hxxps://drive[.]google[.]com/uc?id=1br31_joVUJFoOuh_TDJLp45EGzCF-Nh5&export=download&confirm=t

Analysis

max time kernel
99s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-08-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1br31_joVUJFoOuh_TDJLp45EGzCF-Nh5&export=download&confirm=t

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3744	F-M-Е_v2.exe
2364	u0Y4ZfNbjZ4PNDNB5.exe
4720	AutoHotkey.exe
1924	AutoHotkey.exe
2536	file.exe
1224	file.exe

Loads dropped DLL 2 IoCs

pid	Process
1924	AutoHotkey.exe
1924	AutoHotkey.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	raw.githubusercontent.com
6	drive.google.com
7	drive.google.com
17	raw.githubusercontent.com
19	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1836	tasklist.exe
3524	tasklist.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\F-M-Е_v2.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u0Y4ZfNbjZ4PNDNB5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F-M-Е_v2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	AutoHotkey.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	AutoHotkey.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	AutoHotkey.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AutoHotkey.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	AutoHotkey.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.22000.1\"hypervisor=\"No Hypervisor (No SLAT)\""	AutoHotkey.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AutoHotkey.exe = "0"	AutoHotkey.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\GPU	AutoHotkey.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main	AutoHotkey.exe
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	AutoHotkey.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\AutoHotkey.exe = "1"	AutoHotkey.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AutoHotkey.exe = "11000"	AutoHotkey.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 161490.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\F-M-Е_v2.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
420	msedge.exe
420	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
2796	msedge.exe
2796	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	AutoHotkey.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2076	WMIC.exe
Token: SeSecurityPrivilege	2076	WMIC.exe
Token: SeTakeOwnershipPrivilege	2076	WMIC.exe
Token: SeLoadDriverPrivilege	2076	WMIC.exe
Token: SeSystemProfilePrivilege	2076	WMIC.exe
Token: SeSystemtimePrivilege	2076	WMIC.exe
Token: SeProfSingleProcessPrivilege	2076	WMIC.exe
Token: SeIncBasePriorityPrivilege	2076	WMIC.exe
Token: SeCreatePagefilePrivilege	2076	WMIC.exe
Token: SeBackupPrivilege	2076	WMIC.exe
Token: SeRestorePrivilege	2076	WMIC.exe
Token: SeShutdownPrivilege	2076	WMIC.exe
Token: SeDebugPrivilege	2076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2076	WMIC.exe
Token: SeRemoteShutdownPrivilege	2076	WMIC.exe
Token: SeUndockPrivilege	2076	WMIC.exe
Token: SeManageVolumePrivilege	2076	WMIC.exe
Token: 33	2076	WMIC.exe
Token: 34	2076	WMIC.exe
Token: 35	2076	WMIC.exe
Token: 36	2076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2076	WMIC.exe
Token: SeSecurityPrivilege	2076	WMIC.exe
Token: SeTakeOwnershipPrivilege	2076	WMIC.exe
Token: SeLoadDriverPrivilege	2076	WMIC.exe
Token: SeSystemProfilePrivilege	2076	WMIC.exe
Token: SeSystemtimePrivilege	2076	WMIC.exe
Token: SeProfSingleProcessPrivilege	2076	WMIC.exe
Token: SeIncBasePriorityPrivilege	2076	WMIC.exe
Token: SeCreatePagefilePrivilege	2076	WMIC.exe
Token: SeBackupPrivilege	2076	WMIC.exe
