687998ce267b7952a6df3b0c8841976d381e883fc8522f04c356144d23584635

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Z1RO FORTNITE/Z1RO FREE.exe
Size 803KB
Sample261023-s3bb6acv2v
SHA256 687998ce267b7952a6df3b0c8841976d381e883fc8522f04c356144d23584635
MD5 382a579bb8f65e305fff970ef80f3043
SHA1 684f7b8da73b01f65a123375a8f5d8072cbb15f7
SHA512 0fbf48c981a38e4fd476a0f9f50962c417267fb061e2b6480f258091dc3b6fc23ac15026170b1d251242a819d19162f71db51e7e1697ca2863e660ff42b38d54
SSDEEP 12288:YUES25oMINODUlar2oOnG63i9nIgvdhyC6YLK2eoo:pP25oMINODU0r2od63i9nIgvdh+YW2
TLSH
T17505BF11F7F445A8D17BA13899A2EB1BFB377848072086DF63E405552FA77E08B76322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Drivers\1nkUv23I1.sys	timeless-mapper (1).exe
File created	C:\Windows\System32\Drivers\RgatwZQA.sys	timeless-mapper (1).exe
File created	C:\Windows\System32\Drivers\RgatwZQA1.sys	timeless-mapper (1).exe
File opened for modification	C:\Windows\System32\Drivers\RgatwZQA1.sys	timeless-mapper (1).exe
File created	C:\Windows\System32\Drivers\1nkUv23I.sys	timeless-mapper (1).exe
File created	C:\Windows\System32\Drivers\1nkUv23I1.sys	timeless-mapper (1).exe

Sets service image path in registry 3 TTPs 4 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\1nkUv23I1\ImagePath = "\\??\\C:\\Windows\\System32\\Drivers\\1nkUv23I1.sys"	timeless-mapper (1).exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\1nkUv23I\ImagePath = "\\??\\C:\\Windows\\System32\\Drivers\\1nkUv23I.sys"	timeless-mapper (1).exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RgatwZQA1\ImagePath = "\\??\\C:\\Windows\\System32\\Drivers\\RgatwZQA1.sys"	timeless-mapper (1).exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RgatwZQA\ImagePath = "\\??\\C:\\Windows\\System32\\Drivers\\RgatwZQA.sys"	timeless-mapper (1).exe

