658063b9a8e4469a01e7d5e2146deb17f534468cd581d8d6ca62166efc9412b8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/07/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpc37w1il5.exe
Size 5.2MB
Sample260702-pterfaas81
SHA256 658063b9a8e4469a01e7d5e2146deb17f534468cd581d8d6ca62166efc9412b8
MD5 b6992eaec6dfec0e51805251c0803050
SHA1 c575f190d7abd6a662b6e0ebe9246f7c4f211c65
SHA512 94fd21d2c19b1b77de1994a0ada0485e3cb07def7a6349f6b22b2ca9e4ac6e9417d0e473d4958710a4e6fbe10cfebca7a2f7d54e3e42c393914ab4a8f481fd79
SSDEEP 98304:Ff7wCQInrje/CAVMJy1Wv7PRmrj/QUPbbhIQ5rN:Ffn6/VSlvV4QUDbhISh
TLSH
T1FB463345E7930837E86405396E05E4BCAC23B3AA55D421362FBCCB9F4B741C7B9BA670
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	_iu14D2N.tmp

Executes dropped EXE 64 IoCs

pid	Process
2852	tmpc37w1il5.tmp
4420	fnr.exe
4576	FlushFileCache.exe
3888	unins000.exe
3328	_iu14D2N.tmp
1080	hosts.exe
5456	hosts.exe
5020	hosts.exe
5476	hosts.exe
5304	hosts.exe
3900	hosts.exe
5652	hosts.exe
4588	hosts.exe
6128	hosts.exe
2792	hosts.exe
5668	hosts.exe
2040	hosts.exe
1224	hosts.exe
2176	hosts.exe
4556	hosts.exe
3716	hosts.exe
3864	hosts.exe
5344	hosts.exe
3464	hosts.exe
4360	hosts.exe
4312	hosts.exe
5164	hosts.exe
3056	hosts.exe
1980	hosts.exe
4136	hosts.exe
4884	hosts.exe
5660	hosts.exe
2652	hosts.exe
5304	hosts.exe
4692	hosts.exe
5084	hosts.exe
5956	hosts.exe
2792	hosts.exe
2840	hosts.exe
5668	hosts.exe
4672	hosts.exe
4720	hosts.exe
3600	hosts.exe
1404	hosts.exe
5864	hosts.exe
5128	hosts.exe
1076	hosts.exe
6088	hosts.exe
5552	hosts.exe
2480	hosts.exe
4236	hosts.exe
5640	hosts.exe
2648	hosts.exe
4884	hosts.exe
3120	hosts.exe
4004	hosts.exe
2952	hosts.exe
3236	hosts.exe
5188	hosts.exe
2044	hosts.exe
1976	hosts.exe
6020	hosts.exe
4172	hosts.exe
6100	hosts.exe

Loads dropped DLL 11 IoCs

pid	Process
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	tmpc37w1il5.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\sk\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1860_1449214609\_locales\hy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlushFileCache.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
544	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4904-0-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral1/memory/4904-88-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral1/memory/4904-1200-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274695125348411"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	_iu14D2N.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{E2EB212C-6B12-421E-B466-F0A87C8AF2C2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4576	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	4576	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2852	tmpc37w1il5.tmp
2852	tmpc37w1il5.tmp
3328	_iu14D2N.tmp
1860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2852	4904	tmpc37w1il5.exe	82
PID 2852 wrote to memory of 5200	2852	tmpc37w1il5.tmp	87
PID 5200 wrote to memory of 4420	5200	cmd.exe	89
PID 2852 wrote to memory of 4576	2852	tmpc37w1il5.tmp	90
PID 2852 wrote to memory of 3888	2852	tmpc37w1il5.tmp	92
PID 3888 wrote to memory of 3328	3888	unins000.exe	93
PID 2852 wrote to memory of 1860	2852	tmpc37w1il5.tmp	99
PID 2852 wrote to memory of 3024	2852	tmpc37w1il5.tmp	100
PID 1860 wrote to memory of 116	1860	msedge.exe	102
PID 3024 wrote to memory of 1080	3024	cmd.exe	103
PID 1860 wrote to memory of 544	1860	msedge.exe	105
PID 1860 wrote to memory of 1136	1860	msedge.exe	106
PID 1860 wrote to memory of 1136	1860	msedge.exe	106
PID 1860 wrote to memory of 1136	1860	msedge.exe	106
PID 1860 wrote to memory of 2720	1860	msedge.exe	107
PID 1860 wrote to memory of 2720	1860	msedge.exe	107
PID 1860 wrote to memory of 2160	1860	msedge.exe	109
PID 1860 wrote to memory of 1776	1860	msedge.exe	108
PID 1860 wrote to memory of 2160	1860	msedge.exe	109
PID 1860 wrote to memory of 2160	1860	msedge.exe	109
PID 1860 wrote to memory of 1776	1860	msedge.exe	108
PID 1860 wrote to memory of 1776	1860	msedge.exe	108
PID 3024 wrote to memory of 5456	3024	cmd.exe	110
PID 3024 wrote to memory of 5020	3024	cmd.exe	112
PID 3024 wrote to memory of 5476	3024	cmd.exe	113
PID 3024 wrote to memory of 5304	3024	cmd.exe	141
PID 3024 wrote to memory of 3900	3024	cmd.exe	116
PID 3024 wrote to memory of 5652	3024	cmd.exe	117
PID 3024 wrote to memory of 4588	3024	cmd.exe	118
PID 3024 wrote to memory of 6128	3024	cmd.exe	119
PID 3024 wrote to memory of 2792	3024	cmd.exe	145
PID 3024 wrote to memory of 5668	3024	cmd.exe	147
PID 3024 wrote to memory of 2040	3024	cmd.exe	122
PID 3024 wrote to memory of 1224	3024	cmd.exe	123
PID 3024 wrote to memory of 2176	3024	cmd.exe	124
PID 3024 wrote to memory of 4556	3024	cmd.exe	125
PID 3024 wrote to memory of 3716	3024	cmd.exe	126
PID 3024 wrote to memory of 3864	3024	cmd.exe	127
PID 3024 wrote to memory of 5344	3024	cmd.exe	128
PID 3024 wrote to memory of 3464	3024	cmd.exe	129
PID 3024 wrote to memory of 4360	3024	cmd.exe	130
PID 3024 wrote to memory of 4312	3024	cmd.exe	131
PID 3024 wrote to memory of 5164	3024	cmd.exe	132
PID 3024 wrote to memory of 3056	3024	cmd.exe	133
PID 3024 wrote to memory of 1980	3024	cmd.exe	134
PID 3024 wrote to memory of 4136	3024	cmd.exe	135
PID 3024 wrote to memory of 4884	3024	cmd.exe	161
PID 3024 wrote to memory of 5660	3024	cmd.exe	137
PID 1860 wrote to memory of 2956	1860	msedge.exe	138
PID 1860 wrote to memory of 2956	1860	msedge.exe	138
PID 1860 wrote to memory of 2956	1860	msedge.exe	138
PID 1860 wrote to memory of 4864	1860	msedge.exe	139
PID 1860 wrote to memory of 4864	1860	msedge.exe	139
PID 1860 wrote to memory of 4864	1860	msedge.exe	139
PID 3024 wrote to memory of 2652	3024	cmd.exe	140
PID 3024 wrote to memory of 5304	3024	cmd.exe	141
PID 3024 wrote to memory of 4692	3024	cmd.exe	142
PID 3024 wrote to memory of 5084	3024	cmd.exe	143
PID 3024 wrote to memory of 5956	3024	cmd.exe	144
PID 3024 wrote to memory of 2792	3024	cmd.exe	145
PID 3024 wrote to memory of 2840	3024	cmd.exe	146
PID 3024 wrote to memory of 5668	3024	cmd.exe	147
PID 3024 wrote to memory of 4672	3024	cmd.exe	148
PID 3024 wrote to memory of 4720	3024	cmd.exe	149