Token: SeRestorePrivilege	2076	WMIC.exe
Token: SeShutdownPrivilege	2076	WMIC.exe
Token: SeDebugPrivilege	2076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2076	WMIC.exe
Token: SeRemoteShutdownPrivilege	2076	WMIC.exe
Token: SeUndockPrivilege	2076	WMIC.exe
Token: SeManageVolumePrivilege	2076	WMIC.exe
Token: 33	2076	WMIC.exe
Token: 34	2076	WMIC.exe
Token: 35	2076	WMIC.exe
Token: 36	2076	WMIC.exe
Token: SeDebugPrivilege	3524	tasklist.exe
Token: SeRestorePrivilege	2364	u0Y4ZfNbjZ4PNDNB5.exe
Token: 35	2364	u0Y4ZfNbjZ4PNDNB5.exe
Token: SeSecurityPrivilege	2364	u0Y4ZfNbjZ4PNDNB5.exe
Token: SeSecurityPrivilege	2364	u0Y4ZfNbjZ4PNDNB5.exe
Token: SeRestorePrivilege	2536	file.exe
Token: 35	2536	file.exe
Token: SeSecurityPrivilege	2536	file.exe
Token: SeSecurityPrivilege	2536	file.exe
Token: SeRestorePrivilege	1224	file.exe
Token: 35	1224	file.exe
Token: SeSecurityPrivilege	1224	file.exe
Token: SeSecurityPrivilege	1224	file.exe
Token: 33	4124	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4124	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
420	msedge.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1924	AutoHotkey.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe
1924	AutoHotkey.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 420 wrote to memory of 1196	420	msedge.exe	80
PID 420 wrote to memory of 1196	420	msedge.exe	80
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 4832	420	msedge.exe	82
PID 420 wrote to memory of 2764	420	msedge.exe	83
PID 420 wrote to memory of 2764	420	msedge.exe	83
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84
PID 420 wrote to memory of 460	420	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=1br31_joVUJFoOuh_TDJLp45EGzCF-Nh5&export=download&confirm=t
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcef7a3cb8,0x7ffcef7a3cc8,0x7ffcef7a3cd8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Users\Admin\Downloads\F-M-Е_v2.exe
  "C:\Users\Admin\Downloads\F-M-Е_v2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS0AE2EEE7\run.bat" x -pZhd2kZSak8js u0Y4ZfNbjZ4PNDNB5 -o. -y AsDxzcDAzSDzdD fkkfk@fkfk@fkkf@@kf fk@fk@fkfk@fkkf@fkf 803683707647033375 RkwCDGP2ah"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
  - - C:\Windows\SysWOW64\mode.com
      mode con: cols=40 lines=3
      4⤵
      System Location Discovery: System Language Discovery
      PID:3060
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq EasyAntiCheat_EOS.exe"
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1836
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "EasyAntiCheat_EOS.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name='cmd.exe' and commandline like '%run.bat%'" get processid
      4⤵
      System Location Discovery: System Language Discovery
      PID:2100
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic process where "name='cmd.exe' and commandline like '%run.bat%'" get processid
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /fi "imagename eq AutoHotkey.exe"
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3524
  - - C:\Windows\SysWOW64\find.exe
      find /i "AutoHotkey.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4772
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy *.* ..\ /Y
      4⤵
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\u0Y4ZfNbjZ4PNDNB5.exe
      u0Y4ZfNbjZ4PNDNB5.exe x -pZhd2kZSak8js u0Y4ZfNbjZ4PNDNB5 -o. -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
      AutoHotkey.exe AsDxzcDAzSDzdD
      4⤵
      Executes dropped EXE
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
        