Executes dropped EXE 4 IoCs

pid	Process
4472	timeless-mapper (1).exe
4140	Z1RO FREE.exe
2224	timeless-mapper (1).exe
2888	Z1RO FREE.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
49	api.gofile.io
51	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3412	cmd.exe
4784	cmd.exe
2760	cmd.exe
1636	cmd.exe
4896	cmd.exe
940	cmd.exe
2764	cmd.exe
2784	cmd.exe
3984	cmd.exe
820	cmd.exe
1952	cmd.exe
4592	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1160	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
1472	chrome.exe
1472	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4472	timeless-mapper (1).exe
2224	timeless-mapper (1).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe
Token: SeShutdownPrivilege	2400	chrome.exe
Token: SeCreatePagefilePrivilege	2400	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2268	7zG.exe
4420	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe
2400	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4472	timeless-mapper (1).exe
2224	timeless-mapper (1).exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 940	3664	Z1RO FREE.exe	86
PID 3664 wrote to memory of 4592	3664	Z1RO FREE.exe	87
PID 3664 wrote to memory of 2764	3664	Z1RO FREE.exe	88
PID 3664 wrote to memory of 3412	3664	Z1RO FREE.exe	89
PID 2400 wrote to memory of 4188	2400	chrome.exe	99
PID 2400 wrote to memory of 1160	2400	chrome.exe	100
PID 2400 wrote to memory of 1840	2400	chrome.exe	101
PID 2400 wrote to memory of 1840	2400	chrome.exe	101
PID 2400 wrote to memory of 3328	2400	chrome.exe	102
PID 2400 wrote to memory of 3328	2400	chrome.exe	102
PID 2400 wrote to memory of 3984	2400	chrome.exe	103
PID 2400 wrote to memory of 4580	2400	chrome.exe	104
PID 2400 wrote to memory of 3984	2400	chrome.exe	103
PID 2400 wrote to memory of 4580	2400	chrome.exe	104
PID 2400 wrote to memory of 4732	2400	chrome.exe	106
PID 2400 wrote to memory of 4732	2400	chrome.exe	106
PID 2400 wrote to memory of 2240	2400	chrome.exe	107
PID 2400 wrote to memory of 2240	2400	chrome.exe	107
PID 2400 wrote to memory of 2180	2400	chrome.exe	108
PID 2400 wrote to memory of 2180	2400	chrome.exe	108
PID 2400 wrote to memory of 4600	2400	chrome.exe	109
PID 2400 wrote to memory of 1164	2400	chrome.exe	110
PID 2400 wrote to memory of 1164	2400	chrome.exe	110
PID 2400 wrote to memory of 920	2400	chrome.exe	112
PID 2400 wrote to memory of 920	2400	chrome.exe	112
PID 2400 wrote to memory of 3828	2400	chrome.exe	113
PID 2400 wrote to memory of 3828	2400	chrome.exe	113
PID 2400 wrote to memory of 3804	2400	chrome.exe	114
PID 2400 wrote to memory of 3804	2400	chrome.exe	114
PID 2400 wrote to memory of 4660	2400	chrome.exe	115
PID 2400 wrote to memory of 4660	2400	chrome.exe	115
PID 2400 wrote to memory of 1308	2400	chrome.exe	116
PID 2400 wrote to memory of 1308	2400	chrome.exe	116
PID 2400 wrote to memory of 1480	2400	chrome.exe	117
PID 2400 wrote to memory of 1480	2400	chrome.exe	117
PID 2400 wrote to memory of 4136	2400	chrome.exe	120
PID 2400 wrote to memory of 4116	2400	chrome.exe	121
PID 2400 wrote to memory of 3412	2400	chrome.exe	122
PID 2400 wrote to memory of 456	2400	chrome.exe	123
PID 4140 wrote to memory of 4784	4140	Z1RO FREE.exe	131
PID 4140 wrote to memory of 2760	4140	Z1RO FREE.exe	132
PID 4140 wrote to memory of 2784	4140	Z1RO FREE.exe	133
PID 4140 wrote to memory of 3984	4140	Z1RO FREE.exe	134
PID 2400 wrote to memory of 1472	2400	chrome.exe	139
PID 2888 wrote to memory of 820	2888	Z1RO FREE.exe	142
PID 2888 wrote to memory of 1952	2888	Z1RO FREE.exe	143
PID 2888 wrote to memory of 1636	2888	Z1RO FREE.exe	144
PID 2888 wrote to memory of 4896	2888	Z1RO FREE.exe	145

C:\Users\Admin\AppData\Local\Temp\Z1RO FORTNITE\Z1RO FREE.exe
"C:\Users\Admin\AppData\Local\Temp\Z1RO FORTNITE\Z1RO FREE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:3412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff931a1c728,0x7ff931a1c734,0x7ff931a1c740
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,15877780980292704280,12672533121663936530,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1796,i,4812494148461557105,1818368361789117198,262144 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,18056709996478385144,1116322663020267711,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,11165194469096861917,5190947068435549540,2097152 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,4400556963745265777,81433709244709816,2097152 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4364,i,3614820425487864745,10779515420723489712,2097152 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,11401963825598116714,14565657731722551808,2097152 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,11887501106321273887,4682180351716828595,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,10491037993206774812,425329892896166410,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,17910624559044525305,772117485035556483,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,10286431205823556421,14469407131703845227,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,9521869115997261110,8934238338968318246,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5984,i,6953824792198797921,1669058244907105862,2097152 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5800 /prefetch:2
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6032,i,3584305331267902598,17745480497860626461,2097152 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4856,i,15292591462779074433,7488747798349010655,2097152 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6408,i,4416652859397079143,3012688163469192421,2097152 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,13950541252260538531,11230358688059899523,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,9048258506963707107,14946365596191415262,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,5396530129191053670,3429221484911875162,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4488,i,9866238082849715448,3690525410957039258,524288 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5912,i,17063655499233842027,9618851714976520014,262144 --field-trial-handle=2064,i,1743305062803612299,4227038946219944491,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2344

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Z1RO FORTNITE\" -spe -an -ai#7zMap18766:88:7zEvent31932
1⤵
- Suspicious use of FindShellTrayWindow
PID:2268

C:\Users\Admin\Downloads\Z1RO FORTNITE\timeless-mapper (1).exe
"C:\Users\Admin\Downloads\Z1RO FORTNITE\timeless-mapper (1).exe" "C:\Users\Admin\Downloads\Z1RO FORTNITE\nigctl.sys"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:4472