C:\Users\Admin\AppData\Local\Temp\tmpc37w1il5.exe
"C:\Users\Admin\AppData\Local\Temp\tmpc37w1il5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\is-3AAV4.tmp\tmpc37w1il5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3AAV4.tmp\tmpc37w1il5.tmp" /SL5="$4027C,4901458,140800,C:\Users\Admin\AppData\Local\Temp\tmpc37w1il5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\fnr.exe arc.ini fgrplc -1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\fnr.exe
      C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\fnr.exe arc.ini fgrplc -1
      4⤵
      Executes dropped EXE
      PID:4420
- - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- - F:\Games\007 First Light\unins000.exe
    "F:\Games\007 First Light\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="F:\Games\007 First Light\unins000.exe" /FIRSTPHASEWND=$402BE /VERYSILENT
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ff90493c188,0x7ff90493c194,0x7ff90493c1a0
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,12093647494671258300,2685604076550962888,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:3
      4⤵
      System Time Discovery
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,1267165153457712057,7707256026425402729,262144 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,11103752976691384532,2600037185597541184,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,11460127306400909118,17157638850487164868,2097152 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,2888434087711777195,8467534319066370958,2097152 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4976,i,9962295205633528545,10930126161014053143,2097152 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5148,i,15860905914916123128,5440505123680387269,2097152 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12584896549079711856,13607195449860168843,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,5689837577144318310,5827555451010821527,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,9199025039410534816,10999879178868155058,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,9199025039410534816,10999879178868155058,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6272,i,454292753317517970,9890622371018212170,2097152 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6400,i,12550785482971487832,9303021298801810070,2097152 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,9435447879659054783,13598480283955436059,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,17608078301842002685,6808888431896805522,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,5614013536505758096,3513712381027619453,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,9880160172637717891,15098394577770332105,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,674048615458974620,7432792160024306238,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,18149409118923490421,1315045384253404047,524288 --field-trial-handle=2944,i,1897908126066631264,13157345142535197440,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
      4⤵
      PID:4304
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\host.cmd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\host.cmd"
    3⤵
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:788
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:760
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:848
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall 007 First Light.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\007 First Light\Uninstall 007 First Light.lnk
Size 721B
SHA256 e3415128d7b759f7cd6fa90ece3e82609307e63486662fff08d4e59834ac317f
MD5 ce3e65893f31c58052297b7ff8c8474c
SHA1 fb4d8003e55afa208a4c5996ba327eac5c3f1628
SHA512 0631973b3448e7121cc7e119942c51992aca7d1f7ef9f5ece57ebed5ae4eac5691ba4f9b3a39932327b3f22af7820796fefecadeb9b2a2b1af50b57d11dcb0e8
TLSH
T1780181231E871E4EC595077E60F35B67A310B71BC712EB0F50185E688D91100996EF7B
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hosts.exe.log
Size 847B
SHA256 4597cbb41260631877633b75248620cbff79d2359c5f553b41d1e845080f6399
MD5 72305e6c7d0336a5b729781f69fcd4af
SHA1 afc5955b5f991f9845b795dc207582b3d9500a1a
SHA512 e6b375610cdbfa36925fb77999fb5adcdb34b7a4805f560ba1222568ab3b22fbb10c2e069979ad01cb7fe543495d9ce459cb43b8769b462a2f152e86aa1eb5d9
TLSH
T1CC018E312331B1D589423F43195C29C516FF47847564FE2C75D9225FD92B01B2F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 74ce5a6b37a883f18afbd56ddd77007cd5fded3503c77ba22208880386f14d6b
MD5 cf7a854954653d168a4a632747a69b07
SHA1 d2cd2a75c25a2d1b7ec282408d4675ad4d19d955
SHA512 80f9415c81aa31b876378838577c1077f31ff258fbcdfb5e3bc8cc6985d065c2d3cae7e1a68848f7246f23fc0b7b4bff25353dbe197e5e630059b234c4cd74cd
TLSH
T1FCE0E5ABCD22AC2708FD172C64554B86D60003172B40595F3B3D92098FB263B1597C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f8780a3bf7a468e625dbdac45cdc9fa13cb2d36ca4f1ce7d293c53f43a73670b
MD5 5e7ad26bafdbd6e0a8b1817e393ec8d9
SHA1 dcb5cf8cf0d0f7bf4810b6ecd11a2ba5848bb59f
SHA512 d7168927e9708604850bbaf01a6f16fc581c7b1f707ce386b61654664abd14d798988e67cfc869b95cdf9f849095e412b7e5c220c9ffc59545e4291b64def1d5
SSDEEP 96:MaFekCLxob5OsMI5c0BJsfX+OgVvoO/TRsuyl2s:3uLxobMsMI5c0fKOhVvoYTiuyss
TLSH
T17591EBE62C8640E0EF34E13D61C3894934F786FE3A172E1262A0BC39F9FE3556D19559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59d557.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d557.TMP
Size 3KB
SHA256 baaf01a07769629cfeda615843c2081c0bc17c8c76430e6c71897cc2ad9fdcd5
MD5 a959156fb8c01e406ed3ab91605cb7e5
SHA1 d0c69753d0567a9f263bf9f8f944a0cfc25b2336
SHA512 382f0872633777a582d73938b3de7df09316484aa66f1d0538f21946027c33bbd6fe31600ed380963f6e82c424683a00dfc5497604346cd230a10f7939e8484f
TLSH
T143714DD62DC644E0E379E13D21C6950838F986FE7E272E6176A0B835FAFD3215D1844A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6b427be1078c4edb7427215034d085f2a6a5a87c6ad1bc283795471ca964d8ba
MD5 bae431bd94c644c9210de1ec078d4808
SHA1 98fea9bde5e2f94206d23cc7359aeb5d5e96cfea
SHA512 0c3b32229b2353d574b8cbd0063d000ede3a7d7ec86e2406a030f9e621e83c01751fd87534f376e93adcf2626b90bd04e895c790cc13eac2d52e92497c865c35
SSDEEP 192:sxZrRIyMqZjK1Ml8Mj6E/fhsdEuo43TgKqzodp/60HUw6+WN2n8/eIOvh6rI85XP:sxZrd76E/fhsdT1nR/H2Z/eOrH0zjg
TLSH
T10B72D757A638497B8DDAD619F985BB63D3F4442392905E48AAFCCA0C04E7AED3113C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8d159c1cffc20b4e8865eb66c896bdd6877e52e38fead38fb46651d9f93d5a00
MD5 8ec438cadc78d9f999f869d48f7f84b9
