1866bac0128c85d0781679f24e21e121b073a18e5fe82e3729a962835e705420

Analysis

max time kernel
900s
max time network
853s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 5.2MB
Sample260724-ytdc2sem4v
SHA256 1866bac0128c85d0781679f24e21e121b073a18e5fe82e3729a962835e705420
MD5 35964366b62327544d6199f338ef7dc2
SHA1 6f27790976a30bbe016da155a0312ce489837fa3
SHA512 d78a7c585733c0f28915b86d4f0e81e4aa0e2a937046574802753f6ab285542c6a7ce9a0b2f3feedeaf8f0c6dafd9c63bd6d16f3e6a4fe8d242120e7341e239d
SSDEEP 98304:jqp1kX0luMO7Xev4iUipEqm0GcjnS2r6kPp4/Hk/pZLYN:jU1kX0l2qv4iUmEU9jJr66mYk
TLSH
T192463313B393D835F8718D3AD515D1A9BC033CA446D124661EF9E64F8FBE282A87B5B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.backup	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe

Executes dropped EXE 44 IoCs

pid	Process
2852	setup.tmp
2096	FlushFileCache.exe
4996	unins000.exe
1944	_iu14D2N.tmp
1020	hosts.exe
5832	hosts.exe
1176	hosts.exe
2096	hosts.exe
3116	hosts.exe
5784	hosts.exe
1452	hosts.exe
952	hosts.exe
808	hosts.exe
3476	hosts.exe
5188	hosts.exe
1732	hosts.exe
5912	hosts.exe
2404	hosts.exe
1144	hosts.exe
3296	hosts.exe
4464	hosts.exe
2296	hosts.exe
400	hosts.exe
5080	hosts.exe
1164	hosts.exe
2696	hosts.exe
3672	hosts.exe
3420	hosts.exe
3320	hosts.exe
1144	hosts.exe
5336	hosts.exe
3472	hosts.exe
2780	hosts.exe
6080	hosts.exe
2552	hosts.exe
1916	hosts.exe
1924	hosts.exe
5816	hosts.exe
4908	hosts.exe
5832	hosts.exe
2544	hosts.exe
1176	hosts.exe
5020	hosts.exe
1204	hosts.exe

Loads dropped DLL 12 IoCs

pid	Process
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
2852	setup.tmp
1748	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	setup.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_268961537\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_930322238\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1777457639\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1810331269\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1053261512\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1488025072\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1398027523\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1777457639\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1488025072\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1666722708\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1444221410\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_656867758\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1072239029\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1398027523\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1398027523\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1053261512\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_901456790\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1169143970\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1072239029\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Sigma\Fingerprinting	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe
5784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_iu14D2N.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlushFileCache.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2540	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1860-0-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/1860-63-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/1860-801-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293971694898127"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{2973EC04-2224-4553-A835-7DE81A14B1BC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2852	setup.tmp
2852	setup.tmp
2920	msedge.exe
2920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2096	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	2096	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2852	setup.tmp
2852	setup.tmp
1944	_iu14D2N.tmp
1748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2852	1860	setup.exe	90
PID 2852 wrote to memory of 2096	2852	setup.tmp	93
PID 2852 wrote to memory of 4996	2852	setup.tmp	95
PID 4996 wrote to memory of 1944	4996	unins000.exe	96
PID 2852 wrote to memory of 1748	2852	setup.tmp	97
PID 2852 wrote to memory of 5088	2852	setup.tmp	98
PID 1748 wrote to memory of 1992	1748	msedge.exe	100
PID 5088 wrote to memory of 1020	5088	cmd.exe	101
PID 1748 wrote to memory of 2540	1748	msedge.exe	102
PID 1748 wrote to memory of 3148	1748	msedge.exe	104
PID 1748 wrote to memory of 3148	1748	msedge.exe	104
PID 1748 wrote to memory of 5252	1748	msedge.exe	103
PID 1748 wrote to memory of 5252	1748	msedge.exe	103
PID 1748 wrote to memory of 5252	1748	msedge.exe	103
PID 1748 wrote to memory of 2656	1748	msedge.exe	105
PID 1748 wrote to memory of 2656	1748	msedge.exe	105
PID 1748 wrote to memory of 1512	1748	msedge.exe	106
PID 1748 wrote to memory of 2656	1748	msedge.exe	105
PID 1748 wrote to memory of 1512	1748	msedge.exe	106
PID 1748 wrote to memory of 1512	1748	msedge.exe	106
PID 1748 wrote to memory of 4768	1748	msedge.exe	108
PID 1748 wrote to memory of 6040	1748	msedge.exe	109
PID 1748 wrote to memory of 4768	1748	msedge.exe	108
PID 1748 wrote to memory of 4768	1748	msedge.exe	108
PID 1748 wrote to memory of 6040	1748	msedge.exe	109
PID 1748 wrote to memory of 6040	1748	msedge.exe	109
PID 1748 wrote to memory of 4536	1748	msedge.exe	110
PID 1748 wrote to memory of 4536	1748	msedge.exe	110
PID 5088 wrote to memory of 5832	5088	cmd.exe	111
PID 1748 wrote to memory of 1928	1748	msedge.exe	112
PID 1748 wrote to memory of 1928	1748	msedge.exe	112
PID 1748 wrote to memory of 1928	1748	msedge.exe	112
PID 5088 wrote to memory of 1176	5088	cmd.exe	113
PID 5088 wrote to memory of 2096	5088	cmd.exe	115
PID 5088 wrote to memory of 3116	5088	cmd.exe	137
PID 1748 wrote to memory of 5568	1748	msedge.exe	117
PID 1748 wrote to memory of 2300	1748	msedge.exe	118
PID 1748 wrote to memory of 5568	1748	msedge.exe	117
PID 1748 wrote to memory of 2300	1748	msedge.exe	118
PID 5088 wrote to memory of 5784	5088	cmd.exe	143
PID 5088 wrote to memory of 1452	5088	cmd.exe	120
PID 5088 wrote to memory of 952	5088	cmd.exe	121
PID 5088 wrote to memory of 808	5088	cmd.exe	122
PID 5088 wrote to memory of 3476	5088	cmd.exe	124
PID 1748 wrote to memory of 5956	1748	msedge.exe	125
PID 5088 wrote to memory of 5188	5088	cmd.exe	140
PID 5088 wrote to memory of 1732	5088	cmd.exe	127
PID 5088 wrote to memory of 5912	5088	cmd.exe	128
PID 5088 wrote to memory of 2404	5088	cmd.exe	129
PID 5088 wrote to memory of 1144	5088	cmd.exe	153
PID 5088 wrote to memory of 3296	5088	cmd.exe	131
PID 1748 wrote to memory of 4692	1748	msedge.exe	132
PID 1748 wrote to memory of 4692	1748	msedge.exe	132
PID 5088 wrote to memory of 4464	5088	cmd.exe	134
PID 5088 wrote to memory of 2296	5088	cmd.exe	136
PID 1748 wrote to memory of 3116	1748	msedge.exe	137
PID 1748 wrote to memory of 3116	1748	msedge.exe	137
PID 5088 wrote to memory of 400	5088	cmd.exe	138
PID 5088 wrote to memory of 5080	5088	cmd.exe	139
PID 1748 wrote to memory of 5188	1748	msedge.exe	140
PID 1748 wrote to memory of 5188	1748	msedge.exe	140
PID 1748 wrote to memory of 3860	1748	msedge.exe	141
PID 1748 wrote to memory of 3860	1748	msedge.exe	141
PID 2852 wrote to memory of 5784	2852	setup.tmp	143

