7dea01e24c8ee98454da79c3eefa22c5d96f5a1578bd70ec520cd61b2d8e172c

Analysis

user interaction
yes
max time kernel
130s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 21.1MB
Sample260804-m2tjfsdk2w
SHA256 7dea01e24c8ee98454da79c3eefa22c5d96f5a1578bd70ec520cd61b2d8e172c
MD5 3c9c18e28c22a75f3c98462fc9629586
SHA1 e9a65a1bccde0958d70075c0099eded11ff06b2d
SHA512 c578a746eaaa0305999f9618ab6d8cbf08b8062fbc5ecdf3a604de0921ae28522326ec019c3619e9b72461f364b41dedb8a2f33b07d9aed4d2a3e639a74b1d8f
SSDEEP 393216:XPAklKMVhz29uyn4RuSTmDFHk3NpZJ0fo5YU2MdKKzA7d7U416:fplKMLz29uzuBGNpMQC7chzQ7UE6
TLSH
T1502733A69793173BE818183B1E4394B86F66E5FC11D0B1980EB4CB0D45B92C7AE35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Drops file in Drivers directory 44 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.backup	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe

Executes dropped EXE 19 IoCs

pid	Process
4700	setup.tmp
4724	FlushFileCache.exe
3212	unins000.exe
4596	_iu14D2N.tmp
3392	hosts.exe
2640	hosts.exe
2448	hosts.exe
5320	hosts.exe
4460	hosts.exe
2796	hosts.exe
2364	hosts.exe
5728	hosts.exe
2900	hosts.exe
3488	hosts.exe
3380	hosts.exe
5708	hosts.exe
5328	hosts.exe
2912	hosts.exe
5780	hosts.exe

