77b205c0c392670b838e9dde3d5edf721d732121f6e21122a11c272704f87a50

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 5.1MB
Sample260730-xt26qswbla
SHA256 77b205c0c392670b838e9dde3d5edf721d732121f6e21122a11c272704f87a50
MD5 8477d70cbe66d171c41c8cf36dda0a43
SHA1 89d061cc94c21c2e2e259716bb1a0fb9c0717a57
SHA512 5d7d4d99419676a0068244c430183e5386fa49a3434ace20b33e77a5ccfb03ef1dbd3cd6d48a11870e2ecb1cbd1aacad761450ea2245d00b2dc7c82f4cf5d303
SSDEEP 98304:ff7wCQInrje/CAVMJy1WzsE48iY2cwudRVh8CsN:ffn6/VSlzzxjZLju
TLSH
T178463301B3D32036E0A104355E26D5BC5C11BAA759E2611A2F78DF8F0BB91C7BDF9BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe

Executes dropped EXE 64 IoCs

pid	Process
4132	setup.tmp
2880	fnr.exe
1600	FlushFileCache.exe
1088	unins000.exe
1200	_iu14D2N.tmp
2060	hosts.exe
3948	hosts.exe
4732	hosts.exe
2964	hosts.exe
1964	hosts.exe
2040	hosts.exe
4928	hosts.exe
6116	hosts.exe
5308	hosts.exe
2768	hosts.exe
4652	hosts.exe
4800	hosts.exe
4796	hosts.exe
3236	hosts.exe
1536	hosts.exe
428	hosts.exe
5960	hosts.exe
3028	hosts.exe
3788	hosts.exe
1912	hosts.exe
4328	hosts.exe
2832	hosts.exe
1900	hosts.exe
5388	hosts.exe
4672	hosts.exe
6020	hosts.exe
4244	hosts.exe
2440	hosts.exe
3232	hosts.exe
1248	hosts.exe
6084	hosts.exe
4876	hosts.exe
3192	hosts.exe
3536	hosts.exe
1164	hosts.exe
2068	hosts.exe
5808	hosts.exe
4628	hosts.exe
2560	hosts.exe
1328	hosts.exe
2832	hosts.exe
3636	hosts.exe
4980	hosts.exe
5392	hosts.exe
3100	hosts.exe
868	hosts.exe
2528	hosts.exe
5268	hosts.exe
608	hosts.exe
4636	hosts.exe
5872	hosts.exe
4908	hosts.exe
1176	hosts.exe
3536	hosts.exe
5800	hosts.exe
2936	hosts.exe
5628	hosts.exe
6112	hosts.exe
5612	hosts.exe

Loads dropped DLL 11 IoCs

pid	Process
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp
4132	setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	setup.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5044_423014790\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4184	cmd.exe
4640	cmd.exe
2880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_iu14D2N.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2344	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2108-0-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/2108-88-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/2108-914-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299122544100223"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{80BADA45-80C2-4B8B-A35F-EF23D6133FD3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	setup.tmp
4132	setup.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1600	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	1600	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4132	setup.tmp
4132	setup.tmp
1200	_iu14D2N.tmp
5044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 4132	2108	setup.exe	89
PID 4132 wrote to memory of 4184	4132	setup.tmp	92
PID 4184 wrote to memory of 2880	4184	cmd.exe	94
PID 4132 wrote to memory of 1600	4132	setup.tmp	95
PID 4132 wrote to memory of 1088	4132	setup.tmp	97
PID 1088 wrote to memory of 1200	1088	unins000.exe	98
PID 4132 wrote to memory of 5044	4132	setup.tmp	100
PID 4132 wrote to memory of 4640	4132	setup.tmp	101
PID 5044 wrote to memory of 792	5044	msedge.exe	103
PID 4640 wrote to memory of 2060	4640	cmd.exe	104
PID 5044 wrote to memory of 4668	5044	msedge.exe	106
PID 5044 wrote to memory of 2344	5044	msedge.exe	105
PID 5044 wrote to memory of 4668	5044	msedge.exe	106
PID 5044 wrote to memory of 4668	5044	msedge.exe	106
PID 5044 wrote to memory of 5192	5044	msedge.exe	107
PID 5044 wrote to memory of 5192	5044	msedge.exe	107
PID 5044 wrote to memory of 2376	5044	msedge.exe	109
PID 5044 wrote to memory of 2376	5044	msedge.exe	109
PID 5044 wrote to memory of 2376	5044	msedge.exe	109
PID 5044 wrote to memory of 2636	5044	msedge.exe	110
PID 5044 wrote to memory of 2636	5044	msedge.exe	110
PID 5044 wrote to memory of 2636	5044	msedge.exe	110
PID 5044 wrote to memory of 3148	5044	msedge.exe	111
PID 5044 wrote to memory of 3148	5044	msedge.exe	111
PID 5044 wrote to memory of 3148	5044	msedge.exe	111
PID 5044 wrote to memory of 1980	5044	msedge.exe	112
PID 5044 wrote to memory of 1980	5044	msedge.exe	112
PID 5044 wrote to memory of 1980	5044	msedge.exe	112
PID 4640 wrote to memory of 3948	4640	cmd.exe	113
PID 5044 wrote to memory of 5640	5044	msedge.exe	114
PID 5044 wrote to memory of 5640	5044	msedge.exe	114
PID 5044 wrote to memory of 5492	5044	msedge.exe	115
PID 5044 wrote to memory of 5492	5044	msedge.exe	115
PID 5044 wrote to memory of 5492	5044	msedge.exe	115
PID 4640 wrote to memory of 4732	4640	cmd.exe	117
PID 4640 wrote to memory of 2964	4640	cmd.exe	118
PID 4640 wrote to memory of 1964	4640	cmd.exe	119
PID 4640 wrote to memory of 2040	4640	cmd.exe	120
PID 4640 wrote to memory of 4928	4640	cmd.exe	121
PID 5044 wrote to memory of 4556	5044	msedge.exe	122
PID 5044 wrote to memory of 4556	5044	msedge.exe	122
PID 5044 wrote to memory of 1200	5044	msedge.exe	123
PID 5044 wrote to memory of 1200	5044	msedge.exe	123
PID 4640 wrote to memory of 6116	4640	cmd.exe	124
PID 4640 wrote to memory of 5308	4640	cmd.exe	125
PID 4640 wrote to memory of 2768	4640	cmd.exe	126
PID 4640 wrote to memory of 4652	4640	cmd.exe	191
PID 4640 wrote to memory of 4800	4640	cmd.exe	128
PID 4640 wrote to memory of 4796	4640	cmd.exe	129
PID 4640 wrote to memory of 3236	4640	cmd.exe	221
PID 5044 wrote to memory of 3488	5044	msedge.exe	132
PID 4640 wrote to memory of 1536	4640	cmd.exe	133
PID 4640 wrote to memory of 428	4640	cmd.exe	134
PID 4640 wrote to memory of 5960	4640	cmd.exe	135
PID 4640 wrote to memory of 3028	4640	cmd.exe	136
PID 4640 wrote to memory of 3788	4640	cmd.exe	137
PID 4640 wrote to memory of 1912	4640	cmd.exe	138
PID 4640 wrote to memory of 4328	4640	cmd.exe	139
PID 4640 wrote to memory of 2832	4640	cmd.exe	163
PID 4640 wrote to memory of 1900	4640	cmd.exe	141
PID 4640 wrote to memory of 5388	4640	cmd.exe	143
PID 4640 wrote to memory of 4672	4640	cmd.exe	145
PID 5044 wrote to memory of 5940	5044	msedge.exe	146
PID 5044 wrote to memory of 5940	5044	msedge.exe	146