C:\Users\Admin\Downloads\Z1RO FORTNITE\Z1RO FREE.exe
"C:\Users\Admin\Downloads\Z1RO FORTNITE\Z1RO FREE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:3984

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Z1RO FORTNITE\Z1RO FREE.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4420

C:\Users\Admin\Downloads\Z1RO FORTNITE\timeless-mapper (1).exe
"C:\Users\Admin\Downloads\Z1RO FORTNITE\timeless-mapper (1).exe" "C:\Users\Admin\Downloads\Z1RO FORTNITE\nigctl.sys"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:2224

C:\Users\Admin\Downloads\Z1RO FORTNITE\Z1RO FREE.exe
"C:\Users\Admin\Downloads\Z1RO FORTNITE\Z1RO FREE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04658b81-84ba-4ab8-9667-c9be8063a771.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\04658b81-84ba-4ab8-9667-c9be8063a771.tmp
Size 270KB
SHA256 ccf22969819b4a0678a8be226346f3fbee6b6c2b38a27c43856c65b6f14e2aa1
MD5 35ac284c0516232a96b9da850ed811a6
SHA1 04844889aa3efd67ff2999eb028b1048ef224331
SHA512 6bb22c47e29d088a54715db068c3e4afa479c7a0505a69c27b9f67eb37152aa4f506c86ce2fe687945be79daf62b4195ec3f133c9ed913fb392494f22eb9bbd6
SSDEEP 6144:z3ZSirXGcFskOVjHn2h+hFD+7t56OD9ZfSApprz:LxLrsh2hyFSXD9ZfS4N
TLSH
T1494412337D44B56B1D6C28D2F09BE604DEB2EDDAC6CE190AD4414E8BA05BA4D0B73E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fc04cff-773b-4e66-b063-07653e2f33ef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7fc04cff-773b-4e66-b063-07653e2f33ef.tmp
Size 269KB
SHA256 54e855177fbc2f171054616600530ac48aee5bca40e76f5ec298a568b8b8ac09
MD5 23b8635ca8b533c286f405cb5aae397c
SHA1 8f363bfe53194211c70a0823c4da1a4e5c13220f
SHA512 5b237057fb6dba3d7d8516f38a883be7ff544fbc64dc719fef840b0d3f9b60217c041f018272ac3ba32805558ec9ac18ee36bfb9ca738490e97f7684fa29e76d
SSDEEP 6144:NZSirXGcFskOVjHn2h+hFD+7t56OD9ZfSApprz:NxLrsh2hyFSXD9ZfS4N
TLSH
T10F4422327E44B52B1D6C2892F09BE505DEB2EDD9C6CE1907D4824E8AA05BF4D0B73E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81901f77-a9f3-41a6-a519-9069e3fa56a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\81901f77-a9f3-41a6-a519-9069e3fa56a7.tmp
Size 130KB
SHA256 a6bf9bbcc5650cd98eb19f511ad10e6ff9cef50b4e335dfffffd0c32430fd4fc
MD5 edbad4bf06aa7c631901c02058cce539
SHA1 fbf99c4d5690d7902bb721a89c9456d58017c113
SHA512 2bc8663c5890419682220e41fdbc5c42a9464600b4f35f118737b2f7c3e74fdc61d73d978d81a7d22a6a37510f2ee600cc148c5678a15a72ef8fc284fd550ee4
SSDEEP 3072:R+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:R+hFD+7t56OD9ZfSApprr
TLSH
T119D31232AA95D9BBC9BC6541B157A300DD76A8ED41DE3A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

008144fb-bc8a-4bcf-97ee-fc4748d8312b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\008144fb-bc8a-4bcf-97ee-fc4748d8312b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