Loads dropped DLL 11 IoCs

pid	Process
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp
4700	setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlushFileCache.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_iu14D2N.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4836	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5020-0-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/5020-79-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4700	setup.tmp
4700	setup.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4724	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	4724	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4700	setup.tmp
4700	setup.tmp
4596	_iu14D2N.tmp
2600	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4700	5020	setup.exe	89
PID 4700 wrote to memory of 4724	4700	setup.tmp	92
PID 4700 wrote to memory of 3212	4700	setup.tmp	95
PID 3212 wrote to memory of 4596	3212	unins000.exe	96
PID 4700 wrote to memory of 2600	4700	setup.tmp	97
PID 4700 wrote to memory of 1980	4700	setup.tmp	98
PID 2600 wrote to memory of 2812	2600	msedge.exe	100
PID 1980 wrote to memory of 3392	1980	cmd.exe	101
PID 2600 wrote to memory of 3340	2600	msedge.exe	102
PID 2600 wrote to memory of 4836	2600	msedge.exe	103
PID 2600 wrote to memory of 3340	2600	msedge.exe	102
PID 2600 wrote to memory of 3340	2600	msedge.exe	102
PID 2600 wrote to memory of 1352	2600	msedge.exe	104
PID 2600 wrote to memory of 1352	2600	msedge.exe	104
PID 2600 wrote to memory of 2060	2600	msedge.exe	106
PID 2600 wrote to memory of 2060	2600	msedge.exe	106
PID 2600 wrote to memory of 2060	2600	msedge.exe	106
PID 2600 wrote to memory of 2032	2600	msedge.exe	107
PID 2600 wrote to memory of 2032	2600	msedge.exe	107
PID 2600 wrote to memory of 2032	2600	msedge.exe	107
PID 2600 wrote to memory of 5652	2600	msedge.exe	108
PID 2600 wrote to memory of 5024	2600	msedge.exe	109
PID 2600 wrote to memory of 5652	2600	msedge.exe	108
PID 2600 wrote to memory of 5652	2600	msedge.exe	108
PID 2600 wrote to memory of 5024	2600	msedge.exe	109
PID 2600 wrote to memory of 5024	2600	msedge.exe	109
PID 1980 wrote to memory of 2640	1980	cmd.exe	110
PID 1980 wrote to memory of 2448	1980	cmd.exe	111
PID 1980 wrote to memory of 5320	1980	cmd.exe	160
PID 2600 wrote to memory of 5744	2600	msedge.exe	114
PID 2600 wrote to memory of 5744	2600	msedge.exe	114
PID 2600 wrote to memory of 5744	2600	msedge.exe	114
PID 2600 wrote to memory of 4456	2600	msedge.exe	115
PID 2600 wrote to memory of 4456	2600	msedge.exe	115
PID 1980 wrote to memory of 4460	1980	cmd.exe	140
PID 1980 wrote to memory of 2796	1980	cmd.exe	117
PID 1980 wrote to memory of 2364	1980	cmd.exe	118
PID 1980 wrote to memory of 5728	1980	cmd.exe	119
PID 2600 wrote to memory of 3476	2600	msedge.exe	120
PID 2600 wrote to memory of 5696	2600	msedge.exe	121
PID 2600 wrote to memory of 3476	2600	msedge.exe	120
PID 2600 wrote to memory of 5696	2600	msedge.exe	121
PID 1980 wrote to memory of 2900	1980	cmd.exe	122
PID 1980 wrote to memory of 3488	1980	cmd.exe	123
PID 1980 wrote to memory of 3380	1980	cmd.exe	124
PID 1980 wrote to memory of 5708	1980	cmd.exe	125
PID 1980 wrote to memory of 5328	1980	cmd.exe	126
PID 1980 wrote to memory of 2912	1980	cmd.exe	127
PID 2600 wrote to memory of 5732	2600	msedge.exe	129
PID 1980 wrote to memory of 5780	1980	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\is-NRM94.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NRM94.tmp\setup.tmp" /SL5="$40190,21484210,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- - F:\Games\Baldur's Gate 3\unins000.exe
    "F:\Games\Baldur's Gate 3\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="F:\Games\Baldur's Gate 3\unins000.exe" /FIRSTPHASEWND=$50050 /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffab298c188,0x7ffab298c194,0x7ffab298c1a0
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,16038700015905531070,1791828838221075160,262144 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,14135587585615804225,2165955017524019468,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      System Time Discovery
