hxxps://www[.]mediafire[.]com/folder/6edvg7cb9uykm/CS2+Skin+Changer+v[.]1[.]9

Resubmissions

26/01/2025, 01:09

250126-bhtvbsykam 10

26/01/2025, 01:05

250126-bfw7nswndv 7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/6edvg7cb9uykm/CS2+Skin+Changer+v.1.9

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Installer.exe

Executes dropped EXE 4 IoCs

pid	Process
5532	Installer.exe
5976	Chicken.com
6104	Installer.exe
5236	Chicken.com

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
1220	tasklist.exe
5676	tasklist.exe
3728	tasklist.exe
4376	tasklist.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DomainsConcert	Installer.exe
File opened for modification	C:\Windows\JoyPayroll	Installer.exe
File opened for modification	C:\Windows\ThreadAlgorithm	Installer.exe
File opened for modification	C:\Windows\DomainsConcert	Installer.exe
File opened for modification	C:\Windows\HondurasTemp	Installer.exe
File opened for modification	C:\Windows\PlasmaSomewhere	Installer.exe
File opened for modification	C:\Windows\HondurasTemp	Installer.exe
File opened for modification	C:\Windows\RetailersDraw	Installer.exe
File opened for modification	C:\Windows\LosHoly	Installer.exe
File opened for modification	C:\Windows\RetailersDraw	Installer.exe
File opened for modification	C:\Windows\JoyPayroll	Installer.exe
File opened for modification	C:\Windows\ThreadAlgorithm	Installer.exe
File opened for modification	C:\Windows\LosHoly	Installer.exe
File opened for modification	C:\Windows\PlasmaSomewhere	Installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chicken.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chicken.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
4060	msedge.exe
4060	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
5920	msedge.exe
5920	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6048	OpenWith.exe
1644	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	8	7zG.exe
Token: 35	8	7zG.exe
Token: SeSecurityPrivilege	8	7zG.exe
Token: SeSecurityPrivilege	8	7zG.exe
Token: SeDebugPrivilege	1220	tasklist.exe
Token: SeDebugPrivilege	5676	tasklist.exe
Token: SeDebugPrivilege	3728	tasklist.exe
Token: SeDebugPrivilege	4376	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
5976	Chicken.com
5976	Chicken.com
5976	Chicken.com
5236	Chicken.com
5236	Chicken.com
5236	Chicken.com

Suspicious use of SetWindowsHookEx 58 IoCs

pid	Process
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
6048	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 448	4060	msedge.exe	83
PID 4060 wrote to memory of 448	4060	msedge.exe	83
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 3488	4060	msedge.exe	84
PID 4060 wrote to memory of 2184	4060	msedge.exe	85
PID 4060 wrote to memory of 2184	4060	msedge.exe	85
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86
PID 4060 wrote to memory of 2552	4060	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/folder/6edvg7cb9uykm/CS2+Skin+Changer+v.1.9
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa99af46f8,0x7ffa99af4708,0x7ffa99af4718
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5759028733147287990,12965050952382054338,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1644

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\" -ad -an -ai#7zMap1438:106:7zEvent19184
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\Installer.exe
"C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Gerald Gerald.cmd & Gerald.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1620
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5668
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5676
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 180387
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5768
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Prairie
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "PINE" Transit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 180387\Chicken.com + Exempt + Senegal + Protect + Html + Statement + Comparable + Steel + Originally + Oz 180387\Chicken.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sg + ..\Spine + ..\Ups + ..\Perspectives + ..\Arrival + ..\Gmc + ..\Saver y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\180387\Chicken.com
    Chicken.com y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:5976
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040

C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\Installer.exe
"C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Gerald Gerald.cmd & Gerald.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 180387
    3⤵
    - System Location Discovery: System Language Discovery
    PID:628
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Prairie
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 180387\Chicken.com + Exempt + Senegal + Protect + Html + Statement + Comparable + Steel + Originally + Oz 180387\Chicken.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sg + ..\Spine + ..\Ups + ..\Perspectives + ..\Arrival + ..\Gmc + ..\Saver y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\180387\Chicken.com
    Chicken.com y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:5236
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
215KB

