20d1b2fe923befa147905dcd640ef468df0dd1cc9927eadfd154c7b6a5903c16fb276c8ccaa6bfff795b05a1971794260e5bf8eb105b69d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt

Filesize
76B

MD5
46cb7641be727eb4f17aff2342ae9017

SHA1
683a8d93c63cfa0ccbf444a20b42ae06e2c4b54d

SHA256
944fff1dd6764143550534f747243ef7d84fdac0642c94135ab40f584520f63e

SHA512
dc1b5f363e90abff5c1663a82764296922c842820d2819805e87da6da1081f1b5f2d8debc83ac34a26ce289b7b22588b022433686b19b039074ae184968b9fda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5db48d.TMP

Filesize
140B

MD5
33155973021d696c0835a7d797b37b88

SHA1
836682eef97130a0b9ab97a694b47fca8996476f

SHA256
e67399b5057d114478bcba2fd44908db07ff951866f66db00b68d5efad1efc9f

SHA512
e3ec08f4f7bd890e611ebc9f27bb1204c822a1850a70d0ace5fdd4f3a78c5f5ca167116c6578b99dcd8a525ce4b9db8f23529d4c49c6d4c40e041810ec11f15d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

Filesize
106B

MD5
de9ef0c5bcc012a3a1131988dee272d8

SHA1
fa9ccbdc969ac9e1474fce773234b28d50951cd8

SHA256
3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590

SHA512
cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
8527c980373b0070495c797293006487

SHA1
3b859e511d4bee2efb16efa12e168c1cfcb09e85

SHA256
52fe47fb5c0a31743198f116e46154074124b1198c16b114ee01600e70d5b4a8

SHA512
8e5732fab2f045a4925a757298ea86f4edb25abb9647e5e9117519871d865c6dff641d2cd8e13e29fdbfd8a3bffdb8bb2ff253f61b376d4fde81e46ea0c6bf47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
58b0be63c08720e1e0f7a6b5fa29bc13

SHA1
763456c7a1e1164388ef66ce413d2ffd424fcc20

SHA256
99b6ebef40dd13429974c887584ae9ad830bf27e6013c00c159bdd59a01cd45a

SHA512
c574f32769a1fd3877aa965ef7d4f6099a32b5a101e6da86e69c85a4e66dcd6f4d5a7489b2179f5acf3791808eb9b0524fce230d48f0c302b8ebaaf429329521

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
6dd8da45329131ce3c42f6edbc8badec

SHA1
2032740d550392d3c57dbcda40ca89ee3d4d2ae0

SHA256
597a06b0ff94154cf4af039623cc7b99bce2578950826604b778eb2b39c26b2e

SHA512
2cd8b314ad4f7df71c7a85ecae7215e0661713d7f99399a3233785177eba6fe37544bb0a678326ad88101bd2ce399da18e63a8465c49f879493930f470d46288

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
0f7d7e1f23a91c70cac1602646c5904e

SHA1
c492ad398f7cc81f3813b7922d75a466fed16312

SHA256
b855c2438da152b3b57eeddc1dc4bfe3e237528323c19b4ef02272b1b40be850

SHA512
6e545d7b3a4c0b5fd6309147c95b650230b4390d079f5eb0da053182db9c91234f1fda64447dcbcdd0015502ed0d97a385b20a055fdf9dd684bbdb61953519dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
f44e365f923bff6b48f8c550d0af17a2

SHA1
3e35252e8944f98f67fe8d2daea4acfbdace179f

SHA256
5f79b93bda3d29cf32c7523c96e16a1d2dc7fe69ed4c10edb2a98f4ca765a870

SHA512
0c24360d5db06c4e168b89b3e6651b7faf2dda279675f5dd1de030d59e8d864930f69e1e92a8cfe61dfd06487bc60d5298c0c7b96658deb7347f9cc9ad638b80

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\1a7ff2af-1a93-4272-938f-c8f29300b428.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rtgijszp.33g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fatality.bat