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\is-OPRN6.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OPRN6.tmp\setup.tmp" /SL5="$400A6,4785233,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\fnr.exe arc.ini fgrplc -1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\fnr.exe
      C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\fnr.exe arc.ini fgrplc -1
      4⤵
      Executes dropped EXE
      PID:2880
- - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - F:\Games\Returning to Mia\unins000.exe
    "F:\Games\Returning to Mia\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="F:\Games\Returning to Mia\unins000.exe" /FIRSTPHASEWND=$402B2 /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x388,0x7ffa385ac188,0x7ffa385ac194,0x7ffa385ac1a0
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,555625121999101258,3107014599837412203,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
      4⤵
      System Time Discovery
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15525629182530120893,1504381102719190976,262144 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,8753341472434796120,477728023509334495,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,16339938859811940348,505887702473543224,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,7494512891486787998,9446645012616355550,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4380,i,14385185511773522496,6558672960507424351,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4392,i,14990860429097605394,10196636205817453650,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,1433136818979807351,2316607822389684463,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5468,i,10513341715102589328,11733147735332086765,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,17129796045625171634,15822793431978879846,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,5533995486321127363,11199488905738177626,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1902063057929751920,799870466726358292,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1902063057929751920,799870466726358292,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,1819871825800821430,5411012176338234262,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,17581345282831464466,13952426155371983747,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3820,i,13237719002434629486,1565415687229950230,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6508,i,656901164634278622,14236692889552870765,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5168,i,1347968200958255735,5003665536049063676,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5196,i,9014168402921794886,7109903151043424620,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5560,i,7456349953447029807,10096458952949566606,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6936,i,11967207468027018425,6567631645663420933,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5592,i,3751064199384750400,3479747077796584512,2097152 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,11823503498643055914,7814699537125477626,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,2013152640806172674,3466843281493967918,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,4405513874147448515,11673206872845844475,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,7888091126147651732,12309251920511683417,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:14
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,15716392643496435932,10139080999463352497,524288 --field-trial-handle=2436,i,16338143698656007029,13061974317179059048,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:14
      4⤵
      PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:428
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:868
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:608
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:868
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:712
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:932
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:236
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:244
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3316

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 145KB
SHA256 b10ce7368a16942c3ceaddfb81e9ad7f04f6fee88e5335017bde13628966550b
MD5 3a1e170e1c35e3c8149974925dfd2980
SHA1 c4ff17f1f8856a23b0ced3e7988b98909d74b62a
SHA512 8ac35243bdb667869a7e9cb2bf8f16968b5061e38f8af562ae6e78f97503966ff065c713cc34d07a705777663d7fb19a7a9b7ce0365bb8af2d1f76550f685917
SSDEEP 3072:CKuX/+UVpIcQxWg20fKGTPmJrRdAhLJPJKWrZgy1QIXxdq1vOFpYvVvYpTk4KEK8:qX/XVmNAg4HJrRmBKIZJ6IGvOF0GQ4f1
TLSH
T117E31272006FF85069A800FEE5DB5D6BF1D73C89E7612E60D4A25607883CA76241F2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7c9790653d453e5804053516adb4643b8c5df1ba874779b5608980076e02248a
MD5 f07c7f1f24e26a7b9017fe14317cc3b0
SHA1 2be8920f04e60471f155814f754cac8156a9805f
SHA512 648f858227b082c87160ebeb19f42ce804c499402fbb48a7f17ef53ec8670cc786afba18b51d04353e35f82030f5fd72bdbc95eba66927d3e76d40d1efdd77b7
TLSH
T1B051773863B3E4C0FF20E3B268E13B563234B146560BBF5375441DF4544A7A847B3A54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5adb4e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5adb4e.TMP
Size 1KB
SHA256 5724659549c5976fabb7617d17f13e019d6f7a9aa0fc3c57d850c8befb263f17
MD5 a9088b6d5d4666986dea90f3a94b805f
SHA1 07b601034ac47aa08fbe1d32cc28c6954c9f5b56
SHA512 24bc05b6721387ae8bae69bd4db174a307fa46c7c92ae9a19eda0cdddd2a94ecb28fe0fa8a80761ab7b81950749b8f9a92dc1f5c6a5b6bc9263d48f1aa08b165
TLSH
T1F84174383333E5C1DB64E5F290E566993234F54A0B0BBF9370456EF48886B2C53B0E64
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 baebcbb35253ededaea43ced88e51bb3dd68226fe7b7830d740e87b9d9ae902d
MD5 4f09753a931c89d5ba4994a0c609b9d9
SHA1 cd523842ee5c86be923bb627ac1577cb4d40f3dc
SHA512 38617637ecec9ca9d7aec58db33dbde0a4e661ad671b0de97eb2931978efadfecae197cf0f0e1c1dbf3c57d871bd9000d5a87500a8fced810e379dc71978f687
SSDEEP 192:DbMMKO6eYGDaZeMvtHi7iAyBZKrsh1yY2zGCeWyumBFk2hBj8cn6eCUiRENT:DbMMKO6eYGDaZeMVHi7iAyBZKrsh1yYn
TLSH
T19512D2F7C7F8973E891165F4DA143E2F8E5804A2535C3C6AC9E89E4BA3F28B0D54194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0ff5dce2e8b0997bef581ab364c002fbade9b88d62ff5a44564d6faceaef6e43
MD5 1f7c024ffffdd321bee462e654f0d1f2
SHA1 b06074f46a79dcde2c6bd07feb8bd2c69ad66e42
SHA512 5de884e44ebefb39885dbaa75cf1a3e6a1e0a3c9cbd5444b2413bf565377f6b99d3bfe685b9b68fe2e6cdeec16d3b716e7c7181a2a1c2fb7b445a4960a4531d9
SSDEEP 192:sxRg/yM/jK1Ml8wC4/ftsVsAasZlFzoA8pgP/g6+WNW2V/Yb7Z6KGEIgVRJ:sxRg784/ftsWAaSloG/59/y6mB
TLSH
T1D162D9156A34997BCCDBD209BA517F93D2F91573A2901E44AAFC9A1C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 99a3dcafe607ce661ff6a71904968fdedaa29c865dfad35c8469be7da19ec31e
MD5 8adf1587eb307cc709b062b79734bb65
SHA1 04eee810ee96ad2a89b90430fd8d736ac30428bc
SHA512 d36316f9d326dba97a7049136e3e8eca9b290e18dbb56fbe82195df56aa6eca7ce30a831231bfe2994fc2066231f2d2f49bbc3c6285b0b8e32d0751c02068ccc
SSDEEP 192:sxRP/yM/jK1Ml8wC4/ftsGsAasZlqzoA8pgG/g6+WNfuJcfYbAZ6KGEIgDTRJ:sxRP784/ftsJAaSlnL/5jft6mL
TLSH
T1F162D91666345977CCDBD209BA51BF93D2F95573E2901E44AAFC9A1C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b391c5ced7f27138e6ac97e07ac39ebf53f23dd463c5af5d9f764d09836a5c09
MD5 5e6bfb62a748cdb5fe36b587dabbdf7e
SHA1 987526a0d49511d04a6cac9ff25172f3a8d7b6a3
SHA512 8639bc6b67253df848c198f8101b4ee7145ee0c1af09a220b3316de8c9d16f84dcaed4a6e0a67f3928a9f1634af3b1ad170cbbd41ac222d4008c3afb784b7d2b
SSDEEP 768:FW7p+D7pLuL70tWgikfn48F1+UoAYDCx9Tuqh0VfUC9xbog/OVzZBJ8WNrogZU++:FW7p+1E70tWgikfn4u1jakZByWm6L+
TLSH
T175E2EB3B680CCB7E4F804E9DEC29BD9A6DE801CF96D88D9447EA480C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5937d9544684c424178f87b40bc22cffebdc5b413fba710de7a7490c915386b0
MD5 d68a288a965fe14abe89825081a34409
SHA1 e0d1732028a093ad9cf773ee4daacc58898cbd31
SHA512 7b92261aa37fd87e457daef70da85bf3ed88f1c17389cdddc43bd5568eb105d5235ee4b8d0ebd449f4e6bb05763628acaa3014cc699b2f997daa576247b3189b
SSDEEP 96:KRCHuC0UECWMZxgyCK4ngoCcSaBgCrH+zC+4AwmWgFNg+mK4jg8mc2edsNh+KiAK:CCHuC0UE9MZSy6ngoJSaBgCrH+zC+4Ao
TLSH
T1F8910051323B42C0387E654884B6C45F96C170A2711CA93F7FAA55B28F2BE425EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 244B
SHA256 f3bd27f4cd1f47635e43ccdafa146caac78286f567fe964bd018cb5bf7494f40
MD5 d2884f10127e73cc99fe8eeceea177bb
SHA1 de5025574cae7f180d0909f52aa113a83bead87d
SHA512 2891bc91c96a36256b36326ba5498767b9ed063e7dfdf222a75ce1a7df0ca14ea462d3152ef1efd5bb5a495694db02ca616a5fab130d306a26a33ddc8a15fe9a
TLSH
T1A7D0A7E677348DDA27B1AEE45024B05ED10BD91EDCCCEC98CD05B1D664B4503D102A26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 244B
SHA256 6dfd9ba23132638deb937502bfa50ed9075ed5b38f2c6bc8f8194da42933d724
MD5 f0caf1ff559e4b430338f948e30e8c9f
SHA1 7454a298059dcfccd953e81db1b64a65e8e4aaed
SHA512 9cb2566d40d99ef8ebfe305512f0be6ba659c59b7511ef3a69c9bab2d7db9972ddd506a3c648fb805512d6216b8b2942329c4466e8efaeff3785c38772dec69f
TLSH
T1CAD0A7EF577559E62771ADD46124315E905B9E1DDC9CECAC8C44B1D621B4623C002626
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 160B
SHA256 af8371af6e8048e3d5675791e8e05befbc5b4883a68e81e55f428f2d4f0f4628
MD5 258063dc2c390c87115d50fe122ed6b4
SHA1 a9bb22fdc34a5daef4dbb2ba9386123d540f0eab
SHA512 4b608f6a24b69dbe1674830060b070aceafbf3ad9a0265e66c1d4731eafec2032d326a3456267e2acafca626f40a4ed33f3b9287ce94fb90aad7285a56bdf363
TLSH
T1D2C08CF716388ACA0BB1AED81028721EE10B820CC8C8ECA8C408A0C610749134002627
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a6ca6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5a6ca6.TMP
Size 167B
SHA256 c5a43394c9bcedd01521e5b87ac6103d8f22cde8844f38e323451e832882f21a
MD5 9745d1c9ac0695d9a5456e4dcef88353
SHA1 547b3469ac0060caa05490d4a5c159200be00374
SHA512 963588ed75f18c2256f45ff21d263ed25d186572caedbbf3f3ff3aabc8b14d50f227de7a0732c4d5ea48456f3740a21bd6682f16e275cbfaad83ebc124c1308f
TLSH
T1F4C08CF706384AD60B72A9D45038B20EE10B8E1DCCC8ECE8C409B0C620349138002626
MD5 SHA1 SHA512 TLSH

Submit Download

3ab20b55-f4ed-4f29-8f08-d745bffc0f99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3ab20b55-f4ed-4f29-8f08-d745bffc0f99.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1922fca0c4e2899886600524c54b25c45e67b312b7cbed134a18e968aa9655d8
MD5 3fac8bcca8a008e63e6e18cbdac3d180
SHA1 d806dcf4b1c49c81bb28ec4b85d913a4e47dd24c
SHA512 04cc43f77de40cb3e63aeee6413a6dea4718eb4f17d5bb2299f603213cab533be4c8d262ac132b57b8272ac750171e1b62d10cdb47a4d0245b72fd9c526925ca
SSDEEP 768:trv+4UNbdq3LjQaBqobGgvbtZu4aWADIidy8Lu6eVH1S1C:tbsbI3LVtZzaNsuVLBEH1h
TLSH
T13E13CF76A869CE734DFBA241B1877A476EF851A3C5880AD4C8DD0F8E05874ED131BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8f27eed09327237de49cef20e60035aca082e960e0928432eec8878320b3e56d
MD5 1f1fad74de0340bc2ab25d4804574135
SHA1 b462e9c234c5b25e1ff663e7caf520bd80028e70
SHA512 682abb7adab2ba555ae6b715c49244f0f2eae55eb6a2e993adca1b44f1ef162784c569c7d1f573e7cfebbb40964cdab433a9313297dc3c349521043a49bd34fb
SSDEEP 768:+Z3SjC4JBqobGgvLtZu4aWADIidy8Lu6b9Mb:+Z3SHtZzaNsuVLBb+b
TLSH
T1AAF2BF75BC66CE7389BFA241B2863A5BADF491B3D5D80AC8D4DD4B0E04835BD1316C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cff19529c056b228cfc94c4c15292a41ab5c0257c639064874beea07d3e4f5cf
MD5 3dc26c736de7d067fc59ddb8cf3fbf8e
SHA1 9c435f34b839e2196db7b47f41d8a75ee712a5a3
SHA512 f43d431160abfeb87a1ac093503a3fe34c56d4f8f92ebc3f4b6402208ceb788d892153fa436e741df0dc4cc628e9d543e7d8d88f51ab01f117fd5a3fe4ec79aa
SSDEEP 768:9rv+4UNbdC3cLqBqobGgUpZu4aWADIidy8Lqo3eVH1S1C:9bsbw36pZzaNsuVLrEH1d
TLSH
T16503BF36A869CA739CF79284B187760B7EF8926386880BD4C8DD1F4E46DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 83c11e60d420ccb6d76374136f65e1beb52eb3689d7db0a55e26959ef1b47a70
MD5 53bf1bcbeac44f3f63e398f3f44ed186
SHA1 1912fa3a7258cde54e71628f83e5d7b6814f9ebe
SHA512 97834965cd67911d2f7daee8999f82e113bcbf3b3aa751a310b37cc9e4d716a53753f11f467b5bd7226543ff6e44d635be8c1fcd340ac4a8842e1f4fa0a79a79
SSDEEP 768:zFQq3qwghjBo+q4y4vgvptZu4aWADIidy8Lu6b9Mb:Wq3k6tZzaNsuVLBb+b
TLSH
T18013F5F698D38A76D8AE5343A37D2D469DBCD163B5884984B7C84E4DCC820BFC306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

4447ab63-0f40-4f64-97ab-7ecda69b5f69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4447ab63-0f40-4f64-97ab-7ecda69b5f69.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

BASS.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\BASS.dll
Size 103KB
SHA256 df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
MD5 8005750ec63eb5292884ad6183ae2e77
SHA1 c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA512 febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
SSDEEP 3072:75yP416sLgrTWiKc0rUH9rRq/SJIJmECqc2QOeH:czsMH0Yl2QE3zY
TLSH
T193A301CA68D54913E28B2D73B59B61EA63D8A3C4DB63DFD11E0A030A76FA5D406B3304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS.ini

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\CLS.ini
Size 1013B
SHA256 c8b2e6831d3f740cb4d924fdf0bf4ce3a2544d4452aa9348096005abce9c3ee5
MD5 0cf4b05b2415c90c87e3d7121a7f4dcd
SHA1 7dc33cbe60e173ee692bcb41f27eb282c157981b
SHA512 d8e683d74851fd87665a18329eac6d2047f0ecb3003b7f3a5cc23d2f7797c3449274d8e57bec081bb758b53c78d8fb9bcc3c2c3ef098288211c0df4d6ccfe059
TLSH
T18211900429AD05A921100063A8E27D1D4C3DDF68C315FE2D739748FA28C887AA1FF2F2
MD5 SHA1 SHA512 TLSH

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

FlushFileCache.exe

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\FlushFileCache.exe
Size 29KB
SHA256 a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8
MD5 df77f2b6126f4f258f2e952b53b22879
SHA1 fedda8401ebfe872dd081538deec58965e82f675
SHA512 623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37
SSDEEP 768:kd82J2m8FCija+1I9ETzJHI6JeLzT3O1:kd82J25TzJHI6JeLz
TLSH
T18FD25A9282D1C0FDE762C5714F389411E97B3A31153196BE3AED55DE4E98760AB0C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\ISDone.dll
Size 380KB
SHA256 c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
MD5 63dc27b7bc65243efaa59a9797a140ba
SHA1 22f893aefcebecc9376e2122a3321befa22cdd73
SHA512 3df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
SSDEEP 6144:YAua3SAQSoYo+1Cjnqakl6j+vn+nLE4FZZHYg5mcQXQJSnI4EUiy:biAKg1C7qmvLE4FZR5mcHSnI4EG
TLSH
T18884BE27F686C1B2D10221319D56E7F66279FB804F2904C3BBDDEE1C5D3AB916A38253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MusicButton.png

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\MusicButton.png
Size 1KB
SHA256 7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
MD5 473a683962d3375a00f93dd8ce302158
SHA1 1c0709631834fd3715995514eef875b2b968a6be
SHA512 24ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
TLSH
T1AC21657F52385772496C03A18FAD75C10F94B65903A563CDA65EFE2807E48A60179045
MD5 SHA1 SHA512 TLSH

Submit Download

arc.ini

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\arc.ini
Size 4KB
SHA256 1d8d8cfa3769157e8f7330fbf487ced5b174b68bd3ca65a12c69ee6d3d9de2f5
MD5 b5f0e650ad80a8cebacd3fa1f40c626e
SHA1 5e3b887141c9a96e96356a36557bd2b56f586e14
SHA512 5aa0d53c7d9b82e37fd497d41571f8bad0cca97b2776e8e5219358f6001ac4b2db75feb49d836529e5540a5bc6f155e3421ca152e0a0f23b11c61446de9f7900
SSDEEP 96:xK90KJuKYaQKue7qK70KwKcL9KuK7mKFKQHuKPuKtK+mKiK3KaKGiKMJKKmKskKp:Lale+1wbtJ6Dt
TLSH
T18FA10876386FE60441694300FF958AD9D5CD2907F7290711728FB78F8AF2A01E8A6D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\botva2.dll
Size 37KB
SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
MD5 67965a5957a61867d661f05ae1f4773e
SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
TLSH
T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fnr.exe

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\fnr.exe
Size 4KB
SHA256 699d99dd95425a15a12947bffa8205d8fa3feb86b8b3948995a29c9348b188d1
MD5 e30e3bb220ec04971d724c2fdc063349
SHA1 8d045b493e06010946c37bb7fb203473c337088e
SHA512 564b21849f9f9e1e27f9ad1df32b5594e068128578358873b20dbcb01eece738da2eb8e38c07b49becfd82544bfbc44916ca67606fb4142f778d0f8832bcfa2d
TLSH
T18F81B92D9A569035DF1F98F83E52D59A3378F2D066D0A1164371CFF42F2B8F021A811E
MD5 SHA1 SHA512 TLSH

Submit Download

host.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\host.cmd
Size 4KB
SHA256 4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855
MD5 b1377c69e6897fdb715452b1776fad57
SHA1 9e50e4dc1fd1dd782b6181bd59011340486b8e3d
SHA512 13d3b1cd9b011180e517eb8aaef5dec4c03ef53153e099c5d85b996e27571291d227ad54e70c0618b2c6749197460ea1686496644efe26a8ca3c1ec27f3afdf4
SSDEEP 48:sBxWxexnx2xXxaxAxVx+xPxixtxVxXxUx9xUxBxwxmx3xfxCxAxXxeaxXaxZxLxZ:uG1ez
TLSH
T1BCA1F4DF93A9FE52E49854F0F33A2AAA7DDFB423C9C5BDC494350066674B4B0C3A5608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts.exe

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\hosts.exe
Size 32KB
SHA256 49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119
MD5 a7f30bb876775a914422675a13dd56b3
SHA1 3ea28fe66a04ebbad2507a7dfdebf1622c701d43
SHA512 6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656
SSDEEP 768:Oa236jCLhhCBOtYcPhswK7kCQn5A11E4O:OaeY6GWT5R
TLSH
T131E2091133E8826AC67E0EB178F2521045F2FA276E32D70E0D99409F5A67BD4F412BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\idp.dll
Size 220KB
SHA256 f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
MD5 af555ac9c073f88fe5bf0d677f085025
SHA1 5fff803cf273057c889538886f6992ea05dd146e
SHA512 c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
SSDEEP 3072:00EeiIJYud1RvIOACb918qbQ0XY3chnBLqRAJUZxChtDUOZlLFv:LEIVd1VIW18qbQ0/hn4EUZxmfN
TLSH
T15624AE0079CBC437DA4F0378842AD719073AF99617744ACBEF985EAD8D352C39E36296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintb.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M8JKH.tmp\wintb.dll
Size 16KB
SHA256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
MD5 9436df49e08c83bad8ddc906478c2041
SHA1 a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA512 f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
SSDEEP 384:6j34r4daxbDGQhh5tfEMrg+dOVMVjG+nHL:iorhyepdOVMVRL
TLSH
T16072D68ABF6B24F3E37206F8D1FBB73F3A792910C821AD71DB094515EE33611920521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-OPRN6.tmp\setup.tmp
Size 1.4MB
SHA256 09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
MD5 ae9890548f2fcab56a4e9ae446f55b3f
SHA1 e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA512 154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
SSDEEP 24576:sH9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx:0IEJxCWluyZ8UbMK
TLSH
T15B654A12A2A28833E1733F359D2B86946C367D642E74988B3FF45E0C0E79B417D39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-SDJPP.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5044_1163490061\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Returning to Mia.lnk

Path C:\Users\Public\Desktop\Returning to Mia.lnk
Size 587B
SHA256 70bb5d705f17baa350fa26fa0289ea4e92c223dd05fccdca9262f4bbbcc0354c
MD5 5b55c22684410ed6719825f6de5f5dd4
SHA1 616da37ba1b01827cd0d326cd73a40371d1bbde5
SHA512 3824a4c4a2820182eb32821a64a9391d11891b35b38e4a2f6e5eefc84aaea6107fc6c0048536fd2df67d921992be4f7e2e819cae1e6689411ce797688c1153bb
TLSH
T1BCF04F54CEEA0554F3F3CBB642BAA350CA63BD434B55C38F4578641E58B1240A53AF33
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 3KB
SHA256 b92d17b8b4150e9b186f982ac3241f360f0fedc65883592f88e25989c39eede6
MD5 83768861aea80178a2c4050a32403fc4
SHA1 c00109754216ddd1bd9d44c79d2d7502589e904d
SHA512 b89011064b08f2a2c6e129a6a3bc311633a6a31a6c7772d991175f8602c8516105280a4bdee00f0e425314f05be0a0dad4e0eb530550dcc6c5b61ef93649b101
TLSH
T1BE71E7EE83A4BFAC95B04170E334257931CFB458CAC7B68C7B7EE4E9B7861111A91308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 7bc5497f566723079249e44a058e4d3d412c4f2eee2f954d2434ed071b62f05d
MD5 ae76a28eb6aac7d0e91d8753d3f09857
SHA1 db4b84c2280cfc9b77e41c12f78ad0a51fade0b5
SHA512 172a4a1a45a01003e304f81d777952376275d0025d632a19cae95e4f5b77686430650829ec149d3d49177a11a73581571c297414bd9ec9a9ed9548c4fe43a060
SSDEEP 96:vDZEurK9DvB1MzMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMDMDMPM7M0:RrK9zByRN
TLSH
T1D991A6EE87A4BFACA5B04170E334157935CF7454C9C7B78C7BBEE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 d049c0d695800628598903af18bdf9dbead81d4e17917dc85fd5c12bba1abd79
MD5 251feb778abdafb8639291c0c397dff9
SHA1 99b49bfce4a2fd520e94b71841ad4634ebc9208f
SHA512 e0a2129fdbc4580dbf9c15113f190ee05350d5d124ceb6ee7a5f14be77c260a30aa2e54c088fd83d9eb81b8718cc6d5e16a53bdf40313b54cb50fef3b0473d86
SSDEEP 96:vDZEurK9DvB1MrRJM7MRMVMrMDMDMPM7MHMzMHM3MHMOMbM+MLMKMhMYMNMcMsM0:RrK9zBsRw
TLSH
T1D9B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 7ac17021788dae1d6930a03153aa117f351a050c77ad8cbab8e609a7410acc3f
MD5 c8dd215307dc6fcde55e9bb713de178f
SHA1 5f5593a1ce5a8b0ba63927a0aeea2df7dd836a3c
SHA512 b375588837b4aa1807ab8c5741400761e1ade0182f2b89903d80fd2465f39bdc123e2211e94b760b6e75b90739a51c3cf1eb9f0385b4c6ce2b8e49ebfd045362
SSDEEP 96:vDZEurK9DvBgMrMDMDMPM7MHMzMHM3MHMOMbM+MLMKMhMYMNMcMsMrM7MzMZRzMD:RrK9zBuR+
TLSH
T119B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 09a37ae03d23e382c5c07d8bf8bad4eb426ca9abc37a2e74d1547c425a7a5171
MD5 58c038bdfa1029309ac8934d58dabc67
SHA1 a5c07b734be2e1f22a88d88c303146eb419f96a7
SHA512 efc8a28931256ccdd8adc1f6b7105059d015aab030ad2de43a319d46c6fe3a7118f0747767769c73259bc03d695389ac7f1340cbdb1852d00d063d25953ed370
TLSH
T1AF21EE2A0749A55D22B341E50918B42FA35FD0EF0E7B9D8D3F8E444F7BA2A0C5332746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 2134770f81e21604042aeca76df3089c111ebe0bfe72acbbc849757edea3728c
MD5 0ebf051cbd73611f7be60db49feb5c81
SHA1 2be51c20f76c167c391c9c6032580d8694445d65
SHA512 9f25340204d49a2b662b032835df8c518ad6fa54adfa236cba260f2b4fec462e37a3861ab99ee4a94898e8ba9559a43b81edc4ecd2a0d8a691e29156b8730771
TLSH
T13921F12A0745A55C22B341B50918B42F735FD0EF0E6B99CC3F9E444F7BA260C1372705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 25c1d8fffc353949231be96da04598b179cc548184f7050bd3d5869cd1b944e7
MD5 3453427227cf00dc677524ca9303c299
SHA1 0e7eaccdc5c3815012396a50c55ddad7c41b6180
SHA512 124ba3fa6fee3cd6edb14128d67a92adae7ba0f6f42ae9d7668ff10f0fb2aa2d34fbc5cb08fa574f351963575e316baf4334c7b072767b2183fdfa028481e82c
TLSH
T12321E22A0744A55C22B242B44518B43E734FD0EF0A6BA9CC3F9D444F7B9260C1762705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 fbdd1a825801e9473d41dba7a015b11cedeef22ed28fd9065a3cb982c9c9ccab
MD5 eea65497ae5761f3f229622cc7f04652
SHA1 0eb31f35da8777a0ae2a4fe0cc1cb9c56ec66eac
SHA512 291fcc1f5370b97915c070f077f2ea9148889222f3a1fc7878dd826a4bdb269ac3a6bfcf4797a61b11ba448cdf5802172e1cba285812d5bd14847776b6b28158
TLSH
T10031F66A0754A65C21B241B44528743E734FD0DF09ABA9CC3F9D544F7BD250C1762705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b5d3cc56864625d63f74fe18cc4f27debc99b10c2ec7a870ec7bfa3add20ca4b
MD5 a27d90b3261a4ef8bee482dc8faf79a8
SHA1 346a3f14f0067637394a6d766042469216bdfc23
SHA512 d46052c685a14cdea13a1223efd85a341cf4fd5f1fbdb8e0b7bb75b783dbdb74e662e325279b158abb0100c75cabe750738fc45052971de0f4685d3b5eceb54c
TLSH
T1E731F46E0754BA5C61B241B44628743E728FD0DF09EBBACC3FAE944F7B925081762709
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 7979e026f7e2aa3c70dd457b4048f60d0fde2d17bae7752a77f9602e2851a9ff
MD5 91866401392b000916aa8c7496a3e71d
SHA1 121760268f38ca937032fd76c28e75315739e0e8
SHA512 abe72d03d71fc1ecd6ad7642c5ad597cc5a74b3ac93b3bda048932a9503aad5c870dbfd2e5953b5a902494349e2d37542940c1cc1fb8a9d7b988eda0baf032e6
TLSH
T17531246E0794BA5C61B241748628743E728FE0DF09DBBACC3FAE944F7BD25081762309
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 525baa65ba38c89629258bec647ffc750f04d8dca576fab3dd2536a67aa96483
MD5 c2837388eec28a4feb0819e6b65708a5
SHA1 32a3a47ad6a572c75998a75ca843006f3c8ced51
SHA512 67e0b40a050d05218c95a55a812d326835cc4ce311e7d739517a45887cc50568cb75ccb548a899e0cd62421c1fd3c8d58a18d179498f081fd6346b7174e5f019
TLSH
T18431356E0794BA5C61B241749628743E728FE0DF49DBBACC3FAE944F7BD25081762708
MD5 SHA1 SHA512 TLSH

Submit Download

QuickSFV.EXE

Path F:\Games\Returning to Mia\_Redist\QuickSFV.EXE
Size 101KB
SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
MD5 4b1d5ec11b2b5db046233a28dba73b83
SHA1 3a4e464d3602957f3527727ea62876902b451511
SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
TLSH
T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickSFV.ini