        "AutoHotkey.exe" /f "\\.\pipe\AHKHNPFNMGA"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\new\file.exe
        
        "C:\Users\Admin\AppData\Local\Temp\new\file.exe" -peWu1Mb8G8OyF1 x "C:\Users\Admin\AppData\Local\Temp\new\file" -o"C:\Users\Admin\AppData\Local\Temp\new" -y
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\new\file.exe
        
        "C:\Users\Admin\AppData\Local\Temp\new\file.exe" -peWu1Mb8G8OyF1 x "C:\Users\Admin\AppData\Local\Temp\new\file" -o"C:\Users\Admin\AppData\Local\Temp\new" -y
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UCzt1XcbZ_Wx245bQzb15FZA
        6⤵
        
        PID:4768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcef7a3cb8,0x7ffcef7a3cc8,0x7ffcef7a3cd8
        7⤵
        
        PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1908,15729426127099616945,9219484461224301823,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:1120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4712

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
4f881e4facc79243f1be94f2c68db9ef

SHA1
9542415aaebe2c2af1cea01d7018960bea9e574a

SHA256
82baf7c5c0dec16918527a10992eeaf8f8379bf63e02bc3fef2251bdbbe23c85

SHA512
30596c0d85e7b752b8a49517a109306a82454e50efc124248240be1faf60705b80b85eb75c813df4d086971ceea87c80f82f4a1e223c3a75cbb13352a8fb3001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
bc80626d402e70cb8644dc3be813b9c8

SHA1
fa40f5b6e33801e9ba6c6f0ca0962741db22f4c9

SHA256
694b2e5559c550c849326425626a05eca0dc71b0b679623bf074aca39b0eed31

SHA512
492ae70b76078fa1096ee6006a89c7826c7869aeeb4895694f64289dbd36baffa6567e5f3e20f4be2ab12de4242b7af514436816ac0bbf0bfdca44b531ee83b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
a1c60b375100e22382ce93d17464988f

SHA1
1fad8fa3a51a4a39c8edaa9e7812961e376bbeb1

SHA256
53f868ffe9ae7ffc773d241706eba5d9b6a2467d467af6cab06a1691036f5f97

SHA512
eaabfdc9c5cbdaefc38bb0e0cb3a118af10f4a22c61e22b82b6c53b94966d535482a12c40ac9ee5b3d916fbc4c4f37dc6e93b72ca94d797464146b02e98b1d8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
796B

MD5
6181d8aa6d5f10a8b606d198481d12ca

SHA1
e8c63952b638b8fa73cc280b0f7441bed7cacd8c

SHA256
6da67bffd231b88243b0a348a05626a5dd8c866b93ca1b0105a56e69c5876513

SHA512
8ce2e88ca82e7f600b8d115dca8b48f6c495649f21388dd18af623a8c924d51c3db005fb0c9e03c3ba597df330d348fd247d1419af98c06bbb9dc9924595d669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81e039da51a988017ff8f61d1dda64c1

SHA1
027bba06b6b188b75d74ed888f2977a23a0bddb7

SHA256
dcc4b6424d65a8b3c5d5cdd8528636dfd41912aa614badb82f4b88ff4af41ba6

SHA512
b69a19e95f8c0ca603d2215041a83bcbf2dbf2179ed2bed07a9f29bdabc69413e6d286dfaea79e65c92c06ff757374fcf3f28383ee8d957ef3d82d7030dc603d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3412146df0d0467d2510f9dffcab0756

SHA1
90f890ce43fa1ce61df6409ad3d28e70802011a1

SHA256
a5b1d582b453c5785e9890f8b35c75e6b8655e6a7161bfb334a554d419d948be

SHA512
81162a90b97aeada0de6236531c66a7911667a55f5eea217b8e004ca4e7f0f0044f7ccc53b4326e3f43c5ccfffaf4e653d4097710d264489d5f417b9aee1be84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d343664dc9ba9c5108139475451ce4d

SHA1
4c89690973db200caeea465e3c24bcad493182a1

SHA256
d54ba57b7e68d7040d40b45f85a59aefc6e5c6dce1420dc929aab6f53b2a3801

SHA512
677419e831ae45f81ce188df1c4b08e1d5158f8d26786ec2567e2d8b06cb47896a5bb637c5d365cd360722784b32096626ba266e8b89b2da982b27a71f77181d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
310d9afee982792187fb845b3eedc0e2

SHA1
f8cdfbcbf8303560441f4b8408dabb8ca19e23d7

SHA256
6c2802a30da5ffad168c861bf8a7a45287002bd4cdfb913cd354bcf4926a945d

SHA512
960dda42c89257185f881616c0909f1a95439a0dfc33b6724451d4784349e89ee3e995bec15b02032d30483704d8cbe73552a6c0e4de238b12c9e83ea7864c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
60de91be0143aabc11592eb5ef78deff