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\is-K562D.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K562D.tmp\setup.tmp" /SL5="$400AA,4843798,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - F:\Games\Super Mario Odyssey\unins000.exe
    "F:\Games\Super Mario Odyssey\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="F:\Games\Super Mario Odyssey\unins000.exe" /FIRSTPHASEWND=$C0208 /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x30c,0x7ffe6939c188,0x7ffe6939c194,0x7ffe6939c1a0
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,15800483760330836211,8310312519799885047,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
      4⤵
      System Time Discovery
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,14005599843832247783,14977527939992491357,262144 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,540451045569894507,4206727246018422108,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:13
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,3608601805207415611,15197792312547037341,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,12969115616697443978,6593893330077248222,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,11130947872239766653,9219643922046732678,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4392,i,4594197813291287137,10181172748093501501,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,13915523338688218610,4300281208323933111,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5528,i,14533922739541787687,3128747588428229522,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,148915505064426105,12308531013672306335,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,8014048672762321594,3950292898010256769,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,4815450910510938174,13526339191051692411,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,4815450910510938174,13526339191051692411,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,5206284463807669549,10141221994717716273,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,10264022757769997617,6253883101110905929,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,14567350661777175086,10900914502930828401,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,16450795131861340268,16115286578664917724,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7364,i,8199982506152557630,8521183488901547621,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5368,i,2545178137636431412,5510231925199766206,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6452,i,14936362251336352057,8618320194191297741,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3836,i,10828139314416217591,1011800792929902497,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3676,i,2567370511851077609,15123181363811325640,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7136,i,10866752527635134136,9286211575570492401,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7352,i,3022184757397569806,979732764325502964,2097152 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,3066533005480627875,7949738097396933131,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,12930421036891931880,14846140264516182822,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,6898826311556083508,847940797023070134,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,10043133988989239278,6639468331854540134,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,18142931081648938893,4585207761752563492,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,4681039049462120352,4647684656188834878,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,12415358757518766430,5385010227887291912,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7040,i,12545193881027788811,6872567895464096672,262144 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,8078284132682379486,177092161374712778,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4084,i,10306016719243240477,3056248012806978542,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,8162929571902683777,10455469626163210286,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,2336887104490551727,10880395981770114176,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,10358697840124923865,7189370603715744514,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,15876821540724697784,14236284086095468943,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,8704824338376817488,15981075543835056165,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,593935496045612272,14415779253998254342,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8987312882446023474,13009692225185149023,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,16470984316097881832,3374722045343805800,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6469165370071423274,11762653767217592481,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,17686075808800135381,8726473708285673394,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,722691983067668590,5340601063267385949,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,9717607881666710667,10072123588296917058,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2556334081234982106,12417385902668274175,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,14765135885831175685,3323102596668574717,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,15155073024050837238,6332482413131382531,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,7985897399532387498,17025933089342128241,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,11943898285089318577,13045476463018913096,524288 --field-trial-handle=2188,i,1835065828075352656,1991928188040110554,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:6052
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:952
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:808
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add *.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:400
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5080
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add *.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4912

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1a9a5a5d49d5f2bc987f326b0208c7fc7788c6b94a51d70194579b2080a887d3
MD5 78a7a4acb551f0fb04acea927dde80e4
SHA1 359fb5d2766550d9d7268df4a881661238d41b85
SHA512 542d490b2e75985b10fc4d5afbef752577a5b6a4021ddca1fbc96b235dc23cce0e375d0c001b26d32e20f3d593a403a1ead5bc89b91d23baa4174954a996d329
TLSH
T1D6E0DF880AC8C3AEB203B8C7816D838D82803B0E93C8696A2B0CC4A47042440EBE66B4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 14ec24d4658e25e51d77875bcc318a2a589963d302fa3a672992bcca0f952552
MD5 a9b68176b556db2a02e0c1d96afd5ee2
SHA1 dd87cbc78075b6519732121b08868531f03dcd22
SHA512 271cd7827f563e192be7f42a1d2d6538841e9dccf96d07658912702b36924f4c6e078bb4d40f4b44f50e11f3bbff6fe9e40e225ca5411d329553bab241345f38
TLSH
T17CE0DFD408C8C33EA200B4C792AC438D82A1360E93C86A1A1708C888B242444E7EA6F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c6cc70fccb210bc9524952279f2ba79f751784f1b3a88672592ad6a4b9b20f67
MD5 b435fd47de7dd7b4103bff78a4e76458
SHA1 a014851227947ca51170f3e46caccab4e156c8ae
SHA512 16acad65a09d557432b067358dc0ac157e455cd8671482dfa930dccab0419056cdaea2b93b9caef9921180dc87f12f58168e5678b54ec2ed4881b616ff326f26
TLSH
T14DE0869445C9C76EA246A59781AC835C8290361F97C8A96A5B08C8A87146544F7F67F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d68c432e98e5f2546d311d59c0beb843b0d6d84b3bcb70a8a03624f34240513e
MD5 10e6027d9cc84e58b0daa838e8bf8ad2
SHA1 f8718a38c19e75a4222983b5ee53fa6ef5f8bd07
SHA512 2eeada28c751c83cee2c5fb400a262627dbf67f3a0fdd43c0de7eb00cf4bff7dc7dc33471dfd3dc4919f5905beec0cd07688638295e7d1e20f5ad0ee3f6573d6
TLSH
T120612C0453AE18C2CB1053B52BE4ABA9F6F078580C6B7F0225D4EC34E093FD960E2677
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 5fde3a3ebe81dfaf16dca610759e41c7444fb97c6a0a5ae24e99afd4b054eeed
MD5 99e64dae96c1a1c83295efc6dcda86ad
SHA1 f92ae83c82aec90c2d2323393e7334f5b08ed1a2
SHA512 fbbe2f548a08fb30afea8ca0eea868548cacbe4f7a451f0cb74a4ab346222994c988a4ed10c5eeac055afaf813df3cf055805336eaa96626fbe3a5d34d4f7fa0
SSDEEP 192:D1p4ceZTlAja3q8QpiiBitwlKrXHTykjeg1zGBFCYGhj2EUimlYgCHkN6IGj4v:D1p4ceZTlAja3q8QpiiBitwlKr3TykjC
TLSH
T1F202C1FB8BF5977E8911A1F0EA053E2F8F480452535C386AC9E89E0B93F2870D141A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 5511f8f97b6c2406a99c68793210ac77e0c6268f48e6c45d6550d0f2fe9ae626
MD5 ff6975455ba0277a6e2b9d8bcaac4725
SHA1 2a0856b612c5e632a164b41279a2f51492ec67d4
SHA512 8f9b8540b91530a3578969e653990adb2ecf03bce4f32da78025626ca72cd17bc15a2c6cd02da75da9fc10d035ed0fd5dc6eaca7108db7d533425f5045a60c91
SSDEEP 192:DUpdoeKo/ja3q8QpGqiBitwlKrXHDykjeg1zGBFCYwAhj2EUimlYK66tjNT:DUpdoeKo/ja3q8QpGqiBitwlKr3Dykjl
TLSH
T12B02AEF7C7F8963E891261F4EA153E1F8E480552535C385AC9E8AE4BA3F2870D141D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2bf75a58af3bdc098dc598d80164fd84020deac3274b2c09d4daf9dfac6290bb
MD5 021436c92c4d1a5a5559a36512377ef4
SHA1 81adf5dabca2f53cd330ba9f96c005dd9cf577c2
SHA512 1d139a8fb74e86ecc668c137a8dc5551287cda33df0ad2eaabcaa6468d2da06567da0d584ceb7a4308ea38347d7dd815f91fd1312fe61c4fcdb2eccb745607a4
SSDEEP 192:sxRLRUCy/fVs8gq8kZNmHzoA8pgVd/g6+WNWCDZfeI1KWrIp5RazofrYJG/ZIgDb:sxRLxy/fVs8R8aIu2/5lfe0rCRblWC
TLSH
T11452A41AA9385D7B5CCBE219B655FF63D2F81072A5D02E84E7FC9A0C04E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 abc2a1baa42adfb79582810449bd3027a0764a6ef18888147d6bbcabf52ed246
MD5 5d0eb85bc5870a75f4f785b5a474532a
SHA1 b8d2aab16112b1a6694971beba946caf9e5b90a9
SHA512 2f2ff3cafc76bdb18173dddf8039daa84c9c5d7b73194f55c7d0a39a7657ae1689d417bd08741abeef7aeb4fa747dbe5fd1a44f0c18dd100c9715219854ec15a
SSDEEP 384:sxRLxy/fVs8U66s8qMpRiYnazAW8pZS15posJWeT+58aIu0/5lfe0rCRblW4:snxy/frU4Mnc7WeT+58h/55B+Rb/
TLSH
T18FD20A06A924C83B9EC36D18753DBE33D9EC506262C5DEDA56ECCA0C019D1FDAB07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 352c0644c26abe8cc97d26307d1c737c780f318c0099c74f258a4dd55b5e92d2
MD5 64e688c0de5bfc7a5eca15b78d790ba3
SHA1 16005b70f5501cb8abce1df31b0574c540b15a18
SHA512 ca7143d189de415fd38258d8d0422b768300b82056606114850b0fc40b7cdf90cca52f45a8b89349e0af9a6588615204b3fe51131cf603dc621beae9204667b7
SSDEEP 192:sxRgRUCy/fVsugA8kZNmuzoA8pgr/g6+WNWed/YozrYJG/ZIgV7DeJ:sxRgxy/fVsuP8aITK/5d/nblg
TLSH
T1D142C61A6E289D3B5CCBE60DBA55BF53D2F95032A5902E48F7FC960C04E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 df39a44e8b31e57129db9166e115d92934523b85f1e606de165c3f365aaf72dd
MD5 7c50f5f41bcde7360e46eb76bc791514
SHA1 7c91baeae43ab1b2b50b8b51749857466e7c8188
SHA512 8fabccca9749f9d5127c3eee3ed1b3a35743b9071db88ca216b2d1c8cb5ecba4f0d513cd2dda467e4f21abc1ff42f4143f714f7f1d097336ee11f12eb216ee51
SSDEEP 192:sxRLRUCy/fVs8gA8kZNm9zoA8pg3/g6+WNVaDZfIxgogrYJG/ZIgDSP7DeJ:sxRLxy/fVs8P8aIwm/5qfxblWC
TLSH
T1C442B61A6A389D3B9CC7E21DBA55BF53D2F95032A5D02E48F6FC9A0C04E66DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 42eed20ff857796d91421d38c5e5a527603ad8d84380c90510d85d67ff3bf87f
MD5 41e8f6f6939b24ce1e9e6e605e44b524
SHA1 fadf8d08482ced865abacf40a494b8d8de244f3f
SHA512 78f5ee06f5e65348d85b4b8c1c52a0056bb2e198658216d0ad894d693c487c610fb40235b0834c2fea1eb5543d2001e6d76dd87f785e229672ad7ac48e4e3c48
SSDEEP 768:j26HAA7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVibBVuwVro95e0O:j26HAMEf6RWgs2f02u1jaFbB4wuox
TLSH
T190D2DB7B640DCABF4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d163513e-8560-4a47-a70c-eb2f6265d9d1\index-dir\the-real-index
Size 168B
SHA256 4144a9c6c962e365d561ce07807e0a02c8d5f04c43c5fe70ce8c1e31973b4b9c
MD5 31dbd95db6c868954119f067f0f3ce7c
SHA1 6b6a446c7fdd4b9b5612b14fa96901581416424d
SHA512 7825594a6308c5b334d16ba099c5b8beca8d5d54e6eb2ffc520ac3c8fc21699703983827510232de507af8f38ee150f459fa0e9692b901ea264d4b4307da650d
TLSH
T1FAC02B01CC164455C403113008372024173306EE08063E1200CC4405E13092CC0CF504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f6904.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d163513e-8560-4a47-a70c-eb2f6265d9d1\index-dir\the-real-index~RFe5f6904.TMP