SHA1 2288ce3197b3ddc61879935e31e22befff77c7cc
SHA512 556e10ae9997b6713284dc32801d1d10b4b6ee0277ae37742f0d9b57c12fe09b21c68618c0e6574725747b55fdb058f5ddafa7de72d8a67db4d58a4c0eafc24b
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+eHiLl42vJ4roK:/Zk4PfeEnXDWvXt4hu1jaDeHiL+QJDWN
TLSH
T199F2FA3B680CCB7E4F804E9CEC2ABE9A6EE8018F5698CD5447FA444C03C76EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ff88e08303f7b5145992e48b174cb3212a0a27b9c90caafe6e6fcf87275c44fd
MD5 f57e80f98822868bda563ccb0804ca43
SHA1 ffd77cb3406cc00a468aa64a6a15ccfc962a76c8
SHA512 6e7d3df292623fdc778dff68ef416582cb2966975a5d40904ad7ac39764b880a3ca28f2116cf368581d01aa86c18b4af7c8c7e3ba4b6799cadf7e955a7541e56
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1UH95HQ1xHF1UG:EJGnYNSv9PpHV/qj+da
TLSH
T18BB22C13313A03423CBE2518A2A686779E4231B33019EA7F77A944764E67E224DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 244B
SHA256 18a1aa66d025f6bb7d64ef2ed7963d9d5ed54fd776fc982fb5bd8eb7f9dbfe17
MD5 61fa9a8104fe46f018db918cd96e6d65
SHA1 8bd14da2d8d0128fc121dd89ff3094c18b009161
SHA512 f5b4ba84cc36c29db44a4f0f12d8a47bd8661a91c73a4be0ee73c49353f774413e4c89a06a11999dd20a44690d10a94324087ecc9d5516dc3efd83196432dbf1
TLSH
T146D097EFD33088CA3A30ADE8213AF10DD25E490C8CA4DC90E44874E910BC2029C02D30
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 86B
SHA256 98b890bfcca43595cf76b755e94da14a41eb83325f6ee1b8c4e87b4350ebff6a
MD5 a821fcb99c66f3cb3d439fcaddeb7fda
SHA1 44584097272c7f8087ba5d04e566db8fd168821d
SHA512 6c958296cd3cd17129099b7c664bf1bc5efd64c5b5096985a85e7e2e7c09fa1fbed4d956e15e060d98721d00d807784d73d504045dc6021eeedfc88793cab36d
TLSH
T1A9A001FB8A64899A0A61A9E86139B22EE18F829CCCD8DDF0C40881D66269A221006910
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 167B
SHA256 3d274cf8f9c9d3a395b5f0e478e2a5d5fce2aac20890e7ad67df64c3133e7817
MD5 859e74b6c3e5aba233dbefd1129bfbbd
SHA1 1f1e8bdce90c353ebdba77a79653f9e7272e813e
SHA512 c31b7428778036ef33a3d3f0d4fe80dd64a4f004f4cf5c14c267940ce363d690bc2310cb4f2352c60320433384aa1ba4c65b21aeeaffb8dd74c776767454cf15
TLSH
T171C08CEFA63009DA0F7069E9203EF20DE24F8D0D8CC4CDA4E00974D521785134802A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 160B
SHA256 9577afd871e088e14da25f9b5b7f7b4fe4e2133a618f6b360e2e53ede211e0d7
MD5 d6e147b769616fb2bfaf4e82fc89e6e0
SHA1 4d16f4d65f993395d8ff3768d2d27f9ac7b07c47
SHA512 288a021ed177766da03fdb357b8bafeec5e29a91a0a91ea0c06c2cfa2300c85a7dae4500f36db348cead246dc11f59c0b049a0802be7284ef236ee2b6cb949bc
TLSH
T144C08CEBA63049DA0E70AAEC103EF61DE28F820C8CD4DCA4E00864D5157C4130802A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 244B
SHA256 a6724a143e5b4913b62ec7dbb184a2fc67e4403e79e8fc0b2a2ba2e232842cad
MD5 4bf0302f4ab5c9de4db082468ecf6e8d
SHA1 805a429e3bebd07d53c64eb8d1eb35740e2a5846
SHA512 86896fa24ea728122b6e6b83fe56ee8b0ccf553051dcd80c8c3af809dd2c3be6cd874e81b697398f1f0c5f48b619430e15937195c2fab00e5ab9d538d78c5efe
TLSH
T141D0A7EFE63058951F3099E9143AB51EA14F8E098C94E8A5E844B4E634BC213C44253A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe595971.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe595971.TMP
Size 167B
SHA256 3269eae547f1d915ec49bb7930c22117b0f669dc48d85e70381d0ac6721d5d12
MD5 825b4f361cd0c2235d4db528d6a9d562
SHA1 5ea86be90b962e2ba5726ace7302d855ea994664
SHA512 618321bb2d3ba5c478171a4e450fdf3509bb5f2819b1c9f541ed94d9b1a3bf2fc82e333d1b733c2da8f80f141099600a5842bcbe2b5a9e60d893dc61e3b64aa7
TLSH
T176C08CF79A218AC68B306AD85038726EE28F8C1C8CC8DCECD00879817034A238001922
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cf5e4cf3536f67b0c7a2f353950783a4da4f58348b61196fe5e7eee3cf3d5d53
MD5 053c1d2451b5b1886f0f46108c89e2ef
SHA1 7042daf9181e6060995420b6c84bedafd6f3073a
SHA512 37ec89593c85b9988f15a4a911145ef791f9af5f70f2e553c7f0686922759b36d38e2bae86639a780ebcad82b3ecd9d730f36850ffb1a881e65b2d080a62d020
SSDEEP 384:nViFKtNn/s3n9SS3sN/8TUNTUlI4APzoNmJuV2wBfgVPtIsOJMXupQwGDHHy/7I9:cFKj+9P3gwgzyVWVVIsOJEWQwGb
TLSH
T18BB22A32D859CE7BADEB8B99B74A3A47EEE401A385C85ED4D9D85E0D00C769D030FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 55b4318868261aaaf1eb8c982bfea6ecccd21d2c0d0e9e2480e0513d7a1e6f3e
MD5 6f9341df697caba150f3275ec44d1b16
SHA1 6cd909938bf116aaeff3eb2b514817345a95d2db
SHA512 4255936f29116b9dfc0fbc3dfebb09db2b2049d67cc3373f2f37c87796f24fdbbfc6a800b234bb24de82b7f6138c7f5745f07c5db94c1aad60177bdee1b07386
SSDEEP 384:nmgiF9CcmyWCs3sNr8TUNTUlImkrzoNmf3vwBfgVPtIsOMQPRsEhkP+lFYS/71lQ:m7Fccps3kwglNNVVIsOMQPnhkoFYS/vQ
TLSH
T1F0B25C36EC98CABBECE64F89E74E7A47EEE001A7C59859D4DAD81E1D00D719D130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b6d04a3de851e0135e314a46572279ece4ac50963f44a95c750339124b5cd29a
MD5 7320518874c456d26d61dc8ebfb89740
SHA1 fd4c1b163a0e48dc015de96f5baca291d720e6d6
SHA512 e6d8860080230f7a5cf2b71d5a3e0f8c6d3b37c04e7c0f3d4bab689e799de9c444a12f0cc85deae05bb8edd7e5848d4497717da33c59a75df9a0e9d8206677ad
SSDEEP 384:nOiFKtNn/s3n9SS3sN/8TUNTUlI4APzoNmJuV2wBfgVPtIsOJMXupQwGDHHy/7I9:lFKj+9P3gwgzyVWVVIsOJEWQwGb
TLSH
T167B22A32D859CE7BADEB8B99B74A3A47EEE401A385C85ED4D5D85E0D00C769D030FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0a1acbfd18ffab37a0d7fd91f034c64baac2676b963fab7563ab0d205fadfbcf
MD5 4d6a5e182d8d16c02fe6c6e407955cb4
SHA1 3c030c1913484ca881ee5b404d589f5f6e4fe161
SHA512 aa2c17817b39290267badb4959889f9738991f482e7f19c738dfe7576062a147d28c966808e6ec6d74b5da1d03060615ca83edd2ceb1f7e93d119a61e99d5017
SSDEEP 768:tFccps3wwgll7VVIsOJEWQUGhkoFYS/vQ:5s3UB4JFQthkoaZ
TLSH
T12AC25D32D898CE7BECE64B99F74E3A43EEE011A3C5889AD4DAD91E1C00D719D174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 48134e891dfb9339cb9eb12967f20a14fb613590866fd0995ebfa7d002f34dad
MD5 2f9f32c9fd5b492c8e96294670a8db4a
SHA1 66d9bc7c1d0e1e9978b55e14992407cad94e9c4f
SHA512 59ff551264393803a7a3d008e86bbfdd226191c1e557b5b34458862d023a08f47377c9f554b5e0d2e4e9689e3920fbd8ef075fa20ad5b9f9a247f1af8e27d3ec
SSDEEP 384:nViF1tNn/s3n9Sn3sN/8TUNTUlI4kPzoNmEdkwBfgVPtIsOJMXupQNGDHHy/7IgM:cF1j+9O3gwgXgQVVIsOJEWQNGb
TLSH
T195B22B32D859CE7BADEB8B99B74A3A43EEE401A385C85AD4D9D85E0C00C769D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 07319d44ee062bb81325733afcc5a04b5735ad27a6703b88fb35a643a8d2ade4
MD5 4b9634a86a7e66eb0e5c8c1e965ef2d4
SHA1 5bdc28d60f023e7b9d4e0067d0157895ac793215
SHA512 f8a29a2ff76688076db3f112a5d99d4b15c6ef6a0012f3a9620ee4e41c8874541afdb9de986951213728ec2370b4e9ba2dea358ebdbfd81e36c1b1f3f7567991
TLSH
T15A411A98BAED1158B3B76E5AAFF6A96D847FB8372F06C46D00010D8F0762A00C971733
MD5 SHA1 SHA512 TLSH