Filesize
12KB

MD5
6ff50ee75a873cf561baefa006712466

SHA1
6eac2f3072657515831e552ba88a3c2b033abaae

SHA256
120bdec801cfd630995ffc5495fad36d529cee917192e1631ed9850076355271

SHA512
c0220b40e52b9d480eba609019ebe0feed35f2a9ed98ead28a3a78dfe381f224f343b8b195f86c2257b82ff608b7ed42738b9cb6f495b8d304c2da3078fa9f18

Download Submit
C:\Users\Admin\AppData\Local\Temp\scriptfatality.exe

Filesize
3.1MB

MD5
0c005ae6308f81d5ec3da129a67a2e7e

SHA1
bf1751a53954fd1ddb8b17fbacd279fe553f1062

SHA256
d79d4e96d118bb65c967189983de18e7ce56c492f07bfe1ef9b0cdd3a3980197

SHA512
d5432278e17b90533343c999cf935383ede702160f1ae0f11aba17ebb43a023aad59d4d58ee7c2fc5c2cfb7fba4b64bb0984f20cbd506a0630a17ee836eee522

Download Submit
C:\Users\Admin\Downloads\Fatality Client Update.rar

Filesize
4.3MB

MD5
8bc7e18b2b546eff0ec5c3397f288aca

SHA1
78b19a527d64db3f9f1393e9bc27e2a43b615265

SHA256
332d01c32ea01eabe5c6d73d28245364d46e49cfae810b7345bcd643b7944ef7

SHA512
9cd5fb5d50017769eb28d52f696d7b07a50ec42d11ffc33a5049700afa96156754fa42855f2dac4aa6ec69b80ecb4cca084d190587f06e028aea00b2b883b8dd

Download Submit
C:\Users\Admin\Downloads\Fatality Client Update.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Fatality Client\Fatality Client.exe

Filesize
3.5MB

MD5
2c6fcb192fc5a9a1e2ee249add76064e

SHA1
3237c080368ec126ce2515f6f2e47922ce5a3e90

SHA256
746dd828daf6f1a690ff3c1ec9a601cd6cea626fc2b80a0dda0c68d6075268ff

SHA512
a9faae7438b644aad4a8499612dc39c8fb992acfe9a0c1b13396d486113dc8e376472f01d23102a016fe888f431cc2f5faa38d7e14d659e38ec8bb33aff71fef

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 917555.crdownload

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
C:\Users\Admin\Downloads\winrar-x64-711 (1).exe

Filesize
3.6MB

MD5
f033a919f2f6c705fc986ca56c502e8b

SHA1
b22fb6b92338f9a00777febfd91d689cdeb49a8c

SHA256
4e447dd3a885340845dd89e748a4cb566e19c4da7ae2939f9f26bda067623a25

SHA512
5de7e321f439540febcf2b4ec924f6f2b2d104c3532bf724e24929efc8973488279bb1a8ccedad03534878087495e1cb8af7d7bc0b50bf4f892b034a769ce557

Download Submit
C:\Users\Admin\Downloads\winrar-x64-711 (1).exe:Zone.Identifier

Filesize
75B

MD5
cc0696988fb91d676adc27bf3949786d

SHA1
0561557bebafa161aff436b63f28e213b99d9c5a

SHA256
c95c0ffea82a8baa88cd2ef8b099ab37c1e78f64dcfaee17e22fa4ebda309e08

SHA512
a8316da6329998903726eb1bc4321f2e30458cc63cf1e2246623a44ce58a26ee7f84ce04c40651d36977ed38b55e12d426f86934b5a5340b7e4bfe1e5449e631

Download Submit
C:\Users\Admin\Downloads\winrar-x64-711.exe

Filesize
3.6MB

MD5
12e64891469fce7d79caab048bdbb0e2

SHA1
9578b45d5a9e99cae95be7845681644ae391c836

SHA256
9a266e4fcc51599d067973e962a077972339cd5cdf97ba2b6b8f8da93697905c

SHA512
ea20aadf0ffdbf24f5c3e1f63b00bdf67d5e8d369fd63dd5c5e131ab288f6dc5e68fbcf7a19eafb57dea641cd5aaed58625d7323a7bfdb6b6b1e972b413d6247

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
b931c79a0dbc715bf776a18f9af005af