Size 168B
SHA256 15cc737c8e1f7f9723a378cdb4fb7603ef549cc1360cdff593efa3c98a4dd2a5
MD5 66adab583110017375c33961db74a8b5
SHA1 f5612c976c2afc5083d719c20786332b052d39a6
SHA512 3012d8b3b536f1e38a0dfff133f335a98dbca548eeab4d1c3f6b0e3dbcc6f693e6b4c9854400f929b605907918241cd15f2445b9f9b8501e0e7c15c647676fb7
TLSH
T14CC02203C832ECA0C00B8030A023A22822AB0E280020BA2220C8880EA832888A0CE808
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 e41b07ed53a342857dfcc6dcd7e40e64dfcedf7790f463b49b1cf7de3e9c5a48
MD5 275b54156f73183e8bdc371a8ed62933
SHA1 71b4f82dec779cd307f2f3c63e41f3e85f0e579b
SHA512 e901d89c014b5a94093b6e4aebbef7a241b94c9909f864b72bfdb654f2b7e8d9f364a3997496f5082f20af411c5cdf9c9198414a67606dec0e000009b98886cd
TLSH
T101E0D8B32DD76810ECAF97E62C7154A40181B464D545EC9F251A93C750B1221B856C31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4baeaa2fac91cf56eb37d096aa3359002dd4e9f463568adfcd168f0cec69fb85
MD5 66ee4c9ff2a666f5dbbd7dc7646142da
SHA1 ba72bfd69cbfdd9e25998c241c83269416ac8833
SHA512 8efa0873d43fc89c8c2ae6693d161ad5dd53a8a8cf45dcec09819a02e402d7d6f696bb06ca46adefaf296731aaebeb084392a553c378b8d677380ea4fa7ae48d
SSDEEP 96:KRFSr/VPTXW2r7gooK4tgaocII7aglHPMPNP4PcPWPaPOP8WPqPnPngP2OP22K4T:CFSr/VPTm2rEostgaHII7aglHU1gkeCS
TLSH
T16D918311317A9244387EF9588068897B86C2F4723149A4BB7BBC45A25F27E03DEFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 160B
SHA256 125ceaa440e40a728181b7d5b6e0024123b1dca97811ba55aedb9d396a5e277a
MD5 7e301f427f57f364a8fa5ab05756aa1c
SHA1 23cefa3521445bd8a5b10b67ac6c6a34127dccb2
SHA512 5ba1db07b3fae9a729dc6656531d8857a80796a30d4c2958f8ca08574f8f659f81cb75fcf6faae93edefb6b9f455bbff484ba86944d30b2c2f88e808d674fc84
TLSH
T1FAC08CF30B218A8B4630AEE82028B22DE25B8A5CCCD4CCF0C04C80862834A2248055A1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 86B
SHA256 98b890bfcca43595cf76b755e94da14a41eb83325f6ee1b8c4e87b4350ebff6a
MD5 a821fcb99c66f3cb3d439fcaddeb7fda
SHA1 44584097272c7f8087ba5d04e566db8fd168821d
SHA512 6c958296cd3cd17129099b7c664bf1bc5efd64c5b5096985a85e7e2e7c09fa1fbed4d956e15e060d98721d00d807784d73d504045dc6021eeedfc88793cab36d
TLSH
T1A9A001FB8A64899A0A61A9E86139B22EE18F829CCCD8DDF0C40881D66269A221006910
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 167B
SHA256 eb28a3540db0c2635e8a970874f358d372f355374d7826f7b403fc092e399ff2
MD5 1726b3fd4bef4b664680bece807f7237
SHA1 bdb41d9c535ca654018042e883e7e0b515815363
SHA512 1add4c47174f6a684ae6f6d543044bdf1697c10a71d33f3e3b8c98e8d11142fd79ee082a3aea7d9eef0fe9be9c84b4142e9e0decb94c5c0c3a54df01b7762232
TLSH
T169C08CE30B714A8B47316EE86038B21DE26B8D6D8CC4CCF4C24CB0863038A238809561
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b1c5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5b1c5e.TMP
Size 170B
SHA256 4e7f10885c8bf7b34c4c652935d0ac947d7980a277a4a32b0a7f62411875bd9a
MD5 1792c855ff3c6e0fce62a826db09d312
SHA1 10630e39494011e8d32ae21b88f1cf692b402e60
SHA512 0cf7aba984c766197a31073e1c5355a27eba84a3cf83f2781efd4538da6c0079d84148326fa6c3b1ebe4b7982b8e87a65a498900b1e95719f64f9499251a64fc
TLSH
T1FBC08CF78A3289592B21B9E85135B1ACE04E8D0E9CC8C9B8C804F2D5A0F8352C002A10
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5bb4f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5bb4f5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aa77e7a80f2954fb290ef78cfe3fdd721468a29bfda4cefc6a0769e29b7e9366
MD5 578d2ba722add4c3720853fd484cb1a9
SHA1 67516562692d28b4928fd7340c639bb927917f21
SHA512 797a6bbb2a761ecd2d45119256e9285fe5117125b5fd3d93aa10eeae896cce15679fb3ba270b9c807c69d82630670e959e095abedfc196101c862c0a43616d54
SSDEEP 768:7/3bry/TBOWt3lcONXyer1IRCzni9Qb9Mm:7/3SNcSIqnvb+m
TLSH
T1BCF2BF30E465DE234CE6B392B14777527EF82067D9C40B94EAEAAF0D059356E170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 a4bb50852a83ac861fee13617cace9af5524c8975d436e1183f54ea6a3ae97a1
MD5 11b495f18610983720dedff928c41c7e
SHA1 7e09e64c9eb1458d4224e82ffe916a0ccbcc9a3c
SHA512 4290f544a37d52186d916bc6f8c56163151f4391cbd925759f52a4df61b7d4c7e25d389f7ddce5b7f1c645f5f5289c113d6efe7fee5c24cac9daac04f5b64662
SSDEEP 768:hFQq3uwg4o+0rRpsOWt3lIONXyer1IRCzni9Qb9Mm:wq3wcISIqnvb+m
TLSH
T1B21317F594D78A37D8AE5393A33D6E42A9FCD067B5884980BBD55E0DCC821BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aa98af51549d4cf17561bde4c8284b5a06db3e0bfcb4dfb446495d4479a5e54c
MD5 5a57d392257a01056c7c24e0e3419044
SHA1 b56deec301f44c993a88de0d0cabefa2bd5b9161
SHA512 c218b9ef0e3311a3709131b2e793ba6a8d7d9bfc95d304388983a974a85e2feb368260662d77247bb8abe60e3a45e14faf1de3551a00d1f229d904bf0bbd74ee
SSDEEP 768:J/3RO/TBOWt3lcONXyer1IRCzni9Qb9Mm:J/3INcSIqnvb+m
TLSH
T1D6F2BF30E465DE334CE6B392B14777527EF82077D9C40B94EAEAAF0D059356E170B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 df9f9c0f9e5d4b4c6f0d7a3107a272acaae4010a31c23a3fd23c75dbf6d1839d
MD5 8f4d18b9581105a8a84bda399a3dbdaf
SHA1 3c19445a43d9df036981633ec3075237ff3601b5
SHA512 eb363e2739bd44f4b0553a6fafb12bf2037b4b6c35442b420265a13660f7402055707677d034f561862c982373e932c54764bc4f83df27f800b71226d2088576
SSDEEP 768:Trv+4UNbdc3TO/TBOWt3lcONXyer1IRCzni9Q8:TbsbK36NcSIqnv8
TLSH
T19C03AE31E169AE234CF6A2D5B10B77837FB8209789C00B60EEDA6F4E059759E170F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 828fc28ed698d89eed8f700cbcf850c964d8cdd94033e99b7f057baa2db34da9
MD5 f2be6d858dba7dfced968b9a4f7e7df9
SHA1 8acf4c3f507e0f766c3359b2a1cb16c436230561
SHA512 afbb298cb78e836d52337940ccd4e8bbccde63892607ba6dfcc9df614e2be6f4ddaa4f426b88884cd85eae4831e454af1753eda807be1254616deab6955b5f1d
SSDEEP 768:hrv+4UNbdz3nb/TBOWtqONXyer1IRCzniBVeVH1SK7:hbsbV3biSIqnOEH1l
TLSH
T1E403BF32E4A89E334CE2A3D5B147B6037FB86057D6800790EDDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

