d6abd0c13e32ea620ae486b27c399dda0eea91b9602ea988f1c50a5dc58d35c8

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 7.6MB
Sample260723-23lbsscq3t
SHA256 d6abd0c13e32ea620ae486b27c399dda0eea91b9602ea988f1c50a5dc58d35c8
MD5 28bd6698ed0f6b9b153c68ec12ceced1
SHA1 640c64f4365a73f3ff9c16895443166fc190a54f
SHA512 84690173f67c6a71d303b9e9e14f6a9d144d454d7ffcb677a2511b653614506b6224fc49b116d26a5030b0394a0fee83fcc24c2fdabac0bea060106e0da19134
SSDEEP 196608:6vtAZj41WJ6pzqZjwT6p9fs4O72pPascr:GKZ9JozqZjWKfPxPaBr
TLSH
T117863302638384BDEC6A08387CA2DC40AD1677AD75C5685B3EFDCB4F49BE6C276751A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.backup	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe

Executes dropped EXE 52 IoCs

pid	Process
936	setup.tmp
4700	FlushFileCache.exe
4908	unins000.exe
6104	_iu14D2N.tmp
5580	hosts.exe
2628	hosts.exe
4564	hosts.exe
6080	hosts.exe
4700	hosts.exe
5748	hosts.exe
3540	hosts.exe
1292	hosts.exe
3088	hosts.exe
2876	hosts.exe
5140	hosts.exe
1384	hosts.exe
5460	hosts.exe
4592	hosts.exe
5792	hosts.exe
4496	hosts.exe
3716	hosts.exe
124	hosts.exe
4280	hosts.exe
4860	hosts.exe
1192	hosts.exe
5452	hosts.exe
4564	hosts.exe
5136	hosts.exe
3744	hosts.exe
1552	hosts.exe
6000	hosts.exe
2220	hosts.exe
2020	hosts.exe
2784	hosts.exe
2424	hosts.exe
4576	hosts.exe
1040	hosts.exe
380	hosts.exe
3092	hosts.exe
3088	hosts.exe
4360	hosts.exe
4568	hosts.exe
4844	hosts.exe
4132	hosts.exe
3448	hosts.exe
3440	hosts.exe
4776	hosts.exe
5948	hosts.exe
2084	hosts.exe
4748	hosts.exe
1168	hosts.exe
5452	hosts.exe