Submit Download

tmpc37w1il5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3AAV4.tmp\tmpc37w1il5.tmp
Size 1.4MB
SHA256 09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
MD5 ae9890548f2fcab56a4e9ae446f55b3f
SHA1 e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA512 154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
SSDEEP 24576:sH9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx:0IEJxCWluyZ8UbMK
TLSH
T15B654A12A2A28833E1733F359D2B86946C367D642E74988B3FF45E0C0E79B417D39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L8FJQ.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASS.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\BASS.dll
Size 103KB
SHA256 df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
MD5 8005750ec63eb5292884ad6183ae2e77
SHA1 c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA512 febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
SSDEEP 3072:75yP416sLgrTWiKc0rUH9rRq/SJIJmECqc2QOeH:czsMH0Yl2QE3zY
TLSH
T193A301CA68D54913E28B2D73B59B61EA63D8A3C4DB63DFD11E0A030A76FA5D406B3304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

FlushFileCache.exe

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\FlushFileCache.exe
Size 29KB
SHA256 a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8
MD5 df77f2b6126f4f258f2e952b53b22879
SHA1 fedda8401ebfe872dd081538deec58965e82f675
SHA512 623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37
SSDEEP 768:kd82J2m8FCija+1I9ETzJHI6JeLzT3O1:kd82J25TzJHI6JeLz
TLSH
T18FD25A9282D1C0FDE762C5714F389411E97B3A31153196BE3AED55DE4E98760AB0C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\ISDone.dll
Size 380KB
SHA256 c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
MD5 63dc27b7bc65243efaa59a9797a140ba
SHA1 22f893aefcebecc9376e2122a3321befa22cdd73
SHA512 3df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
SSDEEP 6144:YAua3SAQSoYo+1Cjnqakl6j+vn+nLE4FZZHYg5mcQXQJSnI4EUiy:biAKg1C7qmvLE4FZR5mcHSnI4EG
TLSH
T18884BE27F686C1B2D10221319D56E7F66279FB804F2904C3BBDDEE1C5D3AB916A38253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MusicButton.png