MD5
7b49e7ed72d5c3ab75ea4aa12182314a

SHA1
1338fc8f099438e5465615ace45c245450f98c84

SHA256
747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6

SHA512
6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
84f597ccbc8bc8546eaf47583fca6471

SHA1
c43e6e08e7362c2ec4f26364be603698378f3639

SHA256
c9838d941a1726e3ac3213bf57dee726870b53e182d87828ebcaa6413532eb73

SHA512
eddc7a648b7ba5d805e4ff00773212ffc551245a7d7657cf9cc075436a61736b13b8b1456efcf045fd9c7b296bb73d3cb4a31f708aac2b3fcff0f2a761f34fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f37738473f6c0ce4f2a2e72683b2cb7e

SHA1
50cd655ec41bfc522afd96092465a6e537cb350c

SHA256
83613dd40eb250d7a4dab7a9e848f316d8f355464714faaadf572276e5b11d98

SHA512
ab686f7f5f6849b106423c3c755190a9960de5abf825e7020750b6f8d2d97ad4fead4816937994fab8f4c63c3eceadee2c7363184f48c3494547efba219e12b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
27b6075de4463f4ddba6ed11bbc3d75a

SHA1
a0495a39659ebae0c9dbf322ba8308d2277edabe

SHA256
ec1ee4dbc666458ba26215f2c9103a610b926af68e114b298ad1dc7b0e90e2f2

SHA512
1b49474409e3c28ea06aed764d10a718803f2dc6b5146029468c846fd5b23fa44543f4d8dc481ef645e05bd2f1253c83830db1b7f6bd4b48b1eb6f3679921ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
92ab358a4a200bb8f01e8912e645702d

SHA1
e73615a9a74e2a45f2c1c918cc608b65af479786

SHA256
add2cac23c0c14391b09c0460fa28767d548793d6786b012a9c327b3a3341ed6

SHA512
86a301536629de2cfe75347aa8092c981b75443a5c73b789876cdd42e312e0d9920d1235315e00afd33c3f1bc379de4f03c41199a8768a36576600c5bf25f5fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
579466ee91b30a10b546c85940b7f58b

SHA1
3734d79e473ce911caa50c28abba2401aee302d0

SHA256
96ad9a3f5e38a9e3c6ba72be58f8c74df580cab892b16bba6c44c8bd1cbcd8f0

SHA512
a24abb5276ed5ee93649d71e06507fd702ecc54adb42b47d714d7489dababbf7e5b3aa885f9073408ea130e6d94fbc910038fb34b1ea0f25009167f728b13faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e36538ed74064bf5102a7f41f719b54

SHA1
bb5ca2e6bcaccedc69bef28c9e1654fe842e8785

SHA256
8afe6d6d14acb8eac9a0079424da7a889a4256edc2aca4dac7edf1d66174be0c

SHA512
1e134be970a5a3274570e120dbcd676c1a2367f50c8186a92b9bb93226966a9d09d7a5c592569d9dcd56d6276a51f5571c13fdedc6944355725202b229e128fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e9d3.TMP

Filesize
1KB

MD5
bb712ee949e74975e2da8b4ea8dd0304

SHA1
9ea7451da57bff720a871385d12ad93b60dcdd68

SHA256
1c1d0f13cb90902b74b4051d4d696ee85db66d45bd3fa3a8ad035a7c22668e47

SHA512
9be54a4347af9ad8d30f41b9ce8022a866571122d610137841bd3d6420538d8d9b7a1a5c2308c6bf22ee215e363838d4e6d63f67ffedd5ffd2738caf41dd68df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
af8c2b3f1d9b3704e1936f972a65a263

SHA1
cfa12352f338a610bf0d75483cf472bfda8f1060

SHA256
30a10dee53f52b110fa65e0bd22ae2a2e736f6617fab4e3601aadd13f346ae02

SHA512
38235a0e51e40d2f3a01c8ef83bf9bf2f99c90d2107ae65dccf8dc373c0276dbfb2cd5d6e61f6357ecd67a9f40736a177cc8f5161e0b9a9dc55427609a1bbce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
40d760e141f857b4bab2ba8a931a651a