Loads dropped DLL 11 IoCs

pid	Process
936	setup.tmp
936	setup.tmp
936	setup.tmp
936	setup.tmp
936	setup.tmp
936	setup.tmp
936	setup.tmp
936	setup.tmp
936	setup.tmp
936	setup.tmp
936	setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
352	cmd.exe
1852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_iu14D2N.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlushFileCache.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5808	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1800-0-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/1800-77-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/1800-591-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293217023929044"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{3EE3BBA5-72F0-43C0-B945-080ABCC8CA84}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
936	setup.tmp
936	setup.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4700	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	4700	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
936	setup.tmp
936	setup.tmp
6104	_iu14D2N.tmp
4684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 936	1800	setup.exe	89
PID 936 wrote to memory of 4700	936	setup.tmp	92
PID 936 wrote to memory of 4908	936	setup.tmp	94
PID 4908 wrote to memory of 6104	4908	unins000.exe	95
PID 936 wrote to memory of 4684	936	setup.tmp	96
PID 936 wrote to memory of 1852	936	setup.tmp	97
PID 4684 wrote to memory of 2128	4684	msedge.exe	99
PID 1852 wrote to memory of 5580	1852	cmd.exe	100
PID 4684 wrote to memory of 5676	4684	msedge.exe	103
PID 4684 wrote to memory of 5808	4684	msedge.exe	102
PID 4684 wrote to memory of 5676	4684	msedge.exe	103
PID 4684 wrote to memory of 5676	4684	msedge.exe	103
PID 4684 wrote to memory of 4444	4684	msedge.exe	104
PID 4684 wrote to memory of 4444	4684	msedge.exe	104
PID 4684 wrote to memory of 4500	4684	msedge.exe	105
PID 4684 wrote to memory of 3416	4684	msedge.exe	106
PID 4684 wrote to memory of 4500	4684	msedge.exe	105
PID 4684 wrote to memory of 4500	4684	msedge.exe	105
PID 4684 wrote to memory of 3416	4684	msedge.exe	106
PID 4684 wrote to memory of 3416	4684	msedge.exe	106
PID 4684 wrote to memory of 3020	4684	msedge.exe	107
PID 4684 wrote to memory of 3020	4684	msedge.exe	107
PID 4684 wrote to memory of 3020	4684	msedge.exe	107
PID 4684 wrote to memory of 4796	4684	msedge.exe	108
PID 4684 wrote to memory of 4796	4684	msedge.exe	108
PID 4684 wrote to memory of 4796	4684	msedge.exe	108
PID 1852 wrote to memory of 2628	1852	cmd.exe	109
PID 1852 wrote to memory of 4564	1852	cmd.exe	137
PID 4684 wrote to memory of 1636	4684	msedge.exe	111
PID 4684 wrote to memory of 1636	4684	msedge.exe	111
PID 4684 wrote to memory of 2328	4684	msedge.exe	112
PID 4684 wrote to memory of 2328	4684	msedge.exe	112
PID 4684 wrote to memory of 2328	4684	msedge.exe	112
PID 1852 wrote to memory of 6080	1852	cmd.exe	114
PID 1852 wrote to memory of 4700	1852	cmd.exe	115
PID 1852 wrote to memory of 5748	1852	cmd.exe	116
PID 1852 wrote to memory of 3540	1852	cmd.exe	117
PID 1852 wrote to memory of 1292	1852	cmd.exe	118
PID 1852 wrote to memory of 3088	1852	cmd.exe	160
PID 1852 wrote to memory of 2876	1852	cmd.exe	120
PID 1852 wrote to memory of 5140	1852	cmd.exe	121
PID 4684 wrote to memory of 5728	4684	msedge.exe	122
PID 4684 wrote to memory of 4612	4684	msedge.exe	123
PID 4684 wrote to memory of 5728	4684	msedge.exe	122
PID 4684 wrote to memory of 4612	4684	msedge.exe	123
PID 1852 wrote to memory of 1384	1852	cmd.exe	124
PID 1852 wrote to memory of 5460	1852	cmd.exe	125
PID 1852 wrote to memory of 4592	1852	cmd.exe	126
PID 1852 wrote to memory of 5792	1852	cmd.exe	127
PID 1852 wrote to memory of 4496	1852	cmd.exe	128
PID 1852 wrote to memory of 3716	1852	cmd.exe	129
PID 1852 wrote to memory of 124	1852	cmd.exe	130
PID 1852 wrote to memory of 4280	1852	cmd.exe	131
PID 1852 wrote to memory of 4860	1852	cmd.exe	133
PID 4684 wrote to memory of 5688	4684	msedge.exe	134
PID 1852 wrote to memory of 1192	1852	cmd.exe	135
PID 1852 wrote to memory of 5452	1852	cmd.exe	172
PID 1852 wrote to memory of 4564	1852	cmd.exe	137
PID 1852 wrote to memory of 5136	1852	cmd.exe	138
PID 4684 wrote to memory of 3272	4684	msedge.exe	139
PID 4684 wrote to memory of 3272	4684	msedge.exe	139
PID 4684 wrote to memory of 1820	4684	msedge.exe	140
PID 4684 wrote to memory of 1820	4684	msedge.exe	140
PID 936 wrote to memory of 352	936	setup.tmp	144