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\MusicButton.png
Size 1KB
SHA256 7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
MD5 473a683962d3375a00f93dd8ce302158
SHA1 1c0709631834fd3715995514eef875b2b968a6be
SHA512 24ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
TLSH
T1AC21657F52385772496C03A18FAD75C10F94B65903A563CDA65EFE2807E48A60179045
MD5 SHA1 SHA512 TLSH

Submit Download

arc.ini

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\arc.ini
Size 4KB
SHA256 940ef1667026290eb982a43918c983e25c737f117fd736b4904c54e7641ecdf6
MD5 8814596a7306f0fe6d747607b12593be
SHA1 3cc008ad544ecd8ed28b2e081c30f744ebb77dc8
SHA512 8582294df62a49fee350cd6d0676f25fa61244d454a6058a0c984226fa071b7c7f39ea641ab3f4dec8e90431301d1b267d395d003acef7cf6aa128535da6cb6e
SSDEEP 96:xK90KJuKYaQKue7qK70KwKcL9KuK7mKFKQHuKPuKtK+mKiK3KaKGiKMJKKmKskKW:Lale+1w2tJXD+
TLSH
T1F7A10876386FE60441694301FF958AD9D5CD2907F7291701728FB78F8AF2A00E8A6D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\botva2.dll
Size 37KB
SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
MD5 67965a5957a61867d661f05ae1f4773e
SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
TLSH
T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fnr.exe

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\fnr.exe
Size 4KB
SHA256 699d99dd95425a15a12947bffa8205d8fa3feb86b8b3948995a29c9348b188d1
MD5 e30e3bb220ec04971d724c2fdc063349
SHA1 8d045b493e06010946c37bb7fb203473c337088e
SHA512 564b21849f9f9e1e27f9ad1df32b5594e068128578358873b20dbcb01eece738da2eb8e38c07b49becfd82544bfbc44916ca67606fb4142f778d0f8832bcfa2d
TLSH
T18F81B92D9A569035DF1F98F83E52D59A3378F2D066D0A1164371CFF42F2B8F021A811E
MD5 SHA1 SHA512 TLSH

Submit Download

host.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\host.cmd
Size 4KB
SHA256 4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855
MD5 b1377c69e6897fdb715452b1776fad57
SHA1 9e50e4dc1fd1dd782b6181bd59011340486b8e3d
SHA512 13d3b1cd9b011180e517eb8aaef5dec4c03ef53153e099c5d85b996e27571291d227ad54e70c0618b2c6749197460ea1686496644efe26a8ca3c1ec27f3afdf4
SSDEEP 48:sBxWxexnx2xXxaxAxVx+xPxixtxVxXxUx9xUxBxwxmx3xfxCxAxXxeaxXaxZxLxZ:uG1ez
TLSH
T1BCA1F4DF93A9FE52E49854F0F33A2AAA7DDFB423C9C5BDC494350066674B4B0C3A5608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts.exe

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\hosts.exe
Size 32KB
SHA256 49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119
MD5 a7f30bb876775a914422675a13dd56b3
SHA1 3ea28fe66a04ebbad2507a7dfdebf1622c701d43
SHA512 6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656
SSDEEP 768:Oa236jCLhhCBOtYcPhswK7kCQn5A11E4O:OaeY6GWT5R
TLSH
T131E2091133E8826AC67E0EB178F2521045F2FA276E32D70E0D99409F5A67BD4F412BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\idp.dll
Size 220KB
SHA256 f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
MD5 af555ac9c073f88fe5bf0d677f085025
SHA1 5fff803cf273057c889538886f6992ea05dd146e
SHA512 c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
SSDEEP 3072:00EeiIJYud1RvIOACb918qbQ0XY3chnBLqRAJUZxChtDUOZlLFv:LEIVd1VIW18qbQ0/hn4EUZxmfN
TLSH
T15624AE0079CBC437DA4F0378842AD719073AF99617744ACBEF985EAD8D352C39E36296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintb.dll

Path C:\Users\Admin\AppData\Local\Temp\is-QFRPC.tmp\wintb.dll
Size 16KB
SHA256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
MD5 9436df49e08c83bad8ddc906478c2041
SHA1 a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA512 f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
SSDEEP 384:6j34r4daxbDGQhh5tfEMrg+dOVMVjG+nHL:iorhyepdOVMVRL
TLSH
T16072D68ABF6B24F3E37206F8D1FBB73F3A792910C821AD71DB094515EE33611920521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

007 First Light.lnk

Path C:\Users\Public\Desktop\007 First Light.lnk
Size 685B
SHA256 bac9cf63e51dec2f341d8c6731f993f5f625fcbc556e1645ed539e84693c27e6
MD5 b2b2d9470af0ebc224c974a972ba38b4
SHA1 01db4c5211d45d2df343c1f6bb23ce52fdaf9aec
SHA512 0529ab6657099f4107e6a6a5663edbb45af1fe3c584a4a0ced241526a7c7d8721bb3db7c70ca77661fa38aadb487de82fa90a3760c68ed4cbf620351946c36e6
TLSH
T1E401A9A58DA73514E2FACA7251EA1343EB1032038F22D30E4138AA0D3472110F4BBF27
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 43b9de9333b3a5725f01d1c67f1cff759a35e94eb50c90978c554e67aff5a2ad
MD5 157b416403074236ddf0ab2dd546bef9
SHA1 abb76ce5a508b330c0ebd1bf66639c1b0e87402c
SHA512 9257a4e7fcb7c942ee54335b21ea644cf1d6385b2881f4aa9697210c811dfa4ee244844a2222623cad1b69e0963414296d26854d01d757eef58567760bdd6b7a
SSDEEP 96:vDZEurK9DvB1MsMrM7MzMZR0MrRJM7MRMVMrMDMDMPM7MHMzMHM3MHMOMbM+MLMp:RrK9zBFRr
TLSH
T137B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 48794a6adb23ad473f5aa0cef3e8eabe07bc30df32557ca87c8e1d9bd7fbeed6
MD5 8be2228a1c73ceb9b14ed54e3605aa34
SHA1 656caa9bcab79d157a3cc0bb66465e4ce8a75edb
SHA512 34f6702fede64ed5fbad6beff324cd873115f7bfb1ebc3f85b740525ff82bdf93171c27789d9d08c6ca6acaa434504fe4f93643e8a62e80c4d22c807577e5045
SSDEEP 96:vDZEurK9DvB1MrRJM7MRMVMrMDMDMPM7MHMzMHM3MHMOMbM+MLMKMhMYMNMHMsMl:RrK9zBsRM
TLSH
T178B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 f492a7640d4453632ae7af18f74e2fd78455da51f75611f20ac1a7654c1532ce
MD5 84c3c3e66f05445aa14836343cbe023c
SHA1 fdedfe9276550fe99c5efc4ab1ea4eefec3aefdd
SHA512 23d849060d74bcae6b90c757bff39240535c7c23022c3b5d2f3376521736931e0248abe9a28be731693c389b4cbb22e68b92e7fbaa5ec5ddbec30308d96d76cc
SSDEEP 96:vDZEurK9DvBEMzMHM3MHMOMbM+MLMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMQ:RrK9zBCRS
TLSH
T105B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 56305ec239e9eb019a0c7a823024e37d88b9c6446d4f38c9a4f09e7a98b1c6e7
MD5 f46f97b46ebc88cd999fab54ff7d67a1
SHA1 8862e6ad5fe40471676d1af3b3710ca2c2c95ca2
SHA512 0c68a50c0120f6698821b45194171a07cfc548a3ff36ceb846a6d21c40d2882b1fe0849be504c90dc8e81994965bbf76f79f8827577976576cba0246db65ba36
SSDEEP 96:vDZEurK9DvB1MHM3MHMOMbM+MLMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMT:RrK9zBaRK
TLSH
T173B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 7f161766b8c3306c19b1956937b2e145a305415eeb90bb7dd5ea335e335a7b54
MD5 74f9d52fc3b679692214e44919e4eb38
SHA1 7afee3ae3816ade0a81461a368b37c53f06b56b8
SHA512 6212333b1ca58d062085135ee8bea053901303dd386835fed78e1d936222f9e7995475ba1098d914653eccae76bde3c5a32b27966ed753d6ca8c7a3b53a6abc1
SSDEEP 96:vDZEurK9DvBjM3MHMOMbM+MLMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMDMV:RrK9zBdRf
TLSH
T11BB163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 31d24365613a56603bbe14c7dd8767e05fc8793f41854b85a36a302a7188f6de
MD5 68a6efe3063a587f42d4761b242b0bf9
SHA1 d2b7b80cbd42caea20d0c7ab8c027ae7da982a52
SHA512 9caa38513a109fc1a400dd822422cb029517262f39cb42ec1e6aa7810ff59e212421c44e8472296e846bb1318bcd9f415468454ae69b24524d4fd4f861d7d7e2
SSDEEP 96:vDZEurK9DvB1MbM+MLMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMDMDMPM7M8:RrK9zBLRB
TLSH
T18AB163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 2a949dc1e60c39880d60d2d8b52d319d8ae7f71567635a125cafb4138ac9d846
MD5 c5cf4e3de80025c2c1e253ad49f60fbd
SHA1 40f818d3047116592f444c936a25fb96bc5b2fdd
SHA512 29d0634b2f399831778814f3470209355265bcc7c1402dd7f8d83101c606bc3856318cef486025c680ebcf96abefb430e61b1ed2f83dc1ef147e391bb7e26e59
SSDEEP 96:vDZEurK9DvB1M+MLMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMDMDMPM7MHMA:RrK9zBmRO
TLSH
T18EB163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 45b2d1d6aa2aa63746d5fd7caf5faa05602c4e2339fb366ddd29cc1404a45189
MD5 a191caf190dade435e0855c3abd9eef4
SHA1 5923f980f3a0f21d02f9a94b85bdfd6001d67d32
SHA512 cabfbfed58b2866ced3d9f002cf1be253a259bdf0535ef4eb56abb25f6c270897cd003fb872a0f4721320d4decdfda8217e2e332f2d36c9c2cd08177f431ad6b
TLSH
T13041D2AE0754BE5C61B142709724743E32CFB09A49D7BACC7FBDD49E779210416A2708
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 01a77f7ac70f2ec57b38af5cb6ba4c5479c84a5b71255822827357c7e514a34b
MD5 11b5b4d5fbb345ab5ceef9127a61ae91
SHA1 312287fdc581bf407663100c7bae684788347eef
SHA512 78c98c3df04f9da34bbb32981d71ea13a1ed2e3355efee3bd2b0fa035ffbb872b578a7cab9a51e412b42e0ad154e42d805dfeb0258f4fa046bda872dd4283fa9
TLSH
T122514BEE43A4BF9C95B14170E334257D31CFB45989CB768C7B7ED4EAB7861111AA1308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 3KB
SHA256 9eae8581c570abd862dfab2b015dedfc0bb38992f20a4ff6df5451c2d0aa969f
MD5 54fdfe4ec9a151d60e3ff6ae44725611
SHA1 6ebde179c3d522cd7785018f6e13d778c8c92394
SHA512 67fc9148363577ed79244b3d01ebe5e5783aaa77a7a8a5097a570ca0d9e1835c461ca3f7e9e1648a89d2d57439a994c4983ef2185cc2b26134c53a2b6523a81c
TLSH
T19D6129EE83A4BFAC95B04170E334257D31CFB45989C7768C7B7EE4EAB7861111AA1308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 3KB
SHA256 b9e43be80669649658171addaada81690a875065550a60b68e0a0c1a2144016c
MD5 1cecb88f69db1af17ad0f22766ecd52d