SHA1
0040e259308b94a5428ce61b3f99e662145129e7

SHA256
84c4b88f800853d3b2e579102c517fb6773e5148d273082f75faf6125fbe5950

SHA512
52f44d845fe90b07e88d88f02e0b418107c4f766a2e1de656b0dec49af5a79442c1b509527b36bf96889c819aa150039f963fedb0fe9ddcf421b436744ed97ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
38adb1104af8c8125429b0d19e4e818f

SHA1
d1ef71128dc9b6c6976966d2b709522f26ff5c1f

SHA256
c3cbea90886b1d52f56445db70c0d5087aca75e12a41185d71d1ecb958611184

SHA512
7ecfca01dd83c4ebf45396f329857792dcd9805aed1aaccb92502e8beafa9f081b6aaefe945ac80d046273dc22c64d8d2d069d6cd104cb4d5b044c080f4aa5f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
92e488467c9ca44ae7f3b8e62dd29e3b

SHA1
4e3c76e98b3209ebd4b99396d886e31878aca410

SHA256
dd714f4103aee72a1b202e9c097a253c1bfc153f20d45848ccd6bb24150a5a49

SHA512
802092c09838840bb0f2231ea7a85714c06b5358c32cd6a853026f63b75e599246467a6211863c7cf861492a3ae710db2512a5e34bdbafc719e61536ea791315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
cd87827ea90c2ade11a3134baac2c7f5

SHA1
e25ecfebf736ffe84a1ef83312957a0779d2c9f5

SHA256
dde0315ab4b64632553c1ab023e75cbf803a94fda13ccf680d46c41b55c26740

SHA512
e937c474616d09fb34da1bd7f27cb0a4e2eba976ff595451a93562be817aab213d3b3b1481de7f90af957a07d8a69b8df476b7aa10088b0808dd1d378b60a9a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590640.TMP

Filesize
204B

MD5
d04fe0d7dd7e0f4b3145cb2650d8af10

SHA1
0d168d6a6aac9fc0b765cae2c8a2d2531067efd6

SHA256
ec3e4a80687c435dd2be207c87b4852ae718b91cc0486050c2159155ae8f5aec

SHA512
ec4375bd564961d1ca97bc963ff8be6fbbc1cda55cfea37e7d6fe2448fb2e1f9af9d73c0206b1448e2054a337184fa42044626ed3a030366782ec7d17bde23e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
337b6f74e37fd588afcb4c8211d34108

SHA1
d6735b651c06c36a37213ee8259b1625c7b91d62

SHA256
cb5b3d9aed288fa71cf33061a61144241058b2f2db2314d100bd9947646a6328

SHA512
c3212561ee1198fda7dc0e1712a5d96ebd503bb04417161ee9cbe8790e010d5584687c111d2a1a7e556b679a646fad8991ddae044a845be08981b5cdb3c96fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9354b64c421b1ec54a2f8deebfd841c8

SHA1
d3241b093826089046b2ed4cffda1f44f6865694

SHA256
5e7551b3628042a7167bfde54dd8797b2f1f46e6ce4f7d836915761b3c1e352f

SHA512
990f8cf72d331da626849b8a81266d0ad4228922b8a58120ece2ae6099b4e5eb0cad81ce18c01c448ccdc3314596ed91b659ab233e8d0a608ab8b33fdf33e9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0AE2EEE7\run.bat

Filesize
1KB

MD5
0e18b28ad81adbac6d108969a733307a

SHA1
9abd50146b045a771c8d8afea9524a9c5e74323e

SHA256
69dd02b4cc7526d85c16b786ed3a15f6f1d32171db78edd7ed70cf7538957225

SHA512
00d0c7483636fc41b49b57edabcf0990c490bcde5d36788e650727b0c46ec1b54bb4c0c60ef5a8acc523611c797d3b794191f7b0e5436d7a54ffb65ffa82d90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0AE2EEE7\u0Y4ZfNbjZ4PNDNB5