SHA1
0ea4883421e70cfe7aeb87800ae8fa59c2387081

SHA256
4aba3a8bbad7b58fc5f906c19524fbb5f5582c34a4db44ae7d3b456ae0d566fe

SHA512
773de359c855de5bdaadff6683ee99fd1eb851d73a1610705aa28b52cb9f226590a3d6afcf422188c617b630c9eb872d27040aa01790906f85051a43d447c1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\180387\Chicken.com

Filesize
771B

MD5
fb3fe08b348cd30a21ff8da25c9992ae

SHA1
a1fcdd3a35302e3914c6e65029a0f828c04462fa

SHA256
77e938e390f7e94e56c9b7bab7d3ca3ac5125cc25b042a7a843d6644f73fbd17

SHA512
b63c193c1b16aacb36269f3a40822dfd148c2a1130815bd1e661a5fd304804046391e4f9700e09dbdf30c5ab4d06ae13d4a6a316aea80590d2a57a48d25431dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\180387\Chicken.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\180387\y

Filesize
488KB

MD5
f9c47093d989021fc336df99f9b9dc8f

SHA1
9b8f03a16638dc56b6d09682fe00a0fd0873421c

SHA256
911118e2138f7ebb71ba3a6ac2bb658eea09f2356f29b59a397703d8c7464176

SHA512
a823c87f98131369d6c4c3726c433350bb3151d1a4ce1d51546503326979bb83629d7d2ec73ce14c3dff94904fca6cf80f56c1f012dd0e7cbbc4b86f51b12d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Arrival

Filesize
69KB

MD5
adb9b1feed9c733eb413ba9843f07494

SHA1
1ebb5c95cb7c03f010761905e7a3d77d949dda82

SHA256
cb8f8be07ae99851b227bcbe027f76412ba5bf38bac208dfe9490cc6bb02402b

SHA512
b4a8e7b73069132e3c445f5ae8cf84773100c52cbd8d3b23e82903db3c1e5a94ea1fe219b025baa962443186a283b1ef7cd015521f0dd4f2adfce685d1d0ffbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Comparable

Filesize
147KB

MD5
890691d10de9694768773d03f6920325

SHA1
1177c810197d123a3f9bf3df012d3b353a92761c

SHA256
017280540d352c5e0f1830de989c014e2e75ed03b933d05ec98d2c907edc0b72

SHA512
79426bb7bb5ed5474ed643c4d549a6b5c46f1edb31ac167717a6417ceda2d2bef1b8f3bc165d489f0e358b55cfe6d1462f5e1bf63f1cbf8eee106fe4d9510f0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Exempt

Filesize
107KB

MD5
d2954e27b0a99d55cdf57838dfe74e26

SHA1
47d6ce1c97e66edf859d706e660866424237586b

SHA256
4ff1557e59107e2105bc0bd963671b2326a089455fa11719712a90a540438586

SHA512
dff7dda4a2c2497b62f9034784f97c6c99d0696250e4e2cfe7af363acc25da84665d565e3804f4ccaa46560770656a5e56315ec465ebc9b62b64b8095aab6198

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gerald

Filesize
28KB

MD5
b1d2f71324b83b0300ce817566b370e0

SHA1
fe5447a2b570402f4a218f2304b033d9ce6127a4

SHA256
044262beb6511e3f1368f6ab66a34a545f7dd9c4d5c30d36ec1bc9e2dd569c1e

SHA512
7b346936981f15b8f0a7c6daaca20fc58dceb8e311017ccda811a4a3a87c1d9715751068aef9bc1dddea6ed7b0e5e56898b589c851c4327bf20d4963b946773b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gmc

Filesize
74KB

MD5
3842e0920fb3c7c85dd281c8b918ed22

SHA1
ed9af9ffc86c0bc88d8328e3560479f891baf5b3

SHA256
397f792b1068f50ae5095fb9be7983f23c013db4eff56aea74f7f564a5531755

SHA512
5d1478e5c65cc89c2cfedc97cb1c4f3abec9e023f2faa18ad4b9fcf9629cfc487fa47f951549a77b4542525d3e9043a3f1e5c49bba46b1f626ffce76e2df6912