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,16264696532500943964,10126187225223061680,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,6775165805455609082,13669722338024535814,2097152 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,368624992101399165,16485615440180509652,2097152 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,10821597689395623275,16150192686287339014,2097152 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,16500822900532979391,17780131257099722471,2097152 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3688,i,1297891433231034170,7299310825822789166,2097152 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,10901650146793358390,14043398644214784054,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,1668481706544709278,7883843504989709115,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,12744180481760464674,8578095614311916231,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,9844829427761423431,14776519662404280270,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,9844829427761423431,14776519662404280270,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,13869352700193643983,6423296750543627963,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,12233892253248500882,8193595822728541842,524288 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6408,i,11210882508064607583,18369962322959488656,2097152 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7044,i,8677596616325597429,10966858969966194856,2097152 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6316,i,8275029804372467281,9317312966741688084,2097152 --field-trial-handle=2272,i,8574586248500402578,4093975263816323038,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Baldur's Gate 3.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Baldur's Gate 3\Baldur's Gate 3.lnk
Size 807B
SHA256 01bbdab503b49a58c5a68963a2c50d178f26486937b2a2ca551566e204590f34
MD5 c373d6a8cb7ac02d69ec800e3cb85ec8
SHA1 5616cfe29393a2a41af1ec48dc51eebd3cca3aa6
SHA512 a24268d16d5ac424fcbfad574130477ff298179785a24e76816e75fc4aa66991cffea645f4b2325443f6838f8e7955384861e5211b2dca6168d47faba025a3e6
TLSH
T13D017D7B4AEA0950C27B5332627393B1C782B6478725CB2F605800594C166058D6FF3B
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall Baldur's Gate 3.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Baldur's Gate 3\Uninstall Baldur's Gate 3.lnk
Size 721B
SHA256 6d0a4ffd3f92a767534e70611a823611fd824a220ba5026928c2627e921ae253
MD5 cc4790fb13f4f9e9725a9a6083fd9704
SHA1 9bc9794cf1d22f6257528c485bac088436dd3cec
SHA512 77d5951b513ca55cd44b2a763bb898d5f1b97e80ce6fc3ad9b99aa8c4b6d24c71db7a0db99a09a2f05d60c9109f84986d9b52a2f0e85eb76a515e7b8c4ac9fc7
TLSH
T16C018BBB49E50D50C17B5232A2E39772CBC3BB478B64CB3A605C468A4C425098DAFB37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 709c9fcbdce652a98773663250f2e606f1581bc29aa02a87e4d8fdb0486d84d5
MD5 804a066d5cbfbc70226793c75b5cd82a
SHA1 13ecebb03556e9936d41aa3572f9a82146bfcf91
SHA512 c4529f7b1fe4c2932b07e33f83ffa6131a66d4fde11afa0f2a7300b010a2cdbe02c949e2021106480c9456c988f245369bbf069d3923770b613d23d69c43eebd
SSDEEP 192:sxRwRiCE/ftsajpiZsecbzoA8pgp/g6+WNWJf/YD9rsScG6attPIgVjJ:sxRwPE/ftsa1k/Q/5I/vSi+j
TLSH
T18B42C7156D28A93B8CCBE21DBB25BF53D6F96072A1901E18E7FC961C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1f58cce364a3daec4655201fab04c2b755f6c8ab255824adb22480009d8e0def
MD5 40ad3413ad6431b3f6f6473463f6d7c2
SHA1 89095dc080445189839ce08bf1d8acc96269817f
SHA512 b42ea4a7bb281a1e7a5562dd760aacdddad88199b50a9438b337c96b50fe7d33fbe6f7065ebb0e17fd670c10cb834e7f7da58632ab71033a3bfe1aea7598b251
SSDEEP 192:sxR7RiCE/ftsYjpiZsecbzoA8pgP4/g6+WN0XJf/eHF5eoD9rsScG6attPIgDHjJ:sxR7PE/ftsY1kn1/5O/y6Si+h
TLSH
T19E52D816A938697B4CCBE21DBA15BF57D6F92072A1D01E54EBFC961C00E77ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f59751ff9469352db18c509baee8904af84b4a075303398569c1865a1412270c
MD5 0f8cf03c98ce9692f72aa7f4d1a17eb9
SHA1 9b002829b7c079213d92b46ef7cb466555b4120c
SHA512 8e279a387a57d4cd04492a9df36e942f729493de042fd421f7706744467bccd308ba6422357c07bc5cc9d20b813584225722d957692cce9f981adea4fb92320e
SSDEEP 768:azfWML7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVgYc16propL3Mu:azfWMdE7J0Wg/XfHfu1jaygYy6CpLH
TLSH
T1BFD2EA7B640CCE7F4F800A9DAD197EDF6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 66db067e8d842a3589a9f14512e4b7dfca721381f0e9460825ab752aca240133
MD5 4d0928344eaeb10942472fe60ae5b3b4
SHA1 220ee75ce9bdb6b1f95578bd58c8933bf99c8f2a
SHA512 e1d3f8506fd76812c374b29228ba707cba4ad7bbf6c577234a442a268320819f954aa889e6aad4067f00840040a4d8fc79531fe967c0cf1e90ba21dc92951f5d
SSDEEP 96:KR+zC+4AwmWgFNg+mK4jg8mc2edse3HB+PrZ7/LWPM6gTLK4ygdLcBpk3KOIKDiC:C+zC+4AwRgFe+ujg8V2edse3HB+PrZ7R
TLSH
T14F914605327A0280397E694C80E4C91B43C2B5937508A82B7FF842AA9FA7D535EFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 86B
SHA256 98b890bfcca43595cf76b755e94da14a41eb83325f6ee1b8c4e87b4350ebff6a
MD5 a821fcb99c66f3cb3d439fcaddeb7fda
SHA1 44584097272c7f8087ba5d04e566db8fd168821d
SHA512 6c958296cd3cd17129099b7c664bf1bc5efd64c5b5096985a85e7e2e7c09fa1fbed4d956e15e060d98721d00d807784d73d504045dc6021eeedfc88793cab36d
TLSH
T1A9A001FB8A64899A0A61A9E86139B22EE18F829CCCD8DDF0C40881D66269A221006910
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 167B
SHA256 26fbe56f2766d39b3846390cbf4eb732c07715745f5050752924456d09e16405
MD5 0870aaaad626489dc3f70f05b378edad
SHA1 7773b17474cb7b26ce5d78bd637716d8d85e0580
SHA512 15412776d4c715802833ec5278be4b9b032f1966b50105ac483b29598b9efcac89ff6e3a1eed02accb1e1c05a9d02bcf17e0fee4e9ae259e3264a0322c53bb14
TLSH
T12AC08CF74A304D8A0B7269E42024B11ED10F8E2C8CD4CCA4D80AB18671B85178401927
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 244B
SHA256 a2a7e9a4637421bcd14b72e7cec73bed81a15213ce7445a657cf4d2a9820a300
MD5 f213c6c78f5ea27ca6c5dffbe54e93dd
SHA1 bab36698bd83422349f37db2a5ee4b3e3f62e84b
SHA512 e24bf1d3c8a6205380a77698e6a3a47c878692df8921340d99e34872ec2ec7225cbd918b8bb1431eedd1564e8ca2f47c8070f7859e4286af55c9f4b39da42303
TLSH
T1C1D0A7FB5771594A07757DE56125600DD12B4D09CCD4DCA8CC44B296B0B8617C44652B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 160B
SHA256 2733013d8f867512c08566a900dfcf35cbf5669decdb931f08850765f3a467b1
MD5 940d8a0f1a0c33278903099179eb1a71
SHA1 a225e01e306e981d267c2428b56ba0442a035ee0
SHA512 88a227c0420f4a9169498c7ed61fb5416c572218a9383376a559948b44170fc259df03fd3ad708d096554fbfd06b9dbb638c2e429e01d78afb4f068982676fd9
TLSH
T1DBC08CF74A30498A0BB1AAE82024B11ED20B820C8CE4CCA4D808818671786174402527
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b72db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5b72db.TMP
Size 170B
SHA256 7d65864972f6bb1490c1631b682a2db4dffba00b1646f0ffea139195abf4f1d3
MD5 1677ea026da9a7c66dcd207bfdf91eb5
SHA1 8af25e6f7489774d5794c1320bf06f15dbb61d35
SHA512 49d626f928147f5448bc244c34699bfab1ddf6c24b2a62f72ebdf9ffb19088ab481d178dcd4b438a937bcbe2b91afdc1049829324ec2074f577f2c3f6d5a16a6
TLSH
T142C08CFB8F3248461B61A8E4A034704DE86B8D5D9CC8D8F0C804B0E129B8222A036920
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d77b65b27bafe3e805095c3d6c6870387ae1d5dc9132313e56224ccb9bf92f5c
MD5 80ae973fe3bfdff2d83b6a44f24da6e2
SHA1 a9db2e7df49932046ad17da5a074bfd0d1d9c177
SHA512 ac33ad957c52468810858fb1595eabbe09317fc44f4113120693f8a0094ce0d20bc2a635856dd4339c183f99a0567ddca975c75943a84e312e9f02e5c58d873c
SSDEEP 384:nvZcIT38NWRFvQHvxkWoWZlf8hyEG7OMF4y2rEoajo4cdR8eHhVODjYPNDUMbKef:nT3Pvapi0nIrEnjN3Gac1FbojKgqmUwq
TLSH
T1BAF2BF306865DEB38CEEE385B5837782AEF556A3D4D04EA4D5DDAA0D05439EC230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a927a1eb6ace54bcbd4458d5e4802438b134a22855d163a3e194988b717bcef1
MD5 4fdc8fe6dbb7e2c97a0988c700ff3e6a
SHA1 1a0e7ef02b1d8fa541e778fd633342bbabe83424
SHA512 691a28cd1230b58633ff4678efd42776a44f0826adf904f64b3ca3879915cf1448f046e32f1ad9ff3c29f15e6a5fceb3f850b3b06edf62c4941c5f98a07793fa
SSDEEP 768:rrv+4UNbdS35mi0nLrEnjN3Gac1ZUeVH1SCz:rbsbg3eLQnjMazEH1V
TLSH
T10603CF3269A89EB39CEBE38571837A037FF4525385940BA4C6CD6B0D02DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b5f9ee5815a4f89a49cbbe339d88e7bf9da130adcc33a1f77591009e164b4b5a
MD5 034b962bb51d50da7fbe6e77b79c2ea9
SHA1 bd3298204b0ce7091c34e701cbc0330ceabcea4a
SHA512 26263cead41b4196788f3126cc6026f5fb8b459478a0f5432eed38e0ec4a354e7c72c3486320bf3ed8efda9a9de1d373e898b529e26f277c0c431e83963348c2
SSDEEP 768:xrv+4UNbdI3nvHpi0nIrEnjN3Gac1FbeVH1SCx:xbsbu3fIQnjMaEEH1X
TLSH
T10A13AF3169B8DE734CEBE385B18376437FB4169384D40FA4C5DAAA0D06875ED230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0363ff13-e312-42a2-907d-96aa69bb018a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0363ff13-e312-42a2-907d-96aa69bb018a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-7GREP.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASS.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\BASS.dll
Size 103KB
SHA256 df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
MD5 8005750ec63eb5292884ad6183ae2e77
SHA1 c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA512 febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
SSDEEP 3072:75yP416sLgrTWiKc0rUH9rRq/SJIJmECqc2QOeH:czsMH0Yl2QE3zY
TLSH
T193A301CA68D54913E28B2D73B59B61EA63D8A3C4DB63DFD11E0A030A76FA5D406B3304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS.ini

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\CLS.ini
Size 1008B
SHA256 f4814678768d45681245024a99fec769a5ad32b7a53acf7a3f0c59a17783b71e
MD5 ca5c2d55c6f742ee86a792c6c617499f
SHA1 9838a9b2488112315866f381c701a0a22553bc3f
SHA512 c9c519ddbe738da26217a0d2e774cdae948effa2eadadfe4ed764c51519e7cf35f47cca47e748d0e86b40465afad6368331c7c3ac637219de71d08df9e35ba27
TLSH
T1DF11841419BD45A96100006378B17D1D9C39EE68C616FE2C33A708FE29D587AA0FF3F2
MD5 SHA1 SHA512 TLSH

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

FlushFileCache.exe

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\FlushFileCache.exe
Size 29KB
SHA256 a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8
MD5 df77f2b6126f4f258f2e952b53b22879
SHA1 fedda8401ebfe872dd081538deec58965e82f675
SHA512 623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37
SSDEEP 768:kd82J2m8FCija+1I9ETzJHI6JeLzT3O1:kd82J25TzJHI6JeLz
TLSH
T18FD25A9282D1C0FDE762C5714F389411E97B3A31153196BE3AED55DE4E98760AB0C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\ISDone.dll
Size 380KB
SHA256 c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
MD5 63dc27b7bc65243efaa59a9797a140ba
SHA1 22f893aefcebecc9376e2122a3321befa22cdd73
SHA512 3df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
SSDEEP 6144:YAua3SAQSoYo+1Cjnqakl6j+vn+nLE4FZZHYg5mcQXQJSnI4EUiy:biAKg1C7qmvLE4FZR5mcHSnI4EG
TLSH
T18884BE27F686C1B2D10221319D56E7F66279FB804F2904C3BBDDEE1C5D3AB916A38253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MusicButton.png

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\MusicButton.png
Size 1KB
SHA256 7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
MD5 473a683962d3375a00f93dd8ce302158
SHA1 1c0709631834fd3715995514eef875b2b968a6be
SHA512 24ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
TLSH
T1AC21657F52385772496C03A18FAD75C10F94B65903A563CDA65EFE2807E48A60179045
MD5 SHA1 SHA512 TLSH

Submit Download

builder.exe

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\_Redist\builder.exe
Size 146KB
SHA256 1c362db98474f6896e741234519f3c63234cfcf74071bf232e2d27990de282a2
MD5 3ed84ad98177e3bea38ed075631503c3
SHA1 02cb214a838d2e20adbdc0275b7cfad78820a98e
SHA512 9e956497b4c27c5aa75a2528949be2f82b395a52f0a4f9462add44ff19d6a13fadd900747476367efc01bea599f255def7ef671fdd3c10f7a221f90cc6e6de07
SSDEEP 3072:HbPeMjH+8bW6QzoutdXJSqb6dyNmOdT2BuHIKpvVAkN4O9TuA6/5T3Eo678i9Dpp:TeMH+8bW6IoSdcqb6dyNmOdT2BuHIKpl
TLSH
T1A6E3C7A326EC2C87DA52677E80DB6356333C6FA08337DB63516464370F03AD29E86716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\botva2.dll
Size 37KB
SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
MD5 67965a5957a61867d661f05ae1f4773e
SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
TLSH
T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\idp.dll
Size 220KB
SHA256 f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
MD5 af555ac9c073f88fe5bf0d677f085025
SHA1 5fff803cf273057c889538886f6992ea05dd146e
SHA512 c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
SSDEEP 3072:00EeiIJYud1RvIOACb918qbQ0XY3chnBLqRAJUZxChtDUOZlLFv:LEIVd1VIW18qbQ0/hn4EUZxmfN
TLSH
T15624AE0079CBC437DA4F0378842AD719073AF99617744ACBEF985EAD8D352C39E36296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintb.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GQVU8.tmp\wintb.dll
Size 16KB
SHA256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
MD5 9436df49e08c83bad8ddc906478c2041
SHA1 a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA512 f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
SSDEEP 384:6j34r4daxbDGQhh5tfEMrg+dOVMVjG+nHL:iorhyepdOVMVRL
TLSH
T16072D68ABF6B24F3E37206F8D1FBB73F3A792910C821AD71DB094515EE33611920521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NRM94.tmp\setup.tmp
Size 1.4MB
SHA256 09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
MD5 ae9890548f2fcab56a4e9ae446f55b3f
SHA1 e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA512 154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
SSDEEP 24576:sH9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx:0IEJxCWluyZ8UbMK
TLSH
T15B654A12A2A28833E1733F359D2B86946C367D642E74988B3FF45E0C0E79B417D39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2600_304056035\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Baldur's Gate 3.lnk

Path C:\Users\Public\Desktop\Baldur's Gate 3.lnk
Size 807B
SHA256 9ac86a9c25123997f86e8f857575143b93fbe7d70ae07572db34cca98ba39d3e
MD5 828cb161958bbaba5a2d2b3c071c1755
SHA1 dce9672112fca2479ccc86f9bc24aa8d879fadde
SHA512 cc8ca5b02e9d1738fead6b39bf85031f41ce36e1c4d05f3f6ec7bc11fe014607c64ee9cb82b7f5ecc3f75eaa315ddf27fceded38e055a8c496989c47f428a0fd
TLSH
T1D0017D7B4AEA0954C27B533262B393B1C782B6478735CB2F609800494C126058D6FF3B
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 8ca1133d16ea6da99d4dc459989548000f71a577a331e0003acfc693f834b676
MD5 b1472a2418ef16f2b5a082c36d0e4539
SHA1 ea1cd76485753e4ad9a4ba42beed90a9c50701b5
SHA512 3d673f2627e5c14047d78e987f5ff86666eaeef8c53eff0d5138a66968186f2a250fbf96df9988f9672386b89e31c3aa04e139e22a0a964b19f3b46ab48fd235
TLSH
T142419DAE4794BE5C51B14270D734353E31CFB09989DBBA8C7F7ED49A77861041AA2308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 bff79fc70cf6f8041ddc9b6d5e0d19abda31b990433b4cf7721784864066cbeb
MD5 a8188e9603be0cca741d046cee7f9067
SHA1 440aed91a276bfc2fb95bb78ba864a84d3457f60
SHA512 4ddb3edc267057913394fb96fb605f8d2881613d622caa4c78b9c6d3b7f405013d86b1e57f91d0aadc13703676f498caf81ff0efd2ddae143ea1417cfb13dddf
TLSH
T133517CAE4394BF6C95B14170D734253E31CFB45989CB768C7FBDD49A77861141AA1308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 2be19271db5448049de8802798411179ae99b2cc98ce08b8f2b4f624f7b4e02a
MD5 fd70d546a45e82f594b03550d2d6071c
SHA1 a3b17433c1d3c266128aa9ba7d76d8899602f9b0
SHA512 35f415d7f6d86de56fc0db662d45d3c52ef887229f3d18d432542faa6b42e1a21eb7e6a7af278fd75e0124819e370a7232d8592324fdfa5a30cfcb74b8d912d5
SSDEEP 96:vDZEurK9DvB1MLMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMDMDMPM7MT:RrK9zBeRS
TLSH
T18991A6EE87A4BFACA5B04170E334157935CF7458C9C7B78C7BBEE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.exe

Path F:\Games\Baldur's Gate 3\Launcher.exe
Size 3.7MB
SHA256 6b1322718a09cc082881c4dbce367508f2567466c32d0f7d5b77eb414158a918
MD5 a7fc7d65c3a9341e04d1d962be69521a
SHA1 85e1fd0b8c8ac5636c3a662505aac79d32431bca
SHA512 a3c4749c1c8713b047e5d145392edabd801e867d123bd2d117c14915dc83b44ecd0da87073aa62b4777351018e4d499797739e11e828af53db9e0253e6048b9d
SSDEEP 49152:y36HzwGYTRQSlkaKbySjJUntTHRInT7g/QRvo8mV/rx:UVBSVUntsgoRDeD
TLSH
T15A068D2271C4943FC46B0B3668BBA674993EFB602A16C95B93F41D4C8F7D580393D29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.xml

Path F:\Games\Baldur's Gate 3\Launcher.xml
Size 3KB
SHA256 f7f15a0c1afe6af0c23f2ace11f06bec4b34edd749cde350fd43879baf0e046e
MD5 0d65cbe6bdcc9b607b4534923fd23f2f
SHA1 71d633b49d8d731f813fc02c31dc08da3e1c84d4
SHA512 8ebc8e03cb065c1208e534bacabf206864a0f5cab65fb0ef2f0e524cda3f7c1bfd331f3b7af097364c2de180019b2ca4f4a5832ed793ca691b7fa656ea8bf820
TLSH
T18A818D884181BD308AFA1557932E44ED6E65832FC8844A12F52F20DF7BE675D0DE73DA
MD5 SHA1 SHA512 TLSH

Submit Download

OnlineFix.ini

Path F:\Games\Baldur's Gate 3\NoDVD\Online Fix\bin\OnlineFix.ini
Size 620B
SHA256 600be07bd081466c46412ed04ff8c462021f84172ab38aa1a4c0c6a3ac0986b8
MD5 3c1d9bbdbce821edd66ce25111dbf8cd
SHA1 977f22ea5cbf52fa40fa6f8099e131fd50cc6a24
SHA512 81bf6fed17d7ae5c42ecd567c9bcb979a22ae19d591483ef48a3e63d8690cf406a6a5ddd5f7b7f5c29d9a4de1f62f218b51ffdabe35a495624ebd4147364a3d4
TLSH
T1BFF041D9BD3C1134C42DBE4D28C3A8C358DA229A73BBCC81B28F5D8D3626990607B10C
MD5 SHA1 SHA512 TLSH

Submit Download

OnlineFix.url

Path F:\Games\Baldur's Gate 3\NoDVD\Online Fix\bin\OnlineFix.url
Size 46B
SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
MD5 59bf167dc52a52f6e45f418f8c73ffa1
SHA1 fa006950a6a971e89d4a1c23070d458a30463999
SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
MD5 SHA1 SHA512

Submit Download

OnlineFