Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    98s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2024, 01:29

General

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 23 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pixeldrain.com/u/suvJ1sfL
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3392
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6c7d46f8,0x7ffc6c7d4708,0x7ffc6c7d4718
      2⤵
        PID:3860
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        2⤵
          PID:4524
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:936
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
          2⤵
            PID:64
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
            2⤵
              PID:3024
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              2⤵
                PID:1228
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 /prefetch:8
                2⤵
                  PID:3248
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3192
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                  2⤵
                    PID:4588
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
                    2⤵
                      PID:3724
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
                      2⤵
                        PID:2728
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
                        2⤵
                          PID:1536
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5736 /prefetch:8
                          2⤵
                            PID:1204
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
                            2⤵
                              PID:4544
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3284
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                              2⤵
                                PID:2796
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                                2⤵
                                  PID:3028
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5480 /prefetch:8
                                  2⤵
                                    PID:2864
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3708 /prefetch:8
                                    2⤵
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2456
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
                                    2⤵
                                      PID:4324
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
                                      2⤵
                                        PID:3248
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                                        2⤵
                                          PID:3028
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
                                          2⤵
                                            PID:1044
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
                                            2⤵
                                              PID:5256
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
                                              2⤵
                                                PID:5536
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
                                                2⤵
                                                  PID:4560
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
                                                  2⤵
                                                    PID:5408
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
                                                    2⤵
                                                      PID:5424
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
                                                      2⤵
                                                        PID:1952
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6120 /prefetch:8
                                                        2⤵
                                                          PID:5892
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1224
                                                        • C:\Users\Admin\Downloads\7z2408-x64.exe
                                                          "C:\Users\Admin\Downloads\7z2408-x64.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1536
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:1
                                                          2⤵
                                                            PID:3248
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
                                                            2⤵
                                                              PID:5912
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
                                                              2⤵
                                                                PID:6008
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16769040603677588346,11660062224823593167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
                                                                2⤵
                                                                  PID:6016
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:2720
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:2072
                                                                  • C:\Windows\system32\OpenWith.exe
                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                    1⤵
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2956
                                                                  • C:\Program Files\7-Zip\7zFM.exe
                                                                    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\Launcher.rar"
                                                                    1⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:4376
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO81185DF8\Start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7zO81185DF8\Start.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • Checks whether UAC is enabled
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5676
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO811C8398\Start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7zO811C8398\Start.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5136
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO81196788\Start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7zO81196788\Start.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3160
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO81117B88\Start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7zO81117B88\Start.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3372
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO8119BC88\Start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7zO8119BC88\Start.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2472
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zO811230B8\Start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7zO811230B8\Start.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2584
                                                                  • C:\Users\Admin\Desktop\Start.exe
                                                                    "C:\Users\Admin\Desktop\Start.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3908
                                                                  • C:\Users\Admin\Desktop\Start.exe
                                                                    "C:\Users\Admin\Desktop\Start.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5340

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Program Files\7-Zip\7-zip.dll

                                                                    Filesize

                                                                    99KB

                                                                    MD5

                                                                    d346530e648e15887ae88ea34c82efc9

                                                                    SHA1

                                                                    5644d95910852e50a4b42375bddfef05f6b3490f

                                                                    SHA256

                                                                    f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

                                                                    SHA512

                                                                    62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

                                                                  • C:\Program Files\7-Zip\7z.dll

                                                                    Filesize

                                                                    1.8MB

                                                                    MD5

                                                                    1143c4905bba16d8cc02c6ba8f37f365

                                                                    SHA1

                                                                    db38ac221275acd087cf87ebad393ef7f6e04656

                                                                    SHA256

                                                                    e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

                                                                    SHA512

                                                                    b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

                                                                  • C:\Program Files\7-Zip\7zFM.exe

                                                                    Filesize

                                                                    963KB

                                                                    MD5

                                                                    004d7851f74f86704152ecaaa147f0ce

                                                                    SHA1

                                                                    45a9765c26eb0b1372cb711120d90b5f111123b3

                                                                    SHA256

                                                                    028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be

                                                                    SHA512

                                                                    16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Start.exe.log

                                                                    Filesize

                                                                    496B

                                                                    MD5

                                                                    5b4789d01bb4d7483b71e1a35bce6a8b

                                                                    SHA1

                                                                    de083f2131c9a763c0d1810c97a38732146cffbf

                                                                    SHA256

                                                                    e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6

                                                                    SHA512

                                                                    357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    9b008261dda31857d68792b46af6dd6d

                                                                    SHA1

                                                                    e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

                                                                    SHA256

                                                                    9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

                                                                    SHA512

                                                                    78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    0446fcdd21b016db1f468971fb82a488

                                                                    SHA1

                                                                    726b91562bb75f80981f381e3c69d7d832c87c9d

                                                                    SHA256

                                                                    62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

                                                                    SHA512

                                                                    1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                    Filesize

                                                                    62KB

                                                                    MD5

                                                                    c3c0eb5e044497577bec91b5970f6d30

                                                                    SHA1

                                                                    d833f81cf21f68d43ba64a6c28892945adc317a6

                                                                    SHA256

                                                                    eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                                                    SHA512

                                                                    83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                                    Filesize

                                                                    19KB

                                                                    MD5

                                                                    2e86a72f4e82614cd4842950d2e0a716

                                                                    SHA1

                                                                    d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                    SHA256

                                                                    c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                    SHA512

                                                                    7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                                    Filesize

                                                                    43KB

                                                                    MD5

                                                                    23130a0e9655030e3489970b4382e32b

                                                                    SHA1

                                                                    6d096822d2fe0f902e3518bd997f9d9d222044c9

                                                                    SHA256

                                                                    bdf7e387b1076ddb95ac57de2e38d1bb329053c2720c0ec16476d0a0aed8c4c7

                                                                    SHA512

                                                                    63f8c625f8a486cf7b1975b39b5db28609e1d1f28c217146c0491fcb7cdc7d29857fa1b568c7ccee7007ad86361ee40a76e101ee2a769af0d77cbf580a3470b4

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                                    Filesize

                                                                    67KB

                                                                    MD5

                                                                    929b1f88aa0b766609e4ca5b9770dc24

                                                                    SHA1

                                                                    c1f16f77e4f4aecc80dadd25ea15ed10936cc901

                                                                    SHA256

                                                                    965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

                                                                    SHA512

                                                                    fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                                                    Filesize

                                                                    65KB

                                                                    MD5

                                                                    56d57bc655526551f217536f19195495

                                                                    SHA1

                                                                    28b430886d1220855a805d78dc5d6414aeee6995

                                                                    SHA256

                                                                    f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                    SHA512

                                                                    7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                                    Filesize

                                                                    88KB

                                                                    MD5

                                                                    b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                    SHA1

                                                                    386ba241790252df01a6a028b3238de2f995a559

                                                                    SHA256

                                                                    b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                    SHA512

                                                                    546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                                    Filesize

                                                                    1.2MB

                                                                    MD5

                                                                    a2f556aa8efbe9b379456aedb2c177f7

                                                                    SHA1

                                                                    74513bcba7bcc951cee7200d2590c46360971712

                                                                    SHA256

                                                                    b30d2339dd4dea59e1da5fe7519212ea0dbe14acd8732a9aaeaba7e11aef9204

                                                                    SHA512

                                                                    d37131846d6f0e253bd290465bf75460b0a1a8502599c177bf16074ca38539644949599cf57d36d2b86ca3e68ddabc40dab0d26f62787a67a1e6da621bdb93bc

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    96B

                                                                    MD5

                                                                    7aecf8101d80e1c82b1662ff0b17d1bc

                                                                    SHA1

                                                                    83cd910db48357fa61d927d5eb40f4b4c592649b

                                                                    SHA256

                                                                    35731cf82ae8d8524c5b08808ee0e58ce7f3ebbdc83208ce4eedf5168e1f57b0

                                                                    SHA512

                                                                    dfdf9cc08c42fbf7a777674861eb75bf5db73510d4de65c5b2833bdaccf8c52b1c7a6115b1c9e5337651848f2645fb3c0f46f222e95311ee7ae5b90a5b6b0f8d

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    30b1353a78b5eca247484eab45df2426

                                                                    SHA1

                                                                    5bf56dfbf2fab65fbce2dd34713c9b4ccc06094e

                                                                    SHA256

                                                                    aeda50557eed299a03da1bc3be0a1c8f768660e8f0fa3f9be552c5e842d06e88

                                                                    SHA512

                                                                    2ffe7e2ba8824e5cf1bb8c91041fc8814d80e9994e52d69a95dc89249df8c55ab94555fc7d9ef53914f408e9a9c99d19bcae6d28674f436db8123c97d9858d02

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    c40d294f414ece4ced6f8e884ebf10f4

                                                                    SHA1

                                                                    3c6270d9351e14569e6a6d6e412efe948aed5cca

                                                                    SHA256

                                                                    1529664abd229a0361bd4ad498a61fca29467b81a769183e93b666465c62f03f

                                                                    SHA512

                                                                    bb97b3ccfcb8e3148f32f8220bc8e32e491d0ca9a697a4c7efe247cd68b7d23f876fb7ef0a4dbc4d1ea45cee1e997b4a2770735b7d91ebb9446115ba5e28356b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    6621c5c4fadc451181438c305519d2c6

                                                                    SHA1

                                                                    672f96c2a22caa9f358d27fffb573c9a2579e18d

                                                                    SHA256

                                                                    a170383b3aefc0b3330701b1efc4fbf5685b3e0485c710da70149585b634da38

                                                                    SHA512

                                                                    c089ca740a8c93f921aeddf9aed5f510fcda3cfbe1ffb249a6611953513c24bc07f7ad21943a7dbf4ced51914034b181809b418812b548b02936b441019f2a31

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    047df4fa4c93648c047d3f2a4a64cbe3

                                                                    SHA1

                                                                    4cb04c94d354ab8e728962bab95faafe155845bf

                                                                    SHA256

                                                                    e2f0d316920b33dd892324400e02d85bc2edbabf4790731a091ecd1693a4f7a6

                                                                    SHA512

                                                                    933f389798665d3a62900d74ea4dc14e64c5307127c1e121764f7803e9c6aaaef16dff4e6533bbbff455b50f319a889ff8d4dbc22cca2dfb65893b60db48a547

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    5KB

                                                                    MD5

                                                                    86ab7094ccecf7f41483020cee0ad300

                                                                    SHA1

                                                                    1dafc685bd2170efd42da20f7b65b7c2ba24aed3

                                                                    SHA256

                                                                    b6b40a0de1b712acb4ec772d8bb8497f414bbad995fa49e1878e2e5f5127b6b2

                                                                    SHA512

                                                                    b35913ccc58784cd8712adc1a420deda0c51a06ab15835d6249861bdb07ba4748a9b43a3e78d55f14f5c85bbf0c9266f3a3e25ffe0716126260837a3beaca7b6

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    4716260a8d9fd3179ceeca178bd38acc

                                                                    SHA1

                                                                    d45d13fcf58701f5054508e2b444b2b673f34aa1

                                                                    SHA256

                                                                    9c8738c3b32ac13422291df968f659c0d6c6b3671f0feb6684c213b63dbdf888

                                                                    SHA512

                                                                    582b849da37c1107731a88c7c568b98a9b9a81db632b83f5f8b266b08a87b51988c27df07d8e32248abb1cf53f044374277403775126912bd0d1307a63e55a9b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    90ce9a5b6b6bf5fb306c9e1a9fe1d20f

                                                                    SHA1

                                                                    a01e8cfcc6cb7e99b589161a576127fa73b9f7ab

                                                                    SHA256

                                                                    122d67dd60e26a97921228c2dec5ef35363d1651199096464a2596c5fea3afcc

                                                                    SHA512

                                                                    136ccac1865e4153d53a48072467671e6ee655e65d5e6cc8fd2246853b3b4caa98aadc87e24bbad7552c0d1a50cd77900af5c3712d1a20c68a852d34b1f5fba9

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    538B

                                                                    MD5

                                                                    406bac1024a06ddb6a98e3df3f550994

                                                                    SHA1

                                                                    c66a3cb7db68d92a94326bfc78838e30096d4596

                                                                    SHA256

                                                                    5cc60f1e2033541bd9e29005e06e50c320f1269763766930d973188fc2edca3c

                                                                    SHA512

                                                                    86dd3897c8b6b32f76d1b2a4e82a884dbdd3241efcbc3c793fc5b32ac271818a8d1fe6b8732c206bfb857b8f8ba561dc47da0eaac76556d1f02c16647ae4a472

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    614b69bb5172ccd1fc5d4e3ac3fa1563

                                                                    SHA1

                                                                    6928375e807ac032440fde34c49e1ad2fd4e4e59

                                                                    SHA256

                                                                    0657c4363b799d8de8b57acc6a10e44b512c7299b7dd01a8188fbd04c7ec8478

                                                                    SHA512

                                                                    9390a7bc8ae01e900a9648c3d0a31516be150d723d25c3eeebcac7aada1da73b4cc0d018df4fe07ccdc53238306ed7cf8329273a6779a52318cba51b7f3b6dd6

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    95b4f676b5e2deefecbb150830e4084a

                                                                    SHA1

                                                                    abf3c3d33f169b55be4b187ad5858e450a1b3be2

                                                                    SHA256

                                                                    fbc6759a1c67e8cad850809bd007e03760cc0c67071f90fe596bf94bf35ee232

                                                                    SHA512

                                                                    a31b96c710301c9f3f11830599428ef3390b01173df433079676d33208ae896beb32fee8b87708dc141cd2cbefa8d7bc4230bd55b1462474e36aa384bd21ddd2