01685288-59db-4b24-91c5-dea04bcd9674.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\01685288-59db-4b24-91c5-dea04bcd9674.tmp
Size 13KB
SHA256 34511cd78ad4fd4b10dc0ef0b9cc42d8b99fb755db87f3e027cacc8e99c1cdca
MD5 56b166fdab84a787e204f41acc3e2201
SHA1 a5e73240f2f96aa725cda0f3d80ab79aebc6d425
SHA512 97cd8bdcfcdccf70857637360492df8331e4b519011426c91f916575fa0ff3002b071a5d12c7077bb40f91eb631a51d56bb369869fea87c7d685723e7a63291e
SSDEEP 192:ZRHcEcUwCu6Etv7VNDpjPRpj6lDL9QHsb+WNnf3uXLeXuseN50xAa1sVyIsnAUge:ZRHcEwLNZxNXsWw/ue+X2xAaee
TLSH
T18E52D82DAD50793B5CDBD32AFA66BB53E3F5102220942E84E6FD8A2C15E79CC311741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11b34c94-36e2-408d-a69e-5ee067279615.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\11b34c94-36e2-408d-a69e-5ee067279615.tmp
Size 414B
SHA256 a7ce8f5f5ab18a25ae359cc1333f1703a23d4e6d6f59b96042928816a0347af9
MD5 1e050a79fbd85236e577012573a738c8
SHA1 d06c83c269f924f0d50a8408864ed16f23f694e9
SHA512 e377979f2691a25c996b81dd1e8fba18104d0b2547670c52f1a29880aa81e26ca668c89f355a9fad8456253bd197083c2e44cd80a8730fadc72b0e14082fe032
TLSH
T148E02BA5D862EC3719FC475C66248746E76013573652494F3B3C821C4FB062601868DC
MD5 SHA1 SHA512 TLSH