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\is-91EFO.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-91EFO.tmp\setup.tmp" /SL5="$4011A,7402000,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - F:\Games\ELDEN RING\unins000.exe
    "F:\Games\ELDEN RING\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="F:\Games\ELDEN RING\unins000.exe" /FIRSTPHASEWND=$402CA /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7fffef43c188,0x7fffef43c194,0x7fffef43c1a0
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,16483645860869467193,11781961398778982145,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:11
      4⤵
      System Time Discovery
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,989442095832715460,10193525002042170260,262144 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:2
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,7515247308702034407,15729431882281180244,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,14697388196155551944,8548110606572072918,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,6878123767828493301,8303437523255146998,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7601682451332508838,16207112517887937752,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,10827668042339511011,17438921527214032269,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,8879584066659435524,7839349594113735503,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5372,i,17336205165652568208,7993375300512738803,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,648769667509464898,15450350100170013057,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,18006794973090408091,15634781870374281101,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,2699199581306618144,6532560042880696520,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,2699199581306618144,6532560042880696520,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3768277410325504127,11259942506147610518,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,16383253777440670483,4880082531137310652,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6512,i,18230968978697375018,9701646423600283342,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4048,i,9082661104352806598,5232612275717415814,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5056,i,2379750170031863811,9422835483389206651,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6808,i,16838002837237032588,3418154949845670825,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5144,i,6858527006496516585,14705497099625046447,2097152 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,3307256544240683020,17049020449753221677,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,6688427654828865873,12856260953993156808,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,18135654021062591567,456321504910878821,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,15931862355677759167,12910671002436301479,524288 --field-trial-handle=2928,i,15262442759673964620,14750727937327710357,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add *.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:124
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5136
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:352
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:380
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add *.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall ELDEN RING.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\ELDEN RING\Uninstall ELDEN RING.lnk
Size 692B
SHA256 c8b5cac418a170f2e3b6e222bb375dab03ba4a5854734a79733abbdf1e1e0a3e
MD5 4ef3ca3949df4f598531435f74107b66
SHA1 2a8e9d371e13f207284af14ab18a0bb36018d357
SHA512 3e625f7f387e810bcfb5b9795b17ab1a6940245e1de240a96a73416b027c9fdc239f0f5e9f3638ad9e42f360478a6fd109a8fde282eab3339676bf040f4821ba
TLSH
T1F601262226ED9559C2908B3700D70397C350BB075F594F1F44AC9D05CE51500E57BFF2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ce408e4bbabf2b7e42283b5582c596f55200d2a3428ce0c1dea0a0bed26c8140
MD5 0defdcf33514a463a9f309a47f48d87e
SHA1 bb2f128c0d78c4de049f8e1eeb36004c287e7bd9
SHA512 5b2883f17e511b3ec3f48a7c48a5cd39f15483c294d38201b1c00b7b6f381efaae2451e7a7644c93787f90a2a112cd582945c52748c1be3a6462eba2275287cd
TLSH
T10C713FD1136375AADB25807190EFA40E3BF78726C9873E29A3A85DF0FC1AF6859D1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac66e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ac66e.TMP
Size 3KB
SHA256 0927b160c0ea2dd2fea9b578d4fde32d522915e3ed0bb926e71393ce96e525a4
MD5 cf79102d5c1e3b8e902dba832fc3ea9f
SHA1 5fd2e4129aa6117888dfaf01bb78407ff4833bfe
SHA512 460efe826f4bc77bca80da3b2b86ba7497281ad071c082d199d3d94c0a24f486d09c25289aee4031d89064723f5c7bd4a018feb9a95b88d6f4d06ddbd51ac4d2
TLSH
T19D51F7E2132379AADB25417291EF604F3BE78325C58B3A01A3685DF0FC4AF2854E1123
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fb846e790ad385fa34fe546a4626b37708b0286ee3d69a3b6c8b243a2121a400
MD5 cf021eae9e0bac1d1a201ab2f973baa1
SHA1 ca535947d5375eb780f22c3e7836f089aed195c2
SHA512 42b02035eceebf8aa9f3971d3a2af69a4826df85fce423a4e9c9a884ad76040b3d053e7d809d4c591c54655bc769376037aa2fd2498f68aaf52dc8415dc45785
SSDEEP 192:sxRSR2cC1/ftsXNgfZ8zoA8pgl/g6+WNWyxfYEniKzGIPIgVIbJ:sxRSk1/fts9gBtM/5pfuGvO
TLSH
T1DD42B71AAD68993B9CCBD25DBB25BF53D2F95033A1D05F48A6FC860C04EA6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6c0d0a3fe4a290f701c4b607d4dd5a7f5ad58b8dbabbddf1e7fb3088dfb81fea
MD5 eb3e2a283c46e1769a48a4bd8736f7b7
SHA1 8550bba31af5306e407789d1ccdcca44b221d600
SHA512 8fed972c9c383cfcbe4dedc554ee9ae8501522f50cc8ecd5f777c53ac51b8ee836e101a1fdf4824ec36e18aa3d38e1e5b734e3d7d8be8da8c9120d3bf0ff4621
SSDEEP 192:sxRBR2cC1/ftsDNNfZazoA8pgT3/g6+WN7EyxfeI+IorIY5OZ+EfiKzGIPIgD5It:sxRBk1/fts5NBXq/5bfeRrfjGvO
TLSH
T1E952C65AA974897B9CCBD259BB15FF67D2F95063A1D01F44A7FC8A0C00EB6DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 70060edd40448be0b32bab2a98c0b445f12f569d487bb3b0cab6160b9edded84
MD5 3c4ed61576a630124493dbb31983184a
SHA1 caaa498bc48409d55bc192b8b7ec6e17abde6fe5
SHA512 0d8f357c27c76488aab2398a133f84b32e8cb0445c747af57a044c999d444dce08aa755d3af30ca21a6ec79b1c0b5650b87264888c8ccb79ad040ce124bcac94
SSDEEP 192:sxRBR2cC1/ftsDNgfZ8zoA8pgl/g6+WNWyxfYEniKzGIPIgDrIbJ:sxRBk1/fts5gBtM/5pfuGvY
TLSH
T19E42B71AAD68993B9CCBD25DBB25BF53D2F95033A1D01F48A6FC860C04EA6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7837f3e6c2f903e1c05a02a2408101bbe52716c0f6240f0ddeb70884c4d4cba2
MD5 2b13c769dafc21ecc11ed8a0f06a6464
SHA1 3ac8068413afdeae2c57101c2c0fe10e0500925f
SHA512 841fb92f43672eb902203709efe41d735db2b8e84c5c53bac04cb74331e6daa9cd9ee7c3782f5bca9f095dd24d3733e2f78848ad3429beafd6c7617b78d0ead6
SSDEEP 768:0UQiUW7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkJ2OVqvrop6L:0UQiU2E7PaWgH7feQu1jabJ2Iq8A
TLSH
T148D2DB7B640DCB7F4F804ADDEC197E9B6DA802CB9698CD8047FA851C03C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 30f65a3b543a1aa9321a54ca413a60609ca7b8aa0ba1bff41859f3647c7a0307
MD5 6c10ea9be058f178e49109e9cf338f27
SHA1 5a41d73cf549f4b14e85ff1b97c26dde2d479dc0
SHA512 023cd7af1e39a8f2d90e4c4ea09c03bf51b7b3e98e1eb125eca25740e6472fe60edfa9eed8ac2a24cdbb8f6b9382739a74cc35438e5f88b69bc6a886ba8078e8
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQ2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfyYAKRemem:CdqjXNn7Oj4XfV+gBkldQ2r6WwYYZo9C
TLSH
T18191B915327A13817C7D691C8479981BC6D270A2341CB92F77F85AA20F6BE474CFEAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 160B
SHA256 733180992b269dd91022bf45971f70ca0a5ce0f34340b238a5e274b60c202aa7
MD5 e3f5313145cedd77c05078a0a2c31588
SHA1 96bb57085bb4989a3fb91467bd02c87c43533a77
SHA512 0bff2d751111fb204f68df846b9d5bb008fb86938943f2c122d187e49b6829686a4a394f80906da0db3b98155eb5346003556786d3fcb5747141f49500bbb7f2
TLSH
T135C08CE747204A8A0E70AEE8223CB11DD30F824CC8D8DCE4D54C808614396134842679
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5aaf1d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5aaf1d.TMP
Size 167B
SHA256 5412634941cf5036831d080de30f4477b89380fced26c891a6175fc340783a35
MD5 54d9b61287ae7053395076ab9784a3bf
SHA1 700507eb5c25293062e9c89f472f725080d25979
SHA512 5f1797aaa22f4d85448b991a5fd7b943fb3c87617e42f3433dbd4aeed3c0150d49555306a148f6dfa6981ddc802a49c800ae4b98ffb9023f39c46fcc993f48a2
TLSH
T191C08CE747200A8A0F7269EC213CB14DD21F8D8CCCC8CCE4D54CB08220396138C01679
MD5 SHA1 SHA512 TLSH

Submit Download

8ac32d73-85c2-471f-b623-6e703a9127fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8ac32d73-85c2-471f-b623-6e703a9127fb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 06482fe6548cd113a253a3c96f9557927480008eacfe3be2ff0df25bed8f93a9
MD5 6673af81757fd658fce05bf984ac6792
SHA1 d0ea1da90950e78c90abaa28e8b8a4a24c2e76cb
SHA512 97aef572facebbd33f699a26fa1d9d0a5b51e310103adf50e5fc32066e7655c1910c4e254729ecbc72fea93e436a6c56c700721708109b72606aa47e71b9784f
SSDEEP 768:Uz3a8qG0UKDSK48dHeByERRFzjK3Ycb9MQ:Uz36Ge748dHSyw/Gb+Q
TLSH
T102F2AEB09C698E738CAFD2497A977757AEF04077C1E85A18D2D9EB0E448369D0B06C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 95e5e88e787fb39816bafb7e8f83a3b8cfbebb4f547ce8a963f000ae83a84b91
MD5 d2577bf3f542c5d979ce242021a05811
SHA1 32f4a8425ba4ad407926fb15290e3e95683d8e11
SHA512 e54b087a63da8c074c5651c7db5012d42fed84991ace9d9b3b48c304ab26920397c767a40a0a8c28fb9c768e332275de43c827ed3c4c662aeaf9dc91dd3dff2d
SSDEEP 768:Qrv+4UNbdf3+qGteDrCK48dHeByERRFzjK3Y8eVH1SCj:QbsbJ3HGsrr48dHSyw/+EH1Z
TLSH
T18003CF71A8A85E774CEB92897687B617BFF4411382C41B64C1DD6F4E868B1DC030BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b61d0906ae82f0ecf048b89d13d55c4d51f33fe018600e38f858e3e67351eb6d
MD5 0ef3eb0f49907da0fd565c4d366837f9
SHA1 26f337807fe0558909c3cfa449a5c10353c07124
SHA512 8e091858b193e5c2c7b5a8aef844c9ffc2fe494dca0b70f78dccf3f954072970402c844c1decf5015bd80f11675cbf0acc9d3e89e6314eae0884ce89f9e38c2d
SSDEEP 768:jz3b8qGVFD2K48dHeByERRFzjK3Ycb9MQ:jz35GP/48dHSyw/Gb+Q
TLSH
T187F2AEB09C688E738CAFD2497A977797AEF04177C1E85A18D2D9EB0E448359D0B07C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4161e0ca-7d91-498c-a23b-211b40e3078f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4161e0ca-7d91-498c-a23b-211b40e3078f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-91EFO.tmp\setup.tmp
Size 1.4MB
SHA256 09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
MD5 ae9890548f2fcab56a4e9ae446f55b3f
SHA1 e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA512 154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
SSDEEP 24576:sH9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx:0IEJxCWluyZ8UbMK
TLSH
T15B654A12A2A28833E1733F359D2B86946C367D642E74988B3FF45E0C0E79B417D39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-EP8HN.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASS.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\BASS.dll
Size 103KB
SHA256 df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
MD5 8005750ec63eb5292884ad6183ae2e77
SHA1 c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA512 febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
SSDEEP 3072:75yP416sLgrTWiKc0rUH9rRq/SJIJmECqc2QOeH:czsMH0Yl2QE3zY
TLSH
T193A301CA68D54913E28B2D73B59B61EA63D8A3C4DB63DFD11E0A030A76FA5D406B3304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS.ini

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\CLS.ini
Size 992B
SHA256 04e502f03bfb01da3aafd37070ff17a12a2081c8171fde10109345c9a22ba663
MD5 25e9bcc535f7a2d089cafd72734b011a
SHA1 41a42001b20b2baf3ac710b2826f8097f8d0825c
SHA512 b75fc08dade152fab3d6bd4291a266e2a23fa03f1b36a76de8a0e5830244534a0b66d71111419e23eed5edb0bcc0dd7322bf80dd009843e7e520becd7a840ba9
TLSH
T1F1117C10596D45A92120406335B17D1E8C39CFA4D522BE2C23D708FF2AE89BA60BF6F6
MD5 SHA1 SHA512 TLSH

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

FlushFileCache.exe

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\FlushFileCache.exe
Size 29KB
SHA256 a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8
MD5 df77f2b6126f4f258f2e952b53b22879
SHA1 fedda8401ebfe872dd081538deec58965e82f675
SHA512 623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37
SSDEEP 768:kd82J2m8FCija+1I9ETzJHI6JeLzT3O1:kd82J25TzJHI6JeLz
TLSH
T18FD25A9282D1C0FDE762C5714F389411E97B3A31153196BE3AED55DE4E98760AB0C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\ISDone.dll
Size 380KB
SHA256 c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
MD5 63dc27b7bc65243efaa59a9797a140ba
SHA1 22f893aefcebecc9376e2122a3321befa22cdd73
SHA512 3df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
SSDEEP 6144:YAua3SAQSoYo+1Cjnqakl6j+vn+nLE4FZZHYg5mcQXQJSnI4EUiy:biAKg1C7qmvLE4FZR5mcHSnI4EG
TLSH
T18884BE27F686C1B2D10221319D56E7F66279FB804F2904C3BBDDEE1C5D3AB916A38253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MusicButton.png

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\MusicButton.png
Size 1KB
SHA256 7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
MD5 473a683962d3375a00f93dd8ce302158
SHA1 1c0709631834fd3715995514eef875b2b968a6be
SHA512 24ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
TLSH
T1AC21657F52385772496C03A18FAD75C10F94B65903A563CDA65EFE2807E48A60179045
MD5 SHA1 SHA512 TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\botva2.dll
Size 37KB
SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
MD5 67965a5957a61867d661f05ae1f4773e
SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
TLSH
T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\host.cmd
Size 1KB
SHA256 074dc7875d0a83eb27be8523f9493b7c7a1c27764445c863681178eed098ac16
MD5 beadfba1ff0642e9e3af76fc0ab457dc
SHA1 9ac0a709b0888ff02b76368aa7c072a59f083822
SHA512 8488020ed961b7ce36e52c96111411db14ec5d41dc197b4f03d48be36e5859983331e42566a2523197d091ebc2f538f32fadcdc1b7035812a46a994ab165f695
TLSH
T1B031E2DF97A9FE52D49814F0F33A2AAA7DDFB023C9C6BDC494351066674B4B083A5708
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\hosts.exe
Size 32KB
SHA256 49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119
MD5 a7f30bb876775a914422675a13dd56b3
SHA1 3ea28fe66a04ebbad2507a7dfdebf1622c701d43
SHA512 6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656
SSDEEP 768:Oa236jCLhhCBOtYcPhswK7kCQn5A11E4O:OaeY6GWT5R
TLSH
T131E2091133E8826AC67E0EB178F2521045F2FA276E32D70E0D99409F5A67BD4F412BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\idp.dll
Size 220KB
SHA256 f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
MD5 af555ac9c073f88fe5bf0d677f085025
SHA1 5fff803cf273057c889538886f6992ea05dd146e
SHA512 c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
SSDEEP 3072:00EeiIJYud1RvIOACb918qbQ0XY3chnBLqRAJUZxChtDUOZlLFv:LEIVd1VIW18qbQ0/hn4EUZxmfN
TLSH
T15624AE0079CBC437DA4F0378842AD719073AF99617744ACBEF985EAD8D352C39E36296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintb.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L87I6.tmp\wintb.dll
Size 16KB
SHA256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
MD5 9436df49e08c83bad8ddc906478c2041
SHA1 a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA512 f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
SSDEEP 384:6j34r4daxbDGQhh5tfEMrg+dOVMVjG+nHL:iorhyepdOVMVRL
TLSH
T16072D68ABF6B24F3E37206F8D1FBB73F3A792910C821AD71DB094515EE33611920521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4684_7686967\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ELDEN RING.lnk

Path C:\Users\Public\Desktop\ELDEN RING.lnk
Size 617B
SHA256 8729ff270aa1b3720daa019d76aec256909fa9e2c4599d7cadf47e6a626b27e7
MD5 cbece35024ef4154e69a1254c796d21c
SHA1 072d2e23564dd92d5b57f3eeefb42c0c23017e35
SHA512 5e36d00d8377d738ecd2d24d7f86955cc58c5eeec30c4256efefd956593dcb1a45fab7d8a489aa003ed54d47de88cd7cc8266dc08fbfce98d84f6beb063b2396
TLSH
T1BCF0DFA44CED261CE3B2CB328A77E7D8CB5079838B02422F10146403A832600333AE77
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 09a37ae03d23e382c5c07d8bf8bad4eb426ca9abc37a2e74d1547c425a7a5171
MD5 58c038bdfa1029309ac8934d58dabc67
SHA1 a5c07b734be2e1f22a88d88c303146eb419f96a7
SHA512 efc8a28931256ccdd8adc1f6b7105059d015aab030ad2de43a319d46c6fe3a7118f0747767769c73259bc03d695389ac7f1340cbdb1852d00d063d25953ed370
TLSH
T1AF21EE2A0749A55D22B341E50918B42FA35FD0EF0E7B9D8D3F8E444F7BA2A0C5332746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 3be6bd7ba208511027f993fa34267df2381e66ac0cc0588081a52336ba975406
MD5 b05b62045ed529ecb9b6ebda9c7a03ca
SHA1 863d797d748b9e21ca61f29104353f5030070adf
SHA512 e087677905998ee05faa64bcc4b1f1f35db6e18303353c3b4d9f85b8d5dfb3824f70bac91f1448a87790d6c0036bc091f32c2a392de20216612bfcb9ed2f60e0
TLSH
T18921DF2A0745A55C22B242B50518B42E735FE0EF0A6BA98C3F9D444F7BA260C1372705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 f5a2d2df78c0920e4a3917939f169f39aa31be1df429404336341d3fa0efe6dc
MD5 90098a89e470bd12f2ab7e3e46190346
SHA1 5ea45e12a80ab1cbb560be1823dc68260cacd84d
SHA512 7e75c1775c840b0f7c4cc29ec69c5b72be84d008979cedcab243f32fde18286479ef7ca2efe607edbc73a7d328166d99b1948738261cb5c0139a20e135ff1970
TLSH
T1E321052A0744A55C22B342B45518B42F734FE0EF0E67A9CC3F9D444F7B9160C1772705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 7a06a579c327934bec75b39bca99d09969f210e323946817ac257ad80c24959d
MD5 29476e3e293379d1bf00cb5cca2867cb
SHA1 0df705b8f203736cba3d2fbb7938e87867f9eeb0
SHA512 5986b1b5086158917308d88aae7695f84d363fa93711b959d69be5d91447b7cd3faa1f09bfa6ed217d9b52c235f7a4d3eb9d95d231d68dc682a6d4962c3edf77
TLSH
T11331F66A0754A55C61B242B45518743E734FE0DF09A7A9CC3FAD844F7B9150C1772705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 5ed94bc1c5b7cd111711306682ee9ddfaaa71967e2626d936d87755be7cbb96b
MD5 4dfdcceb3a21e723d5eff18a6d1504f2
SHA1 6860f1e5d159ce202dd104db7d288b23f3580222
SHA512 934b303382ae250deb838de9c13852555e6862ca9ef4d9c18ac7d2d53e520111d928fa5c7e7026864490028f2d8b38bad00a809557fd19bf6147261ed6f59731
TLSH
T19331026A0754AA5C61B242B44628743E738FE0DF09ABBA8C3FAD804E7B925081762305
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 2468e5f2ffde0f1c564257a2cdcfe9f3a02dc61566879c16c1cde32826f3ea16
MD5 9fb2798481ae865b8b50c179bdbca26e
SHA1 f8f17fc83ab37645eeeb698c3cf81b46a245b656
SHA512 175e60002fa666c9e0404fe8413ca9b8699c32ff15c573c5954ef466ebfc128b74c2ac401ecc62303d61dc84b826bb725dfbc5676513f4f7e6ed9dcc577c75bd
TLSH
T17531156E0754BA5C61B242744628743E728FE0DF09DBBACC3F6D904E77915081762309
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 52abe4e9a74d2129d860536fac246f8b3746b0d3636348bcb1bf4b8ced0858b5
MD5 d4311f9afc2b6a3abdac082a777b863e
SHA1 ad58b01cabc00391fadd177fbd2619b44ea510c5
SHA512 3c482ec2e2760f16409dca398b1a1a6d9959716805bb0df5969858697ac581231d57701997ac70f28b9344ea93eb0c45fa94be52a68d09cf78402c471bb0f9a1
TLSH
T1BE31156E0754BA5C61B142749628743E728FE0DF49DBBACC3F6D945E77921081762308
MD5 SHA1 SHA512 TLSH

Submit Download

data.unity3d.xx

Path F:\Games\ELDEN RING\AdvGuide\ELDEN RING Adventure Guide_Data\data.unity3d.xx
Size 894KB
SHA256 c8fc5574831c399a7129e011557fa78044f21f397e23751caf768520043e14e9
MD5 0ed95941c41064719c92ef024b429808
SHA1 c4b89b22788e1ec1a3718acdd3cd849cf1a15d7b
SHA512 60220916d540b22d165634b8a74c0972b84d15c7736ac54c56660d914d7a9fadebb4fc44e23127cae25597942c1b149d6b461328be872c200b0c94eb3edbf723
SSDEEP 24576:9QE8sy7hCZvdmAmxXf0ieMwOsUKjB2cm:96smAm+/FjB2
TLSH
T14215B6D33E620D97F67000F4C9AC7C8447BA1D6EEB4BA5887160DA8D849BC39A74F64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Language Selector.exe

Path F:\Games\ELDEN RING\Game\Language Selector.exe
Size 36KB
SHA256 68427419310dc53e862f644f8af084ee145ec3904c7e554527e1cb6c970467c4
MD5 e31961e5da8bf02dcd642863bcfc983e
SHA1 4195966766ed1b55da17cabcdf91d43c501a681c
SHA512 d4737c12e5aed306f0dad0a334539908c5fdbdd1aa20a8db7a1b3b153214eb7a8adf6030a7f420230a2e03373ed80a1f7b45df7970a27ed2df65588398e968bf
SSDEEP 384:wRDScvTios+jWiJTy3WEC8S/KRpV1px1VHoLFiFE8aCfPa3ca2yq:wR1ivOJJ1XCXbogq8aOasV
TLSH
T1CBF21E55B981DA19D55939F0DC07CBC10B267DA288609B0736B23F1E3A3BDA3CD6B81D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Origins.ini

Path F:\Games\ELDEN RING\Game\Origins.ini
Size 316B
SHA256 3a9a8ffbf836fc324269d34d36e213fafedba3d1ba0221414ad72492aa555964
MD5 9238bf7c327ca40981165add228cf3a7
SHA1 ba361426d8774972b06ee2b24377486d062584a9
SHA512 db38d6e728d109f1ca6d8b8b9d10afbad949186db687826260b9ee70c9b36572b1ee3fe83bc47804fa6e4a13497f983c7a38a9eade3ee2bdd50c131db11cc39c
TLSH
T19FE026A6A641A896903D5059611B8D82DAA1B1FD00839A879ABD2518524BA883F38E35
MD5 SHA1 SHA512 TLSH

Submit Download

QuickSFV.EXE

Path F:\Games\ELDEN RING\_Redist\QuickSFV.EXE
Size 101KB
SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
MD5 4b1d5ec11b2b5db046233a28dba73b83
SHA1 3a4e464d3602957f3527727ea62876902b451511
SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
TLSH
T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickSFV.ini

Path F:\Games\ELDEN RING\_Redist\QuickSFV.ini
Size 155B
SHA256 74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
MD5 c5c28798bca6e9ed5d84fa67b656065a
SHA1 4b6fa3465f1b393e22e9f083b177462028a48e93
SHA512 c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
TLSH
T12DC02B3D075C40150D310E54D0CD71406D4C550F6438CC01AC0437009F10D232A18FA0
MD5 SHA1 SHA512 TLSH

Submit Download

dxwebsetup.exe

Path F:\Games\ELDEN RING\_Redist\dxwebsetup.exe
Size 292KB
SHA256 ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494
MD5 56d52c503adf02184f19eee4767ef60a
SHA1 ca133f67a286f4f20282e19837b53b38a27a1caa
SHA512 246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f
SSDEEP 6144:lWK8x2ZFD7h/uMdnv0iyLI6utiI1ARjhaXcoUvedlVFdo:22ZFD77dnBhi3Us8/VFdo
TLSH
T14F54F15263E9813BE0F52B7929F747432B70BDA49C7DE32E534654880CB2788B87572B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fitgirl.md5

Path F:\Games\ELDEN RING\_Redist\fitgirl.md5
Size 4KB
SHA256 00aa987bce8e4f6dd0a47545ab88083d15fa9da4c12257dc70d4ded6a51d219f
MD5 2f81afe2f476f1e6a48e18878211b0e8
SHA1 aac5ecf042425b5d21f6466425bebc2d1a3ccad3
SHA512 55aca78a34e87459b8d20df0a43d8df7a9338941cb2560f102c279a3b472f66d8cf6581e2b6ba761ba0b5cfeef8e4e1086e10eaaf02e72c23a498deeff734b0f
SSDEEP 48:VQ61uRsPNue1AwCFQtUkKqiBpOrUDrgQkgIomA1vIl1E0QsUHBJGBXyA5w7j8NII:qR8oPMnPMUQzxmiAbEJv7Gvq7oOHYhiW
TLSH
T13781C9FEBEB7307B6457E2A74FC2FC00301CE0D295FED0A8B89E5663511B29491016D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path F:\Games\ELDEN RING\_Redist\vc_redist.x64.exe
Size 14.4MB
SHA256 ee84fed2552e018e854d4cd2496df4dd516f30733a27901167b8a9882119e57c
MD5 7492e87aec4a8f14cb436e13bf1610db
SHA1 3b32bc4b8dec32fd52a8f4bda5648c3a8d999d7c
SHA512 2fc7fab43d47770058814dd48e76a4ecf47bb6eac962940b84b2bd9f25409c1b0112e9bae085b764b285e189fb7563288026fc099cf174d2981bc25bb6cdb651
SSDEEP 393216:3OlptVYmfr7yBG/4s02nXro63eKFJoxyFdMTCx3:3+pttD7yBG/lnD/FJokFdMex3
TLSH
T160E63332E158413AEAE30433AD68F5356F3EA108276489B6E3DCDD4D2A751D273FB612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x86.exe

Path F:\Games\ELDEN RING\_Redist\vc_redist.x86.exe
Size 13.7MB
SHA256 4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6
MD5 ae847b3fbabee336879a72e53962c12c
SHA1 aa56b7fe64e957fba2a6bdc65abbaa47438ec620
SHA512 740fe01920043559c85484624e58a9ad028fe960206ddc56d180ac579c83901e9237095eb085fba3ea1b66cd6bb85dd61d333d266662e643df07ee4a2cc19678
SSDEEP 196608:1RjUzJ/LflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO46viGqANE6c9QvJM4IR92gTmx:nG/rlptVYmfr7yBG/4dp6wf4IPAaGBD
TLSH
T127E63333A154407AE7F70433AA99F6242E7D962C631048BBD3DCDC4D6E791A227FB252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path F:\Games\ELDEN RING\unins000.dat
Size 100KB
SHA256 f10bbfbff06f1407a3fbcd868159f4c21f463bdca8b951fd9837c8ca6cab1368
MD5 2c066169bcd568ee44d679b53dd082b3
SHA1 99fc8618ce4de81934eaaa010fb710ad83ec2362
SHA512 eca94093ab4b0fbc5281720047c77801717e8a042229f7c1236a27f6a9cab4a4a233c46695dc7d25e8840b69551ea580f7c1bb16283bf7c4c7cd67e48d57ce96
SSDEEP 768:uRawIkj7RReT5931h7J9SUCYUJvjfDfvPdR:GFj7Re31EUyXPdR
TLSH
T118A3AB0DAEFC5825D77ED735D9B7021837367DC09662C32A279F4DBA4813B8898A7321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path F:\Games\ELDEN RING\unins000.exe
Size 1.4MB
SHA256 ae6f3ecc13596b4c8c384eabbd1884953cf665bd24d49460083f8c67203f7dfb
MD5 7db6692c9e344423a9e6deee553e7bea
SHA1 5549cc5ce5b82267bcd353349053e5fc737c42bc
SHA512 f33a15eb286aaf22e506a58c279b9481ab853ffaba7a65d5106abeae61bc5d78465710fbdaec82c9f1be368b905b67470d21c85177e6279be22a348344c43ed6
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextxC:cIEJxCWluyZ8UbMKu
TLSH
T1FF653A12A2E24833E1733F359D2B82946C367D642E74988B3FB45E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-88-0x0000000007270000-0x000000000727F000-memory.dmp

Download

memory/936-117-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-206-0x0000000003E20000-0x0000000003E85000-memory.dmp

Download

memory/936-205-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/936-8-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-9-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-264-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/936-23-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/936-30-0x0000000003E20000-0x0000000003E85000-memory.dmp

Download

memory/936-263-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-220-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-213-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-177-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-51-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-118-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/936-122-0x0000000007270000-0x000000000727F000-memory.dmp

Download

memory/936-96-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/936-110-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-204-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-103-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-100-0x0000000007270000-0x000000000727F000-memory.dmp

Download

memory/936-99-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/936-101-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-98-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/936-97-0x0000000003E20000-0x0000000003E85000-memory.dmp

Download

memory/936-566-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-567-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/936-211-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-79-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/936-590-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/936-78-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/1800-591-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1800-77-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1800-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1800-2-0x000000000041E000-0x000000000041F000-memory.dmp

Download

memory/4700-176-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4908-202-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/5580-242-0x00000000001C0000-0x00000000001CE000-memory.dmp

Download

memory/6104-210-0x0000000000400000-0x0000000000579000-memory.dmp

Download