Filesize
651KB

MD5
141687804936a6fb13aaee0c2a1048d1

SHA1
11cb8bdab3f895c3d55ea8b2f9449ce29ed15d7d

SHA256
4d05125a0439e7557165c41d5ee60f6beac508c16c7a10ae04aacbe6c557cdd0

SHA512
568d0af7c6844fada99690cb6bed27688c042a79217d2799be532806e0c99e8d492e951dd27214cf5af5c08861a37f264618c586ff8b41b1ec69e40693628ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0AE2EEE7\u0Y4ZfNbjZ4PNDNB5.exe

Filesize
571KB

MD5
58fc6de6c4e5d2fda63565d54feb9e75

SHA1
0586248c327d21efb8787e8ea9f553ddc03493ec

SHA256
72c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b

SHA512
e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df

Download Submit
C:\Users\Admin\AppData\Local\Temp\AsDxzcDAzSDzdD

Filesize
38.5MB

MD5
9dfcc32f9b3c4c4189454755893f32ce

SHA1
7de7c51eb46b3c599160596b5def8ec3067b750d

SHA256
1b4122c058b7c92fbff8d89931685dd4a3f33c7840e8f08d1f731c8ab56fe0c1

SHA512
5f4855a7c212d1a9e6bed2e6f8c9bdb99947becfd2ca4d4c6e706f3c08dc69d29e65e07f4c7d8035cf37902886f6d8367805ba19b4423276129e6ddc096714fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe

Filesize
1.3MB

MD5
2d0600fe2b1b3bdc45d833ca32a37fdb

SHA1
e9a7411bfef54050de3b485833556f84cabd6e41

SHA256
effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696

SHA512
9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\1\1

Filesize
3KB

MD5
512cd906c4f2ee99a5ffe6dae90ea71a

SHA1
d0dd01a0a28f6b515063644180ed9ac2426e514f

SHA256
4a52af492d61c65b58116bcbf71059dd53c61d07d01b5e0f09573f4ecfd8bc46

SHA512
b5f44fbe59947c44d418b38e78c8c3650c9d39d73b92748dd757c1e9aeb9d7afbe3bf031541c1223e8a2b6d91994d37eb6b3c3ebf2ed363c3726bb0c6888ccf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\1\data.txt

Filesize
5B

MD5
525c961845ee370f826593c47595ab11

SHA1
4373be5e4fa368ff8c9511b0180f99663ae4b76f

SHA256
ae4ea086f68f3ee8f83f8eb118d1d989caed142732c9e325fd00372cbea451dc

SHA512
e07fe1c4a915d41680a42f106fd6f45effb5c96b469649093096c85ce28fd573941761b867a6e8783b98892f4125f2283f7dadb9e512471f6a180a4e047f7bf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\ChangeLog.json

Filesize
105KB

MD5
58068f3562c97f4847951fd2e62780bf

SHA1
a90040203326421bfa164a15de669b40fcb0ea45

SHA256
eaeacd609f76c8e2d4239240a79e68a237e12533737a663deecc0da9239d651d

SHA512
3393932b1aac4f95f15cf0dd5b706f33f9819e58d412ab5cb959a90615ce64c3d475b39860e405640429b969a993c5d196a36decd04259be5e861b92f3e61d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\Config — копия.json

Filesize
6KB

MD5
9c13e1287cf02c04671f07cb3130d2b7

SHA1
b8a6c9dbc68265ef58099d25855311ad3acb9681

SHA256
b6862210b9e6dabb85f5b1d4728496f02a02c8c3974d8b724d122c9bb1589b49

SHA512
f40f801f92d24fb53d8657772f3295e113897d388178984bd177ccab539cb2b79dcf7b330e48a3b7602734f337141c931386d35e294f446ae25cca2603ddc870

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\CrossHair.png

Filesize
234B

MD5
5708840c1c245bad73dd6ff689bf74e5

SHA1
cedeeca6fa4c2757dfeeda022d2ba33dce752c6f

SHA256
175c1745cec830354ba7b883e1a6fce77e188d402fbdd45060eb6a045b7b4b33

SHA512
ec25e8d371cfd0f1d890bec7447533ae1b7dddbc83afcdb4cb023ffa2432742e8160920a645726d45d639c847602da25637c30239363ed3b3bd59765122bdd58