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f28e.TMP

                                                                    Filesize

                                                                    204B

                                                                    MD5

                                                                    9760102fb00e4b9a09d1b7144722e0f6

                                                                    SHA1

                                                                    0e997674bae159a5900f678798ed354c790174e4

                                                                    SHA256

                                                                    03ca3da39bbf98cafdde1e3347cfd9ed50226477d6a8c21e9e8591c097da37bd

                                                                    SHA512

                                                                    65323d592d0c5929aa9c9d88367edab51dee69f45f31dfadab7c89731305ac4c824828e2067b756cf01270a65bb3402fb8e7efb1c6eadc644dd577ef35f47872

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                    SHA1

                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                    SHA256

                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                    SHA512

                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    11KB

                                                                    MD5

                                                                    9594f9b66af7a6e50b5809ed161a1f90

                                                                    SHA1

                                                                    81c0cd1d6174fbf915bf87fd2daeabc27548c817

                                                                    SHA256

                                                                    44f9721a04e8aa4f9a6819e2d8bab4a11e81d9a92c07a5272e7da270d0a35103

                                                                    SHA512

                                                                    0848d39604181c47a6603ad3ae0b03e0cc178911a9bf03652a5d2685cf4ff21c835442ff3de6498f9c894806e20b1c17a570fb7aad32f2eb10cb49bb3b5270b2

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    10KB

                                                                    MD5

                                                                    e972968240f776ce442c8cbd06a5e64f

                                                                    SHA1

                                                                    0cd0fe031b0ab3d5c16d066c6ab2ae2e0bd304f1

                                                                    SHA256

                                                                    f1f30a40fe660e2689d9a37346c8fd1a7314a95de8b4b9a631c2ef5ec81890d2

                                                                    SHA512

                                                                    4b51c151baf4c2d9c72085708670278ca57a1bc75de2aadd282e53e0f6ccbfcd8a96c2430542e020614d06783db06a0293d37ba511d59d3ac0cc717e0be15029

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    10KB

                                                                    MD5

                                                                    58c5ba7800919fd7b6cce0b5e0a05dd7

                                                                    SHA1

                                                                    a85a5cdeb268f29fe1470af97d6c0186635b35f9

                                                                    SHA256

                                                                    1dcc665f3c84b08d0bdf868e0e72e7ff87410cf5aaaa9f00635f226ec553eab7

                                                                    SHA512

                                                                    fc904f493c1441a4d8ed5f758223617c97a8b5e02b71fe6c911a1161dfe11b2c8af152bf76453bef2e7421964aea143e8c45a1b999f7b3422a3c292d7ceb4aef

                                                                  • C:\Users\Admin\AppData\Local\Temp\7zO81185DF8\Start.exe

                                                                    Filesize

                                                                    202KB

                                                                    MD5

                                                                    775d903c7d0676e880682b2f78c0c528

                                                                    SHA1

                                                                    44b0fb55ceb07e6e707824c9c9964d36bd7ebe76

                                                                    SHA256

                                                                    631059c3094723949f4937b3326261cb60bbf62adeac331afc7caedcd3a74dfe

                                                                    SHA512

                                                                    c14ba4329d9ef6977210529f4657ff273cb9a023974df990293daee2b191bd8d713d96eda6a41b8d70da52ec91692f64dc327d9ddb8211c2e66ff534ea880342

                                                                  • C:\Users\Admin\Downloads\Launcher.rar

                                                                    Filesize

                                                                    1.9MB

                                                                    MD5

                                                                    051c6b371ccd9888394fc421ae0ff258

                                                                    SHA1

                                                                    8914a1629ddc9e2013dd729844e7ed18c0301d3d

                                                                    SHA256

                                                                    07bf48c833f82d75c0c8ff57ca721ae90c62f240e0915623c7902e940ff1fc47

                                                                    SHA512

                                                                    8ef577c5d428ec58608992e919f97f76ede5ae4ceef6bdfe9b70bcae4e4eb1e736dbea831ee81a0506dfb27f672625ac5b3015a506415f3285483c94eedf5d9d

                                                                  • C:\Users\Admin\Downloads\Unconfirmed 392688.crdownload

                                                                    Filesize

                                                                    1.5MB

                                                                    MD5

                                                                    0330d0bd7341a9afe5b6d161b1ff4aa1

                                                                    SHA1

                                                                    86918e72f2e43c9c664c246e62b41452d662fbf3

                                                                    SHA256

                                                                    67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

                                                                    SHA512

                                                                    850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1