340ffbfc-8f92-4b09-b975-80cfe6687ee6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\340ffbfc-8f92-4b09-b975-80cfe6687ee6.tmp
Size 1KB
SHA256 df444b5ed91161c5d2e84013e91e57a28fbbd1e4302590bddff64bc98663199a
MD5 cf37b72670448143ffb4009cf7ad060b
SHA1 e2e210f06fa8d4857fc11a37a890b02f672ed738
SHA512 5f6b4f3a776ba0f062d4fbbc5e594ca2af360bbdeaf0fcbb1d649d6f58cd39e668cad4551281c2374c3b44e3aa54648011bd878f27eb16660344550443d39f5c
TLSH
T18B3120E25C3D1AC1C4BE0EBFA08B39FC84E8D326F59474392898ED98563DA1E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

985cefb9-da3c-4ee0-8e6e-603e3ab7ba8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\985cefb9-da3c-4ee0-8e6e-603e3ab7ba8d.tmp
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
MD5 1242319dd708adac46dfcb9d40c77068
SHA1 dff7fdf5059dcaa1f995142f3980df184021fc44
SHA512 5d2bd511e97055ebc6b00ef355284a011fa67ec5483ad8ca69504713c30386e967955c27411472de128ed8661c16bd2a8289de30d9be2b75dc6ae33bcf2e2395
TLSH
T14B311FE15C3D1AD1D4BE0EFFA08B29FC84E8D216F594343A2898ED98567991E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 61b75c30abe641a76e0a66d9269ea0d41b00719efe6c7d66dfe2e498c216b3b9
MD5 2d4c0b72e75b98042d869be63649e3e6
SHA1 d09262ec2e21f2908e29e7466836d56c57f911d0
SHA512 1850ae6443e608062a4ef97d4a3386b36bcf14e0d40fd3f08f666694d2ef9628365b251bfea6e25598a8e438dc2589364027c032d8d62456e437347bbeaa5652
TLSH
T18D3111E15C3D1AD1C4BE0EBFB48B39FC84D8D226F590703A2858ED94567D65E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 082b941eee167ad340be526ff91437bff0ffb685693c40fda23299f07df8dd16
MD5 f0ecefb18808e5b47ebcb7a37cc2520b
SHA1 3d72aa8b183a7e931c97f6652ae03761e2880612
SHA512 13c2acfa22429b5b8ae7f31e100e008c535606fbbe77bbbd5d086a54c51aa47a94bedcf4451db1abee294cdbe1ee32fd1553fb6e7aa8175f8151bf0723b5672b
TLSH
T1654110E19C3D1AD1C4BE0EBFB48B39FC84D8D226F190307A2858ED94867DA1E254043F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

f804c309-8ea7-4cd4-8fa8-c4d84507f1ec.tmp

Path C:\Users\Admin\AppData\Local\Temp\f804c309-8ea7-4cd4-8fa8-c4d84507f1ec.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K562D.tmp\setup.tmp
Size 1.4MB
SHA256 09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
MD5 ae9890548f2fcab56a4e9ae446f55b3f
SHA1 e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA512 154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
SSDEEP 24576:sH9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx:0IEJxCWluyZ8UbMK
TLSH
T15B654A12A2A28833E1733F359D2B86946C367D642E74988B3FF45E0C0E79B417D39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASS.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\BASS.dll
Size 103KB
SHA256 df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
MD5 8005750ec63eb5292884ad6183ae2e77
SHA1 c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA512 febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
SSDEEP 3072:75yP416sLgrTWiKc0rUH9rRq/SJIJmECqc2QOeH:czsMH0Yl2QE3zY
TLSH
T193A301CA68D54913E28B2D73B59B61EA63D8A3C4DB63DFD11E0A030A76FA5D406B3304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS.ini

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\CLS.ini
Size 967B
SHA256 67ea3367b0ac0e484d935df5058ee4fbccbe490aac19d7466d0f6994a9e007f5
MD5 5179bed72a1929409fdcb0a446d3757d
SHA1 8074373cee700e9412c10679c45c301a72b72295
SHA512 5dded063f1fe8f61ac744a2e8c078049a98869b79747c49160e0dbf1a7aa84d5885fbf10a9f1f09f8ec3d2e11cac031ac2c703ac701b3c4c193e325acb5833e6
TLSH
T1F6113D542AAD45696610006369A17D1E8C3DCBA8C115FE2D23AB08FA25D54BAA1FB3F2
MD5 SHA1 SHA512 TLSH