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\Default.json

Filesize
9KB

MD5
55ee2b51c1bb6614deeb2138541d6c27

SHA1
4bfd0dbc7edffebb47aff60a3a682d88ccbcb618

SHA256
659f3ef2dd3e1cc2fa28eaaaa2cee4e1316c4d35a8a0984102603593f9686b5e

SHA512
cfc070c8a86a6973f4702c9f61a967822da848f4a8926325cf0c85c2a0fbdf468d222eb22ab5c9a93dbc9c58d9255b7f4159f01868c4d30fdcc79dc257b0797b

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\Language.json

Filesize
109KB

MD5
92aedbb75bac8cbeb7fd842857bfe64b

SHA1
5d8b7899c77ce319bcd5778099fe4db4361a880f

SHA256
464d163cbf8da907f83264953189522ea7a07f2e839b6fe1d75e4b3e167dfc7e

SHA512
feaf5a040d3af1fbc7724108cc2266a476a9419d7c09121c9271badc2a033802ca21c56ad21901f433a7c884a52651b1243459c622f0032713c59b96dc971d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\Pro.svg

Filesize
4KB

MD5
528c7edb05d700bc65ab59105e12938b

SHA1
95090c8e4a1e145079ad3a96a6d25f26a1a6165d

SHA256
b2496b7628759b1f61fee470393cb0922e4650a1147818b1fd99c0b5cf9fdb6a

SHA512
839eb0d257bc0bfea35536677a5c4b1d21379b9ac18e46229d7b2730800e495786918152e9adfd47391576d19da97291b0a7d2b5ed5080cbf1cd448108927038

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\background.jpg

Filesize
133KB

MD5
0c4b1730664d42444fdae6c62cf6f6e9

SHA1
bce6c0cae81088bbad4578f68bcfe880024287b9

SHA256
d6d018cb87981e4d69ffac2b135f4e0b54ce3244bb8cb3d54604438fdbd5d52e

SHA512
4c76a912f0bd4448d980736d5ed44c2a55f41aea6f4993a54d776f51dd39b0fdbed0cff5bd7bfd7cc0a99e9ec435f12f05e79ee617bd00ea1ab03257a0cff34a

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\file

Filesize
835KB

MD5
32f3140bc36dd3ed3d848119c2e32342

SHA1
e327675904f0f51de43682457ad70744b6a2ca77

SHA256
22314edd6bd3a5a3d6fc9d99b38767243f3c24584607346255e5ed8981fb0c34

SHA512
a5037f45fc8f9987fd41fc3c5230722ac28be3da63dea7a99cf7a03e902a776d15159ec6535dc73e39d412cb9aa032d16177a2ecae1f8f786b52a44e42b9e9db

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\gs.dll

Filesize
121KB

MD5
74c8c5dae54f226ddfd463d5142178e2

SHA1
728a4d28ecb8c81d25677d7415ee1204afe185e2

SHA256
1a064562544e2b975bd5f4bf9f894798b2dd1f77b7864d9ed52d93bf42174340

SHA512
0c92b23b20a01d1f2a57c90a0598683d5a8c3a52489e41527e56bae246904b289481d500f7b4b656bc727eb7d3ce77a8e8dac8b46608f4244f2f4b76d6a4c535

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\gui.html

Filesize
499KB

MD5
791810c332773c384ac62be4c54bf2a7

SHA1
5b5d4659507fb7c4f52aaa9ae8183dd70957fa9c

SHA256
fe7d3225989df6c65f9853f1eff8c356624b0a35344c759b27e349a304cf8396

SHA512
5e1bc4a6c7159eb81dd186874e5733aec6fd6817ab9da2b1c02ea17ae844f2a95fc250986c6892bbac4548ce649648f8d102b1436070b36f899269094e78d100