SHA1
fbbb2883d205995ca8f72858eb6f9182125ab3ff

SHA256
fe8c174c1c887db2038999a303f0fdc79ce7415d3ba1ebba496a68eefe44eb7c

SHA512
732066db7fcd12716a071933f28dae75f55f654a69956e9a9b9ed2f7da198d471cc22fecc70e6cdc9bcacc068fc0f7a55b910c2382ae56797f75d3328098d676

Download Submit
memory/1180-1040-0x0000000000D30000-0x00000000018AD000-memory.dmp

Filesize
11.5MB

Download
memory/1180-1031-0x0000000000D30000-0x00000000018AD000-memory.dmp

Filesize
11.5MB

Download
memory/3080-1075-0x00000000002D0000-0x0000000000E4D000-memory.dmp

Filesize
11.5MB

Download
memory/3080-1072-0x00000000002D0000-0x0000000000E4D000-memory.dmp

Filesize
11.5MB

Download
memory/4312-1065-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download
memory/4312-1151-0x0000000007060000-0x0000000007094000-memory.dmp

Filesize
208KB

Download
memory/4312-1174-0x0000000008460000-0x0000000008A06000-memory.dmp

Filesize
5.6MB

Download
memory/4312-1058-0x0000000005760000-0x0000000005AB7000-memory.dmp

Filesize
3.3MB

Download
memory/4312-1052-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/4312-1073-0x0000000006C30000-0x0000000006C76000-memory.dmp

Filesize
280KB

Download
memory/4312-1051-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/4312-1050-0x0000000004E80000-0x0000000004EA2000-memory.dmp

Filesize
136KB

Download
memory/4312-1049-0x0000000004EE0000-0x000000000550A000-memory.dmp

Filesize
6.2MB

Download
memory/4312-1048-0x0000000004770000-0x00000000047A6000-memory.dmp

Filesize
216KB

Download
memory/4312-1173-0x00000000073F0000-0x0000000007412000-memory.dmp

Filesize
136KB

Download
memory/4312-1152-0x0000000070760000-0x00000000707AC000-memory.dmp

Filesize
304KB

Download
memory/4312-1153-0x0000000070A30000-0x0000000070D87000-memory.dmp

Filesize
3.3MB

Download
memory/4312-1162-0x00000000070A0000-0x00000000070BE000-memory.dmp

Filesize
120KB

Download
memory/4312-1163-0x00000000070C0000-0x0000000007164000-memory.dmp

Filesize
656KB

Download
memory/4312-1064-0x0000000005C40000-0x0000000005C5E000-memory.dmp

Filesize
120KB

Download
memory/4312-1165-0x0000000007200000-0x000000000721A000-memory.dmp

Filesize
104KB

Download
memory/4312-1164-0x0000000007830000-0x0000000007EAA000-memory.dmp

Filesize
6.5MB

Download
memory/4312-1166-0x0000000007250000-0x000000000725A000-memory.dmp

Filesize
40KB

Download
memory/4312-1167-0x0000000007350000-0x00000000073E6000-memory.dmp

Filesize
600KB

Download
memory/4312-1168-0x0000000007280000-0x0000000007291000-memory.dmp

Filesize
68KB

Download
memory/4312-1169-0x00000000072C0000-0x00000000072CE000-memory.dmp

Filesize
56KB

Download
memory/4312-1170-0x00000000072D0000-0x00000000072E5000-memory.dmp

Filesize
84KB

Download
memory/4312-1171-0x0000000007320000-0x000000000733A000-memory.dmp

Filesize
104KB

Download
memory/4312-1172-0x0000000007310000-0x0000000007318000-memory.dmp

Filesize
32KB

Download
memory/4784-1041-0x0000000000020000-0x0000000000B9D000-memory.dmp

Filesize
11.5MB

Download
memory/4784-1183-0x0000000000020000-0x0000000000B9D000-memory.dmp

Filesize
11.5MB

Download
memory/4784-1184-0x0000000000020000-0x0000000000B9D000-memory.dmp

Filesize
11.5MB

Download
memory/5484-1047-0x0000000000140000-0x0000000000CBD000-memory.dmp

Filesize
11.5MB

Download
memory/5484-1063-0x0000000000140000-0x0000000000CBD000-memory.dmp

Filesize
11.5MB

Download