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

FlushFileCache.exe

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\FlushFileCache.exe
Size 29KB
SHA256 a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8
MD5 df77f2b6126f4f258f2e952b53b22879
SHA1 fedda8401ebfe872dd081538deec58965e82f675
SHA512 623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37
SSDEEP 768:kd82J2m8FCija+1I9ETzJHI6JeLzT3O1:kd82J25TzJHI6JeLz
TLSH
T18FD25A9282D1C0FDE762C5714F389411E97B3A31153196BE3AED55DE4E98760AB0C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\ISDone.dll
Size 380KB
SHA256 c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
MD5 63dc27b7bc65243efaa59a9797a140ba
SHA1 22f893aefcebecc9376e2122a3321befa22cdd73
SHA512 3df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
SSDEEP 6144:YAua3SAQSoYo+1Cjnqakl6j+vn+nLE4FZZHYg5mcQXQJSnI4EUiy:biAKg1C7qmvLE4FZR5mcHSnI4EG
TLSH
T18884BE27F686C1B2D10221319D56E7F66279FB804F2904C3BBDDEE1C5D3AB916A38253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MusicButton.png

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\MusicButton.png
Size 1KB
SHA256 7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
MD5 473a683962d3375a00f93dd8ce302158
SHA1 1c0709631834fd3715995514eef875b2b968a6be
SHA512 24ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
TLSH
T1AC21657F52385772496C03A18FAD75C10F94B65903A563CDA65EFE2807E48A60179045
MD5 SHA1 SHA512 TLSH

Submit Download

builder.exe

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\_Redist\builder.exe
Size 146KB
SHA256 1c362db98474f6896e741234519f3c63234cfcf74071bf232e2d27990de282a2
MD5 3ed84ad98177e3bea38ed075631503c3
SHA1 02cb214a838d2e20adbdc0275b7cfad78820a98e
SHA512 9e956497b4c27c5aa75a2528949be2f82b395a52f0a4f9462add44ff19d6a13fadd900747476367efc01bea599f255def7ef671fdd3c10f7a221f90cc6e6de07
SSDEEP 3072:HbPeMjH+8bW6QzoutdXJSqb6dyNmOdT2BuHIKpvVAkN4O9TuA6/5T3Eo678i9Dpp:TeMH+8bW6IoSdcqb6dyNmOdT2BuHIKpl
TLSH
T1A6E3C7A326EC2C87DA52677E80DB6356333C6FA08337DB63516464370F03AD29E86716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\botva2.dll
Size 37KB
SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
MD5 67965a5957a61867d661f05ae1f4773e
SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
TLSH
T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\host.cmd
Size 1KB
SHA256 33288ff27d57b63027bcde3bfe69c0b6db7090408b05f8359082320f5968fdd6
MD5 3d87d06d2a83ca7f252ae2b926942e6f
SHA1 896d90ba8c4c12ba31c885f0b72b62110a96e17e
SHA512 9e4abb771c1e4a6993b2aa57c1e4d710c1e4931d2699697abc4ab0b4e271a5eb390d0aaee0cac46255169903db2e995f28b370ab70675d8af01f5f7297cbc303
TLSH
T12C31B5CF97A9FE52D59814F0F33A2AAA7DDFA023C9C5BDC494351066674B4B083A5708
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.exe

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\hosts.exe
Size 32KB
SHA256 49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119
MD5 a7f30bb876775a914422675a13dd56b3
SHA1 3ea28fe66a04ebbad2507a7dfdebf1622c701d43
SHA512 6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656
SSDEEP 768:Oa236jCLhhCBOtYcPhswK7kCQn5A11E4O:OaeY6GWT5R
TLSH
T131E2091133E8826AC67E0EB178F2521045F2FA276E32D70E0D99409F5A67BD4F412BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\idp.dll
Size 220KB
SHA256 f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
MD5 af555ac9c073f88fe5bf0d677f085025
SHA1 5fff803cf273057c889538886f6992ea05dd146e
SHA512 c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
SSDEEP 3072:00EeiIJYud1RvIOACb918qbQ0XY3chnBLqRAJUZxChtDUOZlLFv:LEIVd1VIW18qbQ0/hn4EUZxmfN
TLSH
T15624AE0079CBC437DA4F0378842AD719073AF99617744ACBEF985EAD8D352C39E36296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintb.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RFOFD.tmp\wintb.dll
Size 16KB
SHA256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
MD5 9436df49e08c83bad8ddc906478c2041
SHA1 a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA512 f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
SSDEEP 384:6j34r4daxbDGQhh5tfEMrg+dOVMVjG+nHL:iorhyepdOVMVRL
TLSH
T16072D68ABF6B24F3E37206F8D1FBB73F3A792910C821AD71DB094515EE33611920521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-V89OP.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1748_2054928054\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SM3DW + BF on Yuzu EA.lnk

Path C:\Users\Public\Desktop\SM3DW + BF on Yuzu EA.lnk
Size 565B
SHA256 5d82fb0cb9bf2afa56510132b7b26ca990f6efe7e0195ce70eab89af8dff1852
MD5 e13925a28af3e599a40b816f9e628b23
SHA1 2af959df66a5ef909d6ad5cd410a0cd4f357d44f
SHA512 08c1de828eab23fc3c216382deb77e4f658c3a85028743cf77f8d5a3ad23558e0f9dbad921030bba8fc161945d01de5d7165bbb704058f1cd78594528570f712
TLSH
T123F02690ABE50220F3FB5EB3403A5BD0872338836E63871E1804902068B02A1E03AF23
MD5 SHA1 SHA512 TLSH