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\icon.ico

Filesize
139KB

MD5
38c0279563abc2c70f9f288b616c9770

SHA1
eeeab2f77e4aad904186e3dfe2ec65207ef92604

SHA256
e4a941a51c9fd340ad1612b1bd4040d53e6924d5cbe1224b1e09ce8a7d4b8c19

SHA512
1d0fdb93a143dacfb8a4d1f8b56c6da6f353d3061ae79777d78f5be9b0b8670f089186f66491a0ce10f6ccf489ea4ed531f41879756c700e170ff82807fff564

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\jquery.min.js

Filesize
87KB

MD5
b61aa6e2d68d21b3546b5b418bf0e9c3

SHA1
9c1398f0de4c869dacb1c9ab1a8cc327f5421ff7

SHA256
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b

SHA512
5882735d9a0239c5c63c5c87b81618e3c8dc09d7d743c3444c535b9547b9b65defa509d7804552c581cb84b61dd1225e2add5dca6b120868ec201fa979504f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\script.js

Filesize
16KB

MD5
ac1d20da4d518b1c74e7640233a830eb

SHA1
1b113d00d3908815cf9d9d6b7400c686fa4fa526

SHA256
770dac9889a0a3a42bc995385b692630537d2c46e53ba89737a460f12e6edb9e

SHA512
abfbd1185252388af265d28c7ed4918cbd3558793b9af4d1e631684f20adfc1d3d20eb9c00feda362f2644d26d01c2b3eb5905b150ac6bcc1ec3baba513888bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\style.css

Filesize
16KB

MD5
1261a774b4ec34a92439bd3b509c470d

SHA1
ff7cf9d6a21bd79fa24b461a9c04d3d24607fbe6

SHA256
a16846c4021e8c4fbf2a7ee97dc54ead4bad02ad07c8780ca3a3be38bdd16d28

SHA512
5767b44035653d5cb77635d0ca363c1d3023257569252ba459fd05898e88331b80d89c15440e66cd1350cf0e8c144c7135ef24a809ca8ee81d7eedb1262c27c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\new\swap

Filesize
1.1MB

MD5
3bf06f64e178d8dcf06e25131c0e6d10

SHA1
f6798bbb82581707cef54c2c2aa1fdf6b9578b36

SHA256
7037f6cf83d9164b86c5d614728aea7410ad90971a8aff392d6c62763b0a4d6c

SHA512
7edb72ec103a9f172cb9e35751a126ac3611b17483aade086ff4f25d642c978065cbe947c226b30caac7447bca5295e6233c2ffaed21eb6f8b2c8bcf37e7d56e

Download Submit
C:\Users\Admin\AppData\Roaming\test.txt

Filesize
2B

MD5
23b58def11b45727d3351702515f86af

SHA1
099600a10a944114aac406d136b625fb416dd779

SHA256
6c179f21e6f62b629055d8ab40f454ed02e48b68563913473b857d3638e23b28

SHA512
16b7aa7f7e549ba129c776bb91ce1e692da103271242d44a9bc145cf338450c90132496ead2530f527b1bd7f50544f37e7d27a2d2bbb58099890aa320f40aca9

Download Submit
C:\Users\Admin\Downloads\F-M-Е_v2.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 161490.crdownload

Filesize
1.1MB

MD5
b99568260ae2ec0cdbf00cebcff47cfd

SHA1
e922444349e6a7e90ee62185133c493df6269bcb

SHA256
152d81f75b4405a865d7df2f875365e0d202baf75130c246859d7c499dff2f52

SHA512
375d0bf77c50397f7b03c8b3db1a0a4dddaf837d66a0b11a81696ef9d4e2f62481cfb22224806f84e70293875a5b3305b1b7da87fdb3aaece9097f9bf2e1995c

Download Submit
memory/1924-307-0x0000000014190000-0x0000000014290000-memory.dmp

Filesize
1024KB

Download
memory/1924-355-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/1924-308-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/1924-498-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/1924-311-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/1924-379-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/1924-330-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/1924-739-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download