Path F:\Games\Returning to Mia\_Redist\QuickSFV.ini
Size 155B
SHA256 74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
MD5 c5c28798bca6e9ed5d84fa67b656065a
SHA1 4b6fa3465f1b393e22e9f083b177462028a48e93
SHA512 c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
TLSH
T12DC02B3D075C40150D310E54D0CD71406D4C550F6438CC01AC0437009F10D232A18FA0
MD5 SHA1 SHA512 TLSH

Submit Download

dxwebsetup.exe

Path F:\Games\Returning to Mia\_Redist\dxwebsetup.exe
Size 292KB
SHA256 ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494
MD5 56d52c503adf02184f19eee4767ef60a
SHA1 ca133f67a286f4f20282e19837b53b38a27a1caa
SHA512 246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f
SSDEEP 6144:lWK8x2ZFD7h/uMdnv0iyLI6utiI1ARjhaXcoUvedlVFdo:22ZFD77dnBhi3Us8/VFdo
TLSH
T14F54F15263E9813BE0F52B7929F747432B70BDA49C7DE32E534654880CB2788B87572B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fitgirl.md5

Path F:\Games\Returning to Mia\_Redist\fitgirl.md5
Size 1.1MB
SHA256 dca26751cebc854e0d3d6d6ab35f1a618ca55ccc1dca1ffe956504729e516fcc
MD5 af56ef9a9b5677a2e2504c909f3a2102
SHA1 84b91fb4f297a86e2b4750bb2cadebb97ac8f3e9
SHA512 bd720dd93b02498aca180500719eaafb2e12f69a639dd786f63880552d2db476acee5bfeb726ca5013aba9e391ea9d0d5dca2aa38aca8573c7fd0e998505e05b
SSDEEP 24576:zOtdVKgFxZoQo9qRjPJkMJt8+yQwgCJFJk3AxbIp+59cDg9TvRvEG+8sVwCIyd03:8oQo9qRjPJkMJt8+yQwgCJFJk3AxbIpA
TLSH
T1B1352B1CE2AB797121FE7239B8B8F54EA5F803450C618C8DE553DE8B7EDA7205C09AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path F:\Games\Returning to Mia\unins000.dat
Size 93KB
SHA256 9e06cba59874a0e35a7b9391482f61f94f248b1d4029ce734e0c6cfa06e81ad0
MD5 8468af5c690778e2c9e5efe626c7341e
SHA1 183301540b37f95a783aa687e3a6699afd0be249
SHA512 8db1888b25a16650e57eff51ab7da2d2b680e9524126368d32396f1cf2ec6a6d00f6a6d3f1414265fe736661714711c091da2435bad75652dd7c5b759f81ab07
SSDEEP 768:OR/bfEjHSgW0ii31h7nLJL9nOW4avEOSfYfvRkD:mcjHSO31/LIQRkD
TLSH
T15E939C0DAEFC5821D77ED735D9E7021837357D80A662D72A279F4DBA4813B8888E7312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path F:\Games\Returning to Mia\unins000.exe
Size 1.4MB
SHA256 b133abce8b0d214ace87957e262c7e697ec90bf9f0ba9e9e88fbbce43fa5cdfe
MD5 cb21e1d3a662242d877803f55b1129ad
SHA1 0e02845da77ec0165faf106bb040ffd6d2d23467
SHA512 c3d505fedd4d1bc463a7f167e6988937ca1b88b4501d9841c207fac07991457a84251fa8185c9472b9622b7e8e129596066decae5a98615a1780ad47a7485ba8
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx5:cIEJxCWluyZ8UbMKF
TLSH
T129653A12A2E24833E1733F359D2B86946C367D642E74988B3FB45E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-171-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/1200-172-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/1600-145-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2060-201-0x0000000000630000-0x000000000063E000-memory.dmp

Download

memory/2108-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2108-88-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2108-914-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2108-1-0x000000000041E000-0x000000000041F000-memory.dmp

Download

memory/4132-97-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-182-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-175-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-177-0x0000000002570000-0x00000000025D5000-memory.dmp

Download

memory/4132-176-0x0000000002550000-0x0000000002565000-memory.dmp

Download

memory/4132-173-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-149-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-151-0x0000000002570000-0x00000000025D5000-memory.dmp

Download

memory/4132-494-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-495-0x0000000002550000-0x0000000002565000-memory.dmp

Download

memory/4132-150-0x0000000002550000-0x0000000002565000-memory.dmp

Download

memory/4132-147-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-146-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-110-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/4132-106-0x0000000002550000-0x0000000002565000-memory.dmp

Download

memory/4132-105-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-691-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-692-0x0000000002550000-0x0000000002565000-memory.dmp

Download

memory/4132-92-0x0000000002570000-0x00000000025D5000-memory.dmp

Download

memory/4132-93-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/4132-94-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/4132-95-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/4132-91-0x0000000002550000-0x0000000002565000-memory.dmp

Download

memory/4132-913-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-89-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-71-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-72-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/4132-81-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/4132-33-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-30-0x0000000002570000-0x00000000025D5000-memory.dmp

Download

memory/4132-23-0x0000000002550000-0x0000000002565000-memory.dmp

Download

memory/4132-9-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4132-8-0x0000000000400000-0x0000000000579000-memory.dmp

Download