Submit Download

SM3DW + BF on Yuzu.lnk

Path C:\Users\Public\Desktop\SM3DW + BF on Yuzu.lnk
Size 557B
SHA256 eb882747addf50be7d6c5f1d6d0e9ff49a900c93224d5d07f8412e6a5cbf5fba
MD5 6b972fa444f39867c51dc082bd5b2f45
SHA1 54140dc16f5e8b457779d9dc11389b8b913f3c60
SHA512 f03a83141dfe437ddc6efbc4df405a61b7edbe8be8de28c344cd772110adc743ffd5b868ed7f44e8d03d8df6275caa0a8f3859f872ba1d9ecdaf167864a1f801
TLSH
T1EDF08690ABE51620F3FB5E73413E5BE0876339936E56872E1844D021A8B0561E137F13
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1398027523\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_455386783\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 e6601dd422305de6785f117ccc44da95cc93a81ff7e8a3fbd468addec0e4ff7d
MD5 58421074edc8f1582cc0299102c3bf77
SHA1 20ada82af0155a3d40b1f016f957100bf500f7b4
SHA512 2c69f3ced8d00427b2cf9f9fe4518a9bca33f567c904c6dbc08d0cd66307349e956934db3f27ce4aeb8051144275e52eb52fd245b5de9ada6f58740c7c5099c1
TLSH
T16121EE2A0749A55D22B341E50918B42FA35FD0EF0E6B9DCD3F8E444F7BA2A0C5362746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 51165e19155d14bc8dd1be9d6a7ef939852fd68f5fe3ed7d53ef06479ed18bfa
MD5 a7f40251928b82ebe3d83b59874ed5a9
SHA1 c80e2c1a2841236b8f880d72e1b9fb9d5223afa2
SHA512 c5315c205d44412351d9b946aa383355dd0d03515d3be910519e93f46ef66912f194194c75ae7f76292af24df63a8bab8657d8da36429feba59ab6de32e80b21
TLSH
T17C21F12A0745A55C22B241A5491CB43F735FD0EF0E6B9DCC3F9E444F7B9260C1362705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b26e3be3c9df185157f2f3331ffdbb16aeaf91c34e3b4665e0308cf46279f4d3
MD5 daa809181eaed54c45a84ae9102233e8
SHA1 5b01c511adc483cbb79e75a4c29c73d02922e38a
SHA512 3313874035608d3f2e5163fd2f9e5de48fa3cb1cbe4046a957bc3bd966aa5eb56a5f515e2313700f8f0498d59ad65cf8b5587d5c92fb74cb838bcb5de4f0e754
TLSH
T10221E26A0745A65C22B241A44528B43E734FD0EF0AABADCC3F9E444F7B9260C1762705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 6e12901cffc97ec172a877d1dced4672620168d0611104f55a6948f9daa39161
MD5 31aa8df3f13ad314634c11423ae8b60b
SHA1 91c2a5e53d987e5a2fc59f9fc04ebfa539133857
SHA512 a121ab40c67493c8cb14233b98b575db684b7fe9734296701662b934b3a49241f1dd65122372bebdbce2ad9a94dc67af4986d53aafb7c262479d97fc5cf7f843
TLSH
T15431F66A0744A65C21B241B44528743E724FD0DF09ABADCC3F9E544F7B9260C1762709
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 0e355b7c756bc13f0ccf8ee0137e3036508df762b87af93d65e24432e355f8f6
MD5 a97a4758ef53991d029ffb70c7c7e406
SHA1 f3af4cc4767b96f02e8db1a18d29c2d59de0266e
SHA512 01163d924cfc12e392143af35836753d81ab65df18f75b11a7f6a62a7cb4ebf3a277e667580cc9b687c2eb6179eae048b5343c1f50ebd0af940b91025f59cc19
TLSH
T16C31F46E0794BA5C21B241B44628743E728FD0DF09DBBECC3FAE944F7B926081762309
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 2467e4fd110554d266fcf34e5e88506086d2bf836657e1ce881c1acfb94b6dff
MD5 9025dd4f8eb4745815eb073401fd91c5
SHA1 60315426ac805277991c828d3327110770222062
SHA512 f29cb5ac85e60988b005a0cdbc1c0c88d3c3bf3f7478e1c20168864efbc745b13739515241f72c8c394fbb5a88bf30f9cb7a81f4f2453afaf998c09ea865956c
TLSH
T1EE31246E0784BA5C21B241748628743E728FD0DF09DBBACC3FAE944F7B926081762709
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ec65b56d4dc66ee997eb0f9e162ad389db3e84a7805c44310b869335926aecc2
MD5 b635675ddf17aa711c81cc5257902089
SHA1 a51036a0a5e754cff94fa47b3b6bdcd79527f959
SHA512 be4ddb9e519d1dccae619f0832cb4195243f1d56cc8a4be9ebd9def5b4eec1414788297005cd5819b8f3352cd164b2f5fdb983f6fa0cb6f134cc071d632d41ea
TLSH
T1E631376E0754BA5C61B141749628743E728FE0DF49DBBACC3FAE944F77925081762708
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 3f0e91cbaea4c12dc93f3c6d865fabcb167d5140d65af2376bf64a42918928fd
MD5 f0d0a7b1f878483ef4423ed5340daa4c
SHA1 445eaea2a99015aab15c41a8ea6007f911295672
SHA512 c78d82d4af72f4b91f0f0986c2666585f3a405a9686d727eab5986ffd6994d20178e87d9c189edc097b66a8fcc7d42a00a8ccca268b1d190305506e5024a2b9a
TLSH
T1CE31136E0794BA5C61B141709628743E328FA0DA49DBBACC3FBED49E779210817A2308
MD5 SHA1 SHA512 TLSH

Submit Download

QuickSFV.EXE

Path F:\Games\Super Mario Odyssey\_Redist\QuickSFV.EXE
Size 101KB
SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
MD5 4b1d5ec11b2b5db046233a28dba73b83
SHA1 3a4e464d3602957f3527727ea62876902b451511
SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
TLSH
T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickSFV.ini

Path F:\Games\Super Mario Odyssey\_Redist\QuickSFV.ini
Size 155B
SHA256 74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
MD5 c5c28798bca6e9ed5d84fa67b656065a
SHA1 4b6fa3465f1b393e22e9f083b177462028a48e93
SHA512 c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
TLSH
T12DC02B3D075C40150D310E54D0CD71406D4C550F6438CC01AC0437009F10D232A18FA0
MD5 SHA1 SHA512 TLSH

Submit Download

dxwebsetup.exe

Path F:\Games\Super Mario Odyssey\_Redist\dxwebsetup.exe
Size 292KB
SHA256 ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494
MD5 56d52c503adf02184f19eee4767ef60a
SHA1 ca133f67a286f4f20282e19837b53b38a27a1caa
SHA512 246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f
SSDEEP 6144:lWK8x2ZFD7h/uMdnv0iyLI6utiI1ARjhaXcoUvedlVFdo:22ZFD77dnBhi3Us8/VFdo
TLSH
T14F54F15263E9813BE0F52B7929F747432B70BDA49C7DE32E534654880CB2788B87572B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fitgirl.md5