SHA1 99372c5a29960e58d2bde3b201350acab7d5698e
SHA512 83c564e9c12d366fd7b8711a4ce51f3102d4a2accebea6316e097c56e183edab2c45c1810113fad6c2dbbdf6b237155fabd7b51d62326f263f132122da0bb73a
TLSH
T1DF6108EE83A4BFAC95B14170E334257931CFB459C9C7768C7B7EE4E9B7861111A91308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 2be19271db5448049de8802798411179ae99b2cc98ce08b8f2b4f624f7b4e02a
MD5 fd70d546a45e82f594b03550d2d6071c
SHA1 a3b17433c1d3c266128aa9ba7d76d8899602f9b0
SHA512 35f415d7f6d86de56fc0db662d45d3c52ef887229f3d18d432542faa6b42e1a21eb7e6a7af278fd75e0124819e370a7232d8592324fdfa5a30cfcb74b8d912d5
SSDEEP 96:vDZEurK9DvB1MLMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMDMDMPM7MT:RrK9zBeRS
TLSH
T18991A6EE87A4BFACA5B04170E334157935CF7458C9C7B78C7BBEE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 395e6d68feefdae2387aa5e45c0218398487c86dd5c8dc54491cb406b3ff23bf
MD5 3cfc055e3f93d47f4d6360bb92c40bc2
SHA1 e6653649b9d089a63b701aab6e9601fd32873fa0
SHA512 f4735592e11995c0addf563084151b9d9006537e9898e3cab5d38943b8c8027ed25c081fd6adb2effb2b7090e6ebe0db58a16d050c603d848dfb52338600f31b
SSDEEP 96:vDZEurK9DvB1MhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMDMDMPM7MHMzMHM3M4:RrK9zBPRd
TLSH
T1A2B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 2a357a65cf1a817f9a938e104715e7e61c4dfd19a7a9ba64f2828de92d4c2115
MD5 f1683eb2ef17de5f354bea174c91cc34
SHA1 628754f89859e8fb8ddec380d6da536de2345243
SHA512 031b01f0a0f29e74c5627a5bda9554e9eab7d9808501c29695bc6eb9c134e411abc494134994eb9f0804f82e4ca84972d401f4a2766c13a5d811841d89890edd
SSDEEP 96:vDZEurK9DvBIMsMrM7MzMZR0MrRJM7MRMVMrMDMDMPM7MHMzMHM3MHMOMbM+MLMS:RrK9zBMRY
TLSH
T1AEB163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 09a37ae03d23e382c5c07d8bf8bad4eb426ca9abc37a2e74d1547c425a7a5171
MD5 58c038bdfa1029309ac8934d58dabc67
SHA1 a5c07b734be2e1f22a88d88c303146eb419f96a7
SHA512 efc8a28931256ccdd8adc1f6b7105059d015aab030ad2de43a319d46c6fe3a7118f0747767769c73259bc03d695389ac7f1340cbdb1852d00d063d25953ed370
TLSH
T1AF21EE2A0749A55D22B341E50918B42FA35FD0EF0E7B9D8D3F8E444F7BA2A0C5332746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 3be6bd7ba208511027f993fa34267df2381e66ac0cc0588081a52336ba975406
MD5 b05b62045ed529ecb9b6ebda9c7a03ca
SHA1 863d797d748b9e21ca61f29104353f5030070adf
SHA512 e087677905998ee05faa64bcc4b1f1f35db6e18303353c3b4d9f85b8d5dfb3824f70bac91f1448a87790d6c0036bc091f32c2a392de20216612bfcb9ed2f60e0
TLSH
T18921DF2A0745A55C22B242B50518B42E735FE0EF0A6BA98C3F9D444F7BA260C1372705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 f5a2d2df78c0920e4a3917939f169f39aa31be1df429404336341d3fa0efe6dc
MD5 90098a89e470bd12f2ab7e3e46190346
SHA1 5ea45e12a80ab1cbb560be1823dc68260cacd84d
SHA512 7e75c1775c840b0f7c4cc29ec69c5b72be84d008979cedcab243f32fde18286479ef7ca2efe607edbc73a7d328166d99b1948738261cb5c0139a20e135ff1970
TLSH
T1E321052A0744A55C22B342B45518B42F734FE0EF0E67A9CC3F9D444F7B9160C1772705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 7a06a579c327934bec75b39bca99d09969f210e323946817ac257ad80c24959d
MD5 29476e3e293379d1bf00cb5cca2867cb
SHA1 0df705b8f203736cba3d2fbb7938e87867f9eeb0
SHA512 5986b1b5086158917308d88aae7695f84d363fa93711b959d69be5d91447b7cd3faa1f09bfa6ed217d9b52c235f7a4d3eb9d95d231d68dc682a6d4962c3edf77
TLSH
T11331F66A0754A55C61B242B45518743E734FE0DF09A7A9CC3FAD844F7B9150C1772705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 5ed94bc1c5b7cd111711306682ee9ddfaaa71967e2626d936d87755be7cbb96b
MD5 4dfdcceb3a21e723d5eff18a6d1504f2
SHA1 6860f1e5d159ce202dd104db7d288b23f3580222
SHA512 934b303382ae250deb838de9c13852555e6862ca9ef4d9c18ac7d2d53e520111d928fa5c7e7026864490028f2d8b38bad00a809557fd19bf6147261ed6f59731
TLSH
T19331026A0754AA5C61B242B44628743E738FE0DF09ABBA8C3FAD804E7B925081762305
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 2468e5f2ffde0f1c564257a2cdcfe9f3a02dc61566879c16c1cde32826f3ea16
MD5 9fb2798481ae865b8b50c179bdbca26e
SHA1 f8f17fc83ab37645eeeb698c3cf81b46a245b656
SHA512 175e60002fa666c9e0404fe8413ca9b8699c32ff15c573c5954ef466ebfc128b74c2ac401ecc62303d61dc84b826bb725dfbc5676513f4f7e6ed9dcc577c75bd
TLSH
T17531156E0754BA5C61B242744628743E728FE0DF09DBBACC3F6D904E77915081762309
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 52abe4e9a74d2129d860536fac246f8b3746b0d3636348bcb1bf4b8ced0858b5
MD5 d4311f9afc2b6a3abdac082a777b863e
SHA1 ad58b01cabc00391fadd177fbd2619b44ea510c5
SHA512 3c482ec2e2760f16409dca398b1a1a6d9959716805bb0df5969858697ac581231d57701997ac70f28b9344ea93eb0c45fa94be52a68d09cf78402c471bb0f9a1
TLSH
T1BE31156E0754BA5C61B142749628743E728FE0DF49DBBACC3F6D945E77921081762308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 420f4ab3460810eb2297082d96e197b57fbcb916de7b207e7617e4c53d3303a5
MD5 e503bbdc60f908008d2b48c11f8fa4b7
SHA1 52d54408cf1bd659f18f03583ec006b034e030c6
SHA512 593843f1dc1fbeb2ba82afebf4c7b7603155b24c2aafd98347dcbbb1b646bfaf941d0c392bedd765db76cbe50392f793b23be481e1cea984ada02206e9c9eb0e
TLSH
T1FE31136E0754BA5C61B141749628743E328FA0DE49DBBA8C3FBD945E77921081762708
MD5 SHA1 SHA512 TLSH