Download Submit
C:\Users\Admin\AppData\Local\Temp\Html

Filesize
143KB

MD5
298c6375609f7a54b312d73b5a4168d2

SHA1
5b0f508f773d0a07128c5b97ece7c97717f24ee7

SHA256
5d1e1321c38f149a05ebcf3cae5312ac68c9e2ddd779d7c9ce45862024eb31f3

SHA512
1273cd08a1baaffd770a1fa939f3eca15c70dd479aff603085c95c99502bc168dc506d6d4df304f36054be13de6ed9af4fc2561d7ccc6f3949cc23c69324e734

Download Submit
C:\Users\Admin\AppData\Local\Temp\Originally

Filesize
53KB

MD5
3d351b019ba8e905c6eddfa820c1f0ed

SHA1
9265177529f6098e2ee8ed3d8dac36a24cb9b192

SHA256
34d9c66803196a19005ee2c9f908278f93e984b4ca4a9e786d24c04168556fae

SHA512
d82ac6b201df093f5a9b503b937c4e5332b2137eb2181a872d6e4c8dfcd0486ea72e78aaf5979bccf165f29826caeb3583499da7e1039a641208fd4c089b3e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Oz

Filesize
25KB

MD5
2a12f635623f096e638c0b517ae80dc7

SHA1
9012203689d126a928e38254f57381a887ca3f46

SHA256
d55ba6bf1ff3d1acb22d500f3b3aaa45c31fba10a999cb465d3cdf2c387b25d6

SHA512
4fec03003b7d1bb91e9319cf2d6940b6ff1d70ea1ac12f7da311218b26a92b8b851ca3aa1b2a1d80a38cfc6c89385efd31a4ed1720e988ec154c4bdcd1693a1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Perspectives

Filesize
83KB

MD5
fb50dee4c1112ff30fce536cb631abfc

SHA1
4bd518c9ee27790be750e6205a850ae3e07f8c2e

SHA256
af6c55e41febc12a2ed028d05cf72bb70033455780ca423949793973dadff212

SHA512
d60da374dd007c6caec781c590adf611883dabdb7349c976192e3eae6e055d6e7b48965485d8b753add42df34f0461c05b303b8cf750c7a9bda32a31b4206b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Prairie

Filesize
477KB

MD5
0a96828d6dda9048818cc2d629a9ff9f

SHA1
5abe6929cc689f2a6c1d93a83af7058933b3ecf6

SHA256
a742dc26a8c2ee1efd50bdf00c1d0b2f639b048de9e9ea9ef02d12090c8a590f

SHA512
5625ab6c23b71411836b82c6f92cc6e3afbc203c62a49c92ebf66c9f2ad8fe32285e5a535a169a65a7dddd37ebbfe6e8cce849c6459fb8fd72917e17303d5419

Download Submit
C:\Users\Admin\AppData\Local\Temp\Protect

Filesize
143KB

MD5
af5cc288b8edb8fab7f9d57d721a5694

SHA1
2c97dd4c719dcfb07337dc69f3bf1a0d469170a6

SHA256
23a2eae98f6d7084fc73e75c1581b7b4db732131b1157c075d5ffb2936e1177c

SHA512
786270304b22a8b36a32a8a6d2e720123aee41bf541d602d93875abaff6a27cfd9360b22b06cae41f62b4de47ef525636adbe8ee366a324c7e5536e39ebba893

Download Submit
C:\Users\Admin\AppData\Local\Temp\Saver

Filesize
52KB

MD5
b1325bd57a34524790f91a98d265d29d

SHA1
f11981e9b5ff3f3fa93cd0c9bf9bac952c024bc4

SHA256
3f2afe613949951ceb0497d114b7c5d98e74a6934c9792ed3fd63a8775d8845a

SHA512
27d0195d548eb43ad8ce6e0df35920896352befd6cb03da1911fe8e228d55d1c1f8d81510c749de4382f8b71157645e67d988610f7b7322bfd7b15264a2ff6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Senegal

Filesize
108KB

MD5
934b2ff5460cf4ee15e9efe3c7470a14

SHA1
1fe91fcb75e019b6835ca6f4c86295e4ae39ab0b

SHA256
3f3f5eba0d023810977da5ee8b0ce0be05756bd4c9a8ff2017a11c5f70a457cc

SHA512
783c7926e303d0ebb75781a1515d905e416318d6cf034b3c37f8c7507acbb78e17cf220b13ce1dd1a99c704993198422c2adf00b34e1cbeb2ec2d7f9708e9189

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sg

Filesize
86KB

MD5
3aae310119068ea94c5e58d38143be33

SHA1
fe886dd3fb10323cc87222d32b6f7781d1c97935

SHA256
abf42750d29381ea1e23419e6a08f73f5ec326c37c6b9d95c041045b4b9b54d3

SHA512
c9f91ad0bc940f3a679bc663c7c5a67ba27a231bf5d30788841ef5721d70516592d06097f054c60ccf9d7d806cf124905294381a3177fd60191493ea1c856c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spine

Filesize
73KB

MD5
ff79ea5ee03d407d8eb05dcc6b69c1b8

SHA1
cbf99efaac975d1a0df7b7474f44b06294ee9f67

SHA256
ddf742ad9770ec05cf9bcab2658ab1d9561d1be48f86dfa8bda02b27d4446c47

SHA512
668377f34bef60577a2c104779093f573204bf41d6f6d58b3e0c7a4c49f5234a1463d0ddaf6e7c74b3c0c35613e8a881304086b3752b4b625142352007f53277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Statement

Filesize
116KB

MD5
c70b07da1c6967051e2202d2774038fb

SHA1
50595272c208f26d627865ce90600ec6d5e88d66

SHA256
11889ad9086a95c399f003c8feb4308d11e7ac7ccd5806b8be54d9beb64d6e5d

SHA512
7760b6c36ee8058cfd73cd1bbeefd6df26d92f4d40966e4f0e37f3b17c8ddf178afc692ae41f7a2145d554ad2694a5c32979f04c06dfbc1f80dd677b86e24a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Steel

Filesize
82KB

MD5
3e406b5220daa68ee1c98e0304f332ef

SHA1
52e5e72ad8c50b893a7b6be426586998fb400e08

SHA256
755093ad17388f010896123d814417ee51b08b383fa96daf76f1f2a0b78811e4

SHA512
07166381cf933895433f0fddc63cf3eb701e42028b36a6dbf21febd1731a667ce75374127d8eec7477d4a81c6a6b47b7309b1b25701cfd5db57fd408d305d49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Transit

Filesize
775B

MD5
b983dcd93d693182b775f3dbcb737a8b

SHA1
087ce22216d07a647ed5f4d08c02223d5a789c8b

SHA256
2d5ec8234d45822b9b90459b9a556e70a64554a65fa4fa6baf2e74d92a0042ed

SHA512
23159469a47981150a404e95362ea4c0ef026f2007f925e0d1b53bd5ef8f559ef0081d44f5d278746ad4190c935b65eae6e422e505fdb18651cf5dbe1230ead2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ups

Filesize
51KB

MD5
01209a148ff554a7b15adfd344b5589d

SHA1
d031d58bb0a2a4a5c3b123b692d2aacb5605cdc1

SHA256
055377880319bad61b9140bf114df294e7944f4549ab428b9da7ad49bde4320d

SHA512
57df693b4963159640f977d94e852117546a42b336544730cb8efd15b44de08edeb7ed2a864eea8e655b3ae0582d7ba159c27cc49d190ed7de6226dc31da97a1

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\Installer.exe

Filesize
1.1MB

MD5
a2e8cf348222b9b8d3768f9d9d19f0d0

SHA1
54d2ea84919e1ce60b3354078c25365c6a06a732

SHA256
1fc0ddcd468f3e6451de4e215d0df7955f8ccf397b3c2f08b1d8c2795fc6e2e5

SHA512
b283d902e03a95ea2055e6ff80ce5840d58c08b020b1ca27e9dc2badfc28a048b51e9021956215758142000085601c9811f7736c015760f8ca92f31891310e0f

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\Shared\Shared\Microsoft.SqlServer.Types.dll

Filesize
374KB

MD5
25656a196ed967bcd4b152a4073b8b44

SHA1
a9b64b8a42c9da3243378f2a17a9ff8057154116

SHA256
36c3e5efd0731ccf5ac9a341c488b4fd14c69747f5a3f6e4cd976a7c1288b3b0

SHA512
3903556d2130a219e9795856a14eb28926e3b798eabfe96353300ccc1c11925aff2f417c9ca588f2ddd0df47d6a64517980a39752edade9ad725f6ee4aa16383

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\Shared\Shared\Resources\1033\sqlevn70.rll

Filesize
2.5MB

MD5
27d0d43f7ee9daefc96eef48620bdb4c

SHA1
83c84ce3c517871dec311500001db5c501d25be3

SHA256
4790c4c828d21865b556b48bdbb0dc84fec7e49e8fbccfd5e75c9dcfb86cae5a

SHA512
fd651fb3cb9335db0a26fd58bc0831a0e91c437ca1a65355b968cf0900fecab1289b6660e64220c330b00c456e1a40e6536e8ad0a3df3f58021f6c1a47861530

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\Shared\Shared\Resources\1049\sqlevn70.rll

Filesize
2.8MB

MD5
35e743c24d8eda76966acf60ed8b337f

SHA1
9eacb67db44b21d2091a50f2d7a7ba7cfa7bfbea

SHA256
09c875779139587ede45c49cf14173d7ce1b68246471a4f5b67dad021e5085ff

SHA512
a25e279baca808528e8d9c0d824ca008a3666eb62f483dc3c9f81c503c97d22689c4ef8e525bf45844f865200f85a3b0a9b1911535fc427e51269043f5983a5e

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\Shared\Shared\instapi110.dll

Filesize
47KB

MD5
f9ee4c23a7bdbbb94bbfff3da087b431

SHA1
b8dad015dcd170bc84e8ae333c66e40c7e4090c3

SHA256
fc988b3fad95fd8ad36d829c9bfa2f36dcd517de674705a3928ad3384354f34f

SHA512
9ba5b2865854929f6ce41139c0a2db61ff49291b0a4e8a0ba653ed622406c0cd9eaeaa4df44fccddc03f0ad621ae75db071d93b76454d4be468334069d8bf5dd

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\Shared\Shared\lssyscat.dat

Filesize
1.0MB

MD5
8079e21b5980d3089761d2366d1c0828

SHA1
77d8430339e0d384a50064697846c8f818f0176c

SHA256
7cb429032be391e6f01065bb772aaf00f979ce7f1766b71d541fa53c58988f27

SHA512
96cb7f455fb567ba5a4e1cb019114d0680fcd338b78d6ed0a2cdd442809d4611cf46bfa95be39e0657b245a1e8c5913d21c53b1f35ee035d4b98af6b51657438

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\sqldk.dll

Filesize
1.6MB

MD5
9284cdf83b7b75720344b616864e8766

SHA1
0ff8fe5eed78440044f1b6afe117e91d2453744a

SHA256
5ab3dfd1f5c303688593e8779dca3fdeb3075647cc675df4d3a23a0a3f90f84d

SHA512
6b9fbcbafe732720e3bc7b4ff15a1349b55d46fc760ab2961193c4103439aeaa1313a950436de80fa6d2c78e9e4334a1d64c157046ec4ce41c2ce32c6df2665c

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\sqllang.dll

Filesize
24.8MB

MD5
29f692b545d0493d4d2257439c6969e7

SHA1
fccfcd17acf600abafe4671be0a1e0d9c06ce3f6

SHA256
f51cf85cfe31f0b447ad5d6000d176b64de50b5e7a09a0af9f59c0a23cbc729c

SHA512
dccdd19aba438f40fd944988f4431a905633cd29048de3b45c924350db67ad481bb221546c41145de93bc1f210c5c9e830a6dcb95127c04f8c80924647f027b0

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\sqllangsvc.dll

Filesize
51KB

MD5
fe645bdecf22601e9fdc293aed23ba0c

SHA1
a665dd12847f2f19a18e68329c98ec543e295027

SHA256
b5108ecfc1dd73e8023d609d5edd8e6dbc5279991a0ae1628f0ca2932b61010b

SHA512
43ac5d53d58c18c0983cbee628ff31dd3ad643b6b9e2ae1bae6d604885538a6733eb05551984dd7cbbb2ae00904e43ba3755ee007c83f874d0627d891e4162b8

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\sqlos.dll

Filesize
23KB

MD5
d5678b23d062bd0acdc4b6d9e88c9585

SHA1
0f9ea289f11eec5b5bc8a00f70d36b84b33f8455

SHA256
c8fe018e57adbb1a5328192e8e9be4a5eb15829ff5ab2713b00c6be7dca98e1e

SHA512
353669e3d65153425f45fcf0c63b603de96a1213aee9db824865c2a80955c465b2e382f01dc91baf8505ff8b970555cccafacc88f4fb4eb20d32bb1f75703d90

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\sqltses.dll

Filesize
7.8MB

MD5
344479af61cacc9c64bca055297afec1

SHA1
cc5e66e6dffa8a243193a8d25424dd81c8d85eac

SHA256
ab859a1d945cb99e2e52e218ef442234d1436f9aa9a81b76ebf85068ccdebc05

SHA512
cf76823c207ccbdc298a863b123c9a84e28e3e41c796ceb55d77fdebaa0ed9f7eb5262efd39bd393cc86319d98275a485e791d3d28b2f92a8d9d69866ba946e7

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\cache\Shared\xe.dll

Filesize
399KB

MD5
063ca314262d277a92189028a9e094fd

SHA1
3f8fb62d6b38ae258dbffda4d9470c78753c3814

SHA256
0ec09cd7d58aeb260fe82ca79ad16c353d7053a665d98f4deb26eba5e2b6e9d3

SHA512
0ef025c85545377d67562bef8744c0966262fd5ffe7fded4a9958ad01cab19e319b7f29fb45d4187a4930611d6b0dea0be32097cb78ae8423934080f7038193f

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\plugins\Autoupdater.ini

Filesize
5KB

MD5
f78b8f3d265b4e9a706ed0aae70bdf9c

SHA1
6d73ad3954fd8fda80911071efca1910fd2d0a3d

SHA256
dcae62d049c4dd496effab6f02220bc270c6c098ebb55a5a6e55fbafad2974d2

SHA512
c44887c08d1239969aaf9934921f1a7341b87faded169136fcc0539d62de3104ecec0e3ac7a28eb3135cb449f58310b49f868963b64b920210d1c55104e7e7cb

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\plugins\Management.log

Filesize
8KB

MD5
ff765d6581fe6568aaae19de239b2e7a

SHA1
78b09b0ce2e59ce87f65251ea903842c1c77046a

SHA256
4dd051de9b04902fc59d411b1c27c42007cacca4ea52e88d71c897cad1d990cc

SHA512
8fa7c766fc1ac48408d964eb9844f9c4a2fb3e33357e736230024788ec71cb3c338397e16f8e556bbcaafd83c58f3af6a55ceaa9daff290b0e687093e5c97a2e

Download Submit
C:\Users\Admin\Downloads\CS2 Skin Changer v.1.9\plugins\main.ini

Filesize
4KB

MD5
d2e799c6b2467a0a4aeb0cba508e8a30

SHA1
349e50e830cca26b03a0e32bac1f9045a72eb406

SHA256
d3d79eda930253d1ad388f60a56775f7d6bff80ce5a4e07c812d7d338fc93593

SHA512
f1d14875a6379b450eb5dc2513a1791ec65a6fb237db94a74621c70ca5d579428b7cded35ce3bece884faaabca4f0705de73fb5cc8b2d60be995b2be66cb20c2

Download Submit