Path F:\Games\Super Mario Odyssey\_Redist\fitgirl.md5
Size 2KB
SHA256 5ef25e04796bf274231816b0a5fd0c38497389670126e5e54e2a1921fd2320ad
MD5 e603d6067d690d618ee9e8d1e117316d
SHA1 67add8d467874ffd7fca3514d5b229b399f207e7
SHA512 f8d18a114470a8a159173577ca7abdddd3f4a8923220fe895cb599a5cc615d990c4dfb0bab21addba1c67b90e6e269cb580726cf28ce02bf1d64c3b71b188676
TLSH
T1F551D85EE30F4838991DB292A251ED2E487B2476776483C8817502D3F89366AEA3F0B0
MD5 SHA1 SHA512 TLSH

Submit Download

vc_redist.x64.exe

Path F:\Games\Super Mario Odyssey\_Redist\vc_redist.x64.exe
Size 14.4MB
SHA256 ee84fed2552e018e854d4cd2496df4dd516f30733a27901167b8a9882119e57c
MD5 7492e87aec4a8f14cb436e13bf1610db
SHA1 3b32bc4b8dec32fd52a8f4bda5648c3a8d999d7c
SHA512 2fc7fab43d47770058814dd48e76a4ecf47bb6eac962940b84b2bd9f25409c1b0112e9bae085b764b285e189fb7563288026fc099cf174d2981bc25bb6cdb651
SSDEEP 393216:3OlptVYmfr7yBG/4s02nXro63eKFJoxyFdMTCx3:3+pttD7yBG/lnD/FJokFdMex3
TLSH
T160E63332E158413AEAE30433AD68F5356F3EA108276489B6E3DCDD4D2A751D273FB612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x86.exe

Path F:\Games\Super Mario Odyssey\_Redist\vc_redist.x86.exe
Size 13.7MB
SHA256 4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6
MD5 ae847b3fbabee336879a72e53962c12c
SHA1 aa56b7fe64e957fba2a6bdc65abbaa47438ec620
SHA512 740fe01920043559c85484624e58a9ad028fe960206ddc56d180ac579c83901e9237095eb085fba3ea1b66cd6bb85dd61d333d266662e643df07ee4a2cc19678
SSDEEP 196608:1RjUzJ/LflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO46viGqANE6c9QvJM4IR92gTmx:nG/rlptVYmfr7yBG/4dp6wf4IPAaGBD
TLSH
T127E63333A154407AE7F70433AA99F6242E7D962C631048BBD3DCDC4D6E791A227FB252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game.ico

Path F:\Games\Super Mario Odyssey\game.ico
Size 200KB
SHA256 dc23ea95fef03a355fd40e56fc4629768ce9336bd9ab9ba6508153ec0bf1374f
MD5 c0d29a99991a6bb33fbaacb2674bfb3b
SHA1 120e183a48e31cdc89cdd5f1de794187d5b7af81
SHA512 a6596bde907a07cd357d5023ce00c1de99c868cf0653e2785777423a429a58086e2e2448aa8c5f07e66402a0eff20c730231982fcc0c8ce37a97b11ee0796c3f
SSDEEP 6144:S0iP6ODDP0oHpqGLE3GPzzD3PMvpv5+s4beHGH9:P0P1Tw3Cn6vybXd
TLSH
T186145CC5858A46A6FEBC2FB014D55E8D32177EFA3C2419193C2EBC6C463529F602D7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path F:\Games\Super Mario Odyssey\unins000.dat
Size 95KB
SHA256 2913d1b7a0f43ad0afa340549733a0e037eaed9221f72945a2beedb743d8c19f
MD5 8d5864523073b1e1ff95ac78d9b4f631
SHA1 70bc28da097ff01247da1f8ee020f5729ffbdf26
SHA512 4e352ca86698dabb91f4f07f0708a4dec977de3e86727c7041b27119255bc166fb322d9b3890650ced7d41410c854536172c2a67ae9bda38c27102180d65a78e
SSDEEP 768:N6R/jqfj/HfMHPd31h7AK9AMLks6YFiOefDfvQp:NeEj/Hs31BAG6Qp
TLSH
T1BD939A0DAEFC5821D77ED635D9B7021837317DC1A662D72A279E4DBA4813B8888E7312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path F:\Games\Super Mario Odyssey\unins000.exe
Size 1.4MB
SHA256 c90338c63d995186dfae42a2e7af8b030217cba91e396520a0de7af00b365a22
MD5 5571bb5b7ea7ef89306f72cd98e5d659
SHA1 d9c4988c4d4607357bf37f637914b8cf089f1bca
SHA512 700147567b4ae644447d9cad4dafee0ec94dd3d7a7fc5715156d7432a6381d3046bac35e0fe4035cb95052a23053b040133362b9227014d64d93ae1502b98175
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextxI:cIEJxCWluyZ8UbMK8
TLSH
T13E653A12A2E24833E1733F359D2B82946C367D642E74988B3FB45E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1020-235-0x00000000006B0000-0x00000000006BE000-memory.dmp

Download

memory/1860-2-0x000000000041E000-0x000000000041F000-memory.dmp

Download

memory/1860-801-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1860-63-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1860-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1944-177-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2096-145-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2852-68-0x0000000003D10000-0x0000000003D75000-memory.dmp

Download

memory/2852-179-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-150-0x0000000003D10000-0x0000000003D75000-memory.dmp

Download

memory/2852-98-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-99-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Download

memory/2852-92-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Download

memory/2852-96-0x0000000007120000-0x000000000712F000-memory.dmp

Download

memory/2852-93-0x0000000003D10000-0x0000000003D75000-memory.dmp

Download

memory/2852-91-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-90-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/2852-88-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-149-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Download

memory/2852-758-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-800-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-67-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Download

memory/2852-69-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/2852-148-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-147-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-81-0x0000000007120000-0x000000000712F000-memory.dmp

Download

memory/2852-70-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/2852-66-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-72-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/2852-71-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-38-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-193-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-30-0x0000000003D10000-0x0000000003D75000-memory.dmp

Download

memory/2852-759-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Download

memory/2852-23-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Download

memory/2852-181-0x0000000003D10000-0x0000000003D75000-memory.dmp

Download

memory/2852-180-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Download

memory/2852-186-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-9-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/2852-8-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4996-176-0x0000000000400000-0x0000000000579000-memory.dmp

Download