Submit Download

QuickSFV.EXE

Path F:\Games\007 First Light\_Redist\QuickSFV.EXE
Size 101KB
SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
MD5 4b1d5ec11b2b5db046233a28dba73b83
SHA1 3a4e464d3602957f3527727ea62876902b451511
SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
TLSH
T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickSFV.ini

Path F:\Games\007 First Light\_Redist\QuickSFV.ini
Size 155B
SHA256 74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
MD5 c5c28798bca6e9ed5d84fa67b656065a
SHA1 4b6fa3465f1b393e22e9f083b177462028a48e93
SHA512 c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
TLSH
T12DC02B3D075C40150D310E54D0CD71406D4C550F6438CC01AC0437009F10D232A18FA0
MD5 SHA1 SHA512 TLSH

Submit Download

dxwebsetup.exe

Path F:\Games\007 First Light\_Redist\dxwebsetup.exe
Size 292KB
SHA256 ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494
MD5 56d52c503adf02184f19eee4767ef60a
SHA1 ca133f67a286f4f20282e19837b53b38a27a1caa
SHA512 246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f
SSDEEP 6144:lWK8x2ZFD7h/uMdnv0iyLI6utiI1ARjhaXcoUvedlVFdo:22ZFD77dnBhi3Us8/VFdo
TLSH
T14F54F15263E9813BE0F52B7929F747432B70BDA49C7DE32E534654880CB2788B87572B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fitgirl.md5

Path F:\Games\007 First Light\_Redist\fitgirl.md5
Size 5KB
SHA256 3519baee687d04e00df0b305841aba25ebf83e9dfa71a14a74b51eb4ec572b21
MD5 2d9675081ccfbbafbe628ec86e639ae6
SHA1 6a8b78685770476e0875a4298fa61fd5a08075f1
SHA512 fe8ef9d00463d490b2f4477ecd369b42357573e84b83ee43a96efe7fd38e21e5f214fd4d4dcb5af1347af516e2c36867a83ef86015411dae77c6b95b0deb205b
SSDEEP 96:2YNyGC1lSeJ1NOYtaG60MTrHr3AcFm3xdsTJu:2YNWbqYt960M/kck
TLSH
T1AEB1CDDFE68388FD5B672E3361996D9C0352658A7AD3DB608B30C1DB0063332BA450BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path F:\Games\007 First Light\_Redist\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x86.exe

Path F:\Games\007 First Light\_Redist\vc_redist.x86.exe
Size 13.3MB
SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
MD5 99f52708b06b9c695a8d64a44740bf08
SHA1 c2743ffc36d2af40ade0e370be52d6b202874114
SHA512 d0a609f6b2f05939ab82aa5fde1bb0595206653a2ab2ce859a750f71596c4491a8074bb825484e365a4fbcdb820d5de0346e7209ea22214b090b4fe853098dce
SSDEEP 196608:fLZBJflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4L6f6psSD5YM4565kIgoOgP2edk:lHlptVYmfr7yBG/4L6f6pXc65kngP1
TLSH
T1A8E63332E494413BFFB604336A65E9203E7DA628274149F6E3C8FD4D3A7219267F7612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path F:\Games\007 First Light\unins000.dat
Size 101KB
SHA256 0f880ced802ff765279eacdbf4388253db97702d7caa84cead818edddc411ec8
MD5 d2d5de592a952260798b65c1ed659b98
SHA1 60bfaa1f3fdc4b3997edf546b6c0c428ec24ea8f
SHA512 2c4519e7a0906420860b977f225a9f548bf1dab1b76cab0b887eab985db6690ed59310673639b8daa4cac45b04471f2bed038f0ff85a39d49b5e0c7b336af4e7
SSDEEP 768:tR/BiGMjXF52ggT31h74WTclQOW4avY4qfIfDfTRgW:di7jXFa31vcrmRgW
TLSH
T14BA3BB0DAEFC5821D77ED735D9B7021837367D809662D32A279F4DBA4813B8898E7312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path F:\Games\007 First Light\unins000.exe
Size 1.4MB
SHA256 61afd4fb7f8635856e955c97b7234436fd5ae2f8d1ad3ec160772cc6a4abb4a9
MD5 37066b7002b4c7077327c553c688003b
SHA1 438f9a6f18dce816dbadc64f5810c4b8393fe55e
SHA512 f55e4c2875ad9de5794d7850c400711f579512a4fcf19fd88cdeac649373085169ca7c17bb06e3f558548ed7427103e976b0fdf3219c5a5697b3b93b2e641114
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextxp:cIEJxCWluyZ8UbMKF
TLSH
T1D9653A12A2E24833E1733F359D2B86946C367D642E74988B3FB45E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-263-0x00000000000C0000-0x00000000000CE000-memory.dmp

Download

memory/2852-104-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-112-0x0000000003CD0000-0x0000000003CE5000-memory.dmp

Download

memory/2852-95-0x0000000006BE0000-0x0000000006BEF000-memory.dmp

Download

memory/2852-91-0x0000000003CD0000-0x0000000003CE5000-memory.dmp

Download

memory/2852-111-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-116-0x0000000006BE0000-0x0000000006BEF000-memory.dmp

Download

memory/2852-92-0x0000000003E50000-0x0000000003EB5000-memory.dmp

Download

memory/2852-93-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/2852-94-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/2852-89-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-7-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-747-0x0000000003CD0000-0x0000000003CE5000-memory.dmp

Download

memory/2852-746-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-81-0x0000000006BE0000-0x0000000006BEF000-memory.dmp

Download

memory/2852-71-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-72-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/2852-48-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-22-0x0000000003CD0000-0x0000000003CE5000-memory.dmp

Download

memory/2852-29-0x0000000003E50000-0x0000000003EB5000-memory.dmp

Download

memory/2852-97-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-176-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-8-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-223-0x0000000003CD0000-0x0000000003CE5000-memory.dmp

Download

memory/2852-215-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-1130-0x0000000003CD0000-0x0000000003CE5000-memory.dmp

Download

memory/2852-1129-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-206-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-200-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-201-0x0000000003CD0000-0x0000000003CE5000-memory.dmp

Download

memory/2852-202-0x0000000003E50000-0x0000000003EB5000-memory.dmp

Download

memory/2852-1199-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3328-198-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3888-197-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4576-175-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4904-1200-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4904-2-0x000000000041E000-0x000000000041F000-memory.dmp

Download

memory/4904-88-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4904-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download