Submit Download

8b8c027c-3e92-462d-b81c-a70e1bcfbd27.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8b8c027c-3e92-462d-b81c-a70e1bcfbd27.tmp
Size 12KB
SHA256 2a64be4d05614735322c9f82be6b4456d8e90555c1e0ff58f1e441e8233e057a
MD5 f161eebf17f0e0ff94119b32b767cd07
SHA1 93bb8590b935664a8282cce57f3f4e432dc1f989
SHA512 76b00c780d7cc6b5a1732d4de0b50a343173fc72312f0036ed9791c8a5b24108095af00d7534ba256762c13839adf91308666b34d6f9cc396d6a3e7eaba7efea
SSDEEP 192:ZRHcccUwCu6Evv7VNDpAPRp26lDL9QHsb+WNnf3uD3XT2R0useN50xAa1FVyIsnH:ZRHccwLnZxUXLWw/a2hX2xAaF8
TLSH
T1CF42C42DAD20B93B5CDBD22AFA66B753D3F5102260952E80E6FD8A2C11E79CC3127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 d3b53ce310be1538125749d6085dc0c75e390451e9d087e52fb2f0251df65c2a
MD5 81dd2f40f13895bb3f2725f427d54485
SHA1 475d8536be92af9aade7ffc98b787fae20d80eb4
SHA512 32faad95a56d0514bd52a12a267cb850e7de816f71aaa5fdaf8ce080efb0029e60a47277f777e83e2c031c3c203b3e8cb60ed4d773ec7f1a7862caea5395fff8
TLSH
T1E8214EA2F0641131F7C063701FC481643AF2FAD048073EEBB1C60BB94A24FD2809828C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2908b05e-246f-4ea0-88fa-fff4d12f1007.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2908b05e-246f-4ea0-88fa-fff4d12f1007.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d3d6ef60-ac7d-4e52-974e-34d06028cfb9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d3d6ef60-ac7d-4e52-974e-34d06028cfb9.tmp
Size 3KB
SHA256 b83afa5f23ee2f72121d4f978e32733c13ac6307999669a1ce662a978b31ee7a
MD5 c1fcdba4b823a491a146d390250096f7
SHA1 074e9adfbceed5c26064e2e60f1fb9aabd0d9880
SHA512 f105bc3a82ced6645cbfba9f8f0a22ba5a1668f932bfe709c180e696d15e9f9d0b804a9a56d2708e1ed47c04525d6530d0f9429f23cca74e3021511ec2e9f6b5
TLSH
T11F5199F7C3E8956D891566F4AA106E1FDE6D0A14432C3D6689D4AE1B53E2872D20034E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 0a1003e38997de6ab8a4d814832168127f74977ca937496dc4dec0f5d4e4a251
MD5 c410933308d156b423572ef6de3b9e4d
SHA1 7f797f6cf0e22009f048345265748d67c39f0641
SHA512 4704d9b997ce9f881baf596a3cce4a17822aa3d78be5a7e5e1c51960a69c68b8110f8221fcad616fc6380d41d1c97835830c8cf0f06bd0f1ef1f7e277386bb61
TLSH
T1D9B0121980415705C85203B011B0149835549F30BA05570ED3F40E31C8352A2801B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 fe8e5048db65547e92e89dfd1dfdfdab53aa18c02f75fdbd0028db32d138a809
MD5 d2e34fbe54c52fa680d4124442d3e21a
SHA1 013ca7240607a88e4fb0f73ddcccbfa09c30a3e1
SHA512 b022b950f1580bd6280309c4f215e4204c11de9b0806765db43519b9f9aac4bd2e03a81afb1b34068e681b11ec5ace7b1ed2eb549b56be66f20042f415203254
TLSH
T12FB002A5C2066252C08603B0A6D796D87574DF25C703123AB3E01A76EE29A7186251E5
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 2476ea2a7fbaf87516cf0934536460b5f55820ec1ee7f49a8de52f7676395042
MD5 b42a1e113f8e0696469a58fd54c2f72e
SHA1 d2001662464d4b71efd07a9320ebdbd90168b70f
SHA512 dd55e4cd6f5c71069de10d696770325667adf80e1f288bf6b349d127478fdd17b0d6731aa2f00b5ee5177a460d9fbcdae046e31ce3396ad8337a953909590060
TLSH
T10BA0022141C1E811DEA15370E07E55C12272681455564347B5F13474899BED18511110
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c0e2d4db-d5ee-4744-90e7-9e1470b4ec26.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c0e2d4db-d5ee-4744-90e7-9e1470b4ec26.tmp
Size 13KB
SHA256 f5645b2719980c8ba28e7ee8e1f4c74f6d636bb0ae021523b3dd0c930087274a
MD5 ab7e5d961a97819018d5b91618a5028e
SHA1 c1eeb23c5e7ddbecfeaef20e4ef9312ed8aaf5e5
SHA512 2a64f145fde24c47a7b6fdce85f692fbb6fcaa9a9433c1bc36a4e063077c985ea321698b8399a31c6a79d30db4cfbe95715b7a129c033fd1b29bcafdd8829fde
SSDEEP 192:ZRHcccUwCu6E9v7VNDpAPRp26lDL9QHsb+WNnf3uD3XT2RguseN50xAa1OVyIsnB:ZRHccwL9ZxUXLWw/a2hX2xAa8e
TLSH
T1CA52C62DAD60793B5CDBD22AFA66BB53E3F5102260D52E80E6FD8A2C11E79CC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9d1a640-d84d-4003-81b9-67bd8009e1a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e9d1a640-d84d-4003-81b9-67bd8009e1a2.tmp
Size 17KB
SHA256 d0079e63e600d9041b44dcb293ef0c9bb10e710737d9e8ea0ee6f3fe0350e6dd
MD5 54cecf450584b2807410f85e9b1fb5ec
SHA1 1f5756e59f0ce4662716decf2bb7b130c4449905
SHA512 51e1d06dab6fad741ce37cb33f2fc2be4e9c98c867d16777e2baa6428eb8e83ce7e8d43ee0f087418ce0e878b28e9e1ada618b592c80367a32d30046ebfbff0f
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3q0HG3tbewj:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pe
TLSH
T1FB72F8677C4C9A770FD4CA8CDC167B4FEDB5025A65EA88A442FB982503D4ACF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f67ed50f-76dd-404e-8ac8-03470abb7d8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f67ed50f-76dd-404e-8ac8-03470abb7d8f.tmp
Size 269KB
SHA256 6c8f45ab09f909d4863d24bb894bbaa59c1547a9d7817f8044c6225fc8477d47
MD5 a9f9b9d7ff86b2450fd204524e60fa32
SHA1 70249bab3745d46b6267461c745383ba9ce6174f
SHA512 af2b6235993838ef0fad132875225e0145288a184487c0f3d67f182a7e60d2fd7fa8c3b6d2569b58219dca5f49438ef4a9151b8fb08f82ed7e6f971ffce14e21
SSDEEP 6144:MZSirXGcFskOVjHn2h+hFD+7t56OD9ZfSApprz:MxLrsh2hyFSXD9ZfS4N
TLSH
T1694422327E44B52B1D6C2892F09BE505DEB2EDD9C6CE1907D4824E8BA05BF4D0B73E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc41dbe7-e50d-49aa-918a-886d361f883c.tmp

Path C:\Users\Admin\AppData\Local\Temp\bc41dbe7-e50d-49aa-918a-886d361f883c.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2400_168438039\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

0e80f649-607e-4fa8-a10f-317b4465c0e7.tmp

Path C:\Users\Admin\Downloads\0e80f649-607e-4fa8-a10f-317b4465c0e7.tmp
Size 16KB
SHA256 71b02c0f46e39c573700ed531c2fbb0a2c45a35caaacc5f0f92ca55bda881668
MD5 53addcf64abc59d5ca0f26c47097d5db
SHA1 c68e71947ab6c0c3d869bc33fc314fc364dd1fce
SHA512 f1b5b4fe8fe07ff489c9f38f0bd56d3ac4468669a685fdd03ff8b9641d67c44f0db99cba022512af6365c8727a305baa47eb738e140ba1329391cbf9595c7336
SSDEEP 384:iKA9pWnt1remkBAOuOt1TMjpLYUxSGX0Tnr:iK5DnOjTMB3x8
TLSH
T12772D0ADDD4796D910B333CE00A79CC728E79D79B0D92B265166FA11EFE600CB38B605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z1RO FORTNITE.rar.crdownload

Path C:\Users\Admin\Downloads\Z1RO FORTNITE.rar.crdownload
Size 457KB
SHA256 bc8a3c6b80442788cc293df7503ea6a4963f8ec8d196a1ad2d3f73479a3364a5
MD5 6fccfe98359a94aa0c5c93864eedae83
SHA1 402528abb57912ea632a029c55e18228300a8c9f
SHA512 96113cccaaac4b3776de3e59aef133a5c5e2e5038acb65052ab2161be71574943ab6b5066122b101b6cf22fd883d41a023796d633db5cc4e08cfddcad808167d
SSDEEP 12288:7ySzb+wcuMoEx9JvlF25IZr4Mui6znVRKTw7BCzAPLmF:+Szb+wP+SSiW6HKE7BPLmF
TLSH
T118A423AAA5D5345429BED9C8D06F3040AD9B4A07FFC93E02D63BAE8C059F11C85F5B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z1RO FREE.exe

Path C:\Users\Admin\Downloads\Z1RO FORTNITE\Z1RO FREE.exe
Size 803KB
SHA256 687998ce267b7952a6df3b0c8841976d381e883fc8522f04c356144d23584635
MD5 382a579bb8f65e305fff970ef80f3043
SHA1 684f7b8da73b01f65a123375a8f5d8072cbb15f7
SHA512 0fbf48c981a38e4fd476a0f9f50962c417267fb061e2b6480f258091dc3b6fc23ac15026170b1d251242a819d19162f71db51e7e1697ca2863e660ff42b38d54
SSDEEP 12288:YUES25oMINODUlar2oOnG63i9nIgvdhyC6YLK2eoo:pP25oMINODU0r2od63i9nIgvdh+YW2
TLSH
T17505BF11F7F445A8D17BA13899A2EB1BFB377848072086DF63E405552FA77E08B76322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigctl.sys

Path C:\Users\Admin\Downloads\Z1RO FORTNITE\nigctl.sys
Size 29KB
SHA256 927893280567a079a910cabb2035d65db67b7937674a354d147a322ee2c4b455
MD5 e290273aeb3cdec4bb19acf46fcfc0b3
SHA1 9c2905b6153ff00a26b355c3f03935d231a7140f
SHA512 42a194c8c5a6ecc4e5cc0f9560979d33d6ccddc5df2c3129fe9e29fbfd8d15cf2db0d413db769cbb7cefe53cc5438a4b41444e9917eafc46f09ed6157de3d103
SSDEEP 768:T2kSiPesXyTEKY16+jxRyO1JijUvfW4YiNSc6G7:CwWsCTbY1hRyojFSc6G7
TLSH
T1FDD25B3651C2B5EEEA6750398373E2CBF96134411326D8EF0AF4EC1E672AC951279C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

timeless-mapper (1).exe

Path C:\Users\Admin\Downloads\Z1RO FORTNITE\timeless-mapper (1).exe
Size 58KB
SHA256 6f73e0c1edb6966caf5be85ab3fc6c61fe2fba47b8118ea99349cbd72c2ae5ac
MD5 be7a4c7e772c3634491dfe6397badb52
SHA1 6e9c16044f019f8aa769bc8aac273c9d93495fa9
SHA512 78c9387e85991b4d803ba68be65e772f74040c396c907e7bd0a6fc6a692a862ada845f6a0fffbb89114823fa5b7e9c5b31e63f223f29ca533372006fad2a2b70
SSDEEP 1536:aYoFXmAZ8KTPLd12YI3H1MjHCPizDoC0VO:hoZzrTPLd12D3H1M7CPizUV
TLSH
T113438E43531004B8D19BD23DC9B38926E6B1B869473257DF86E585B60FB27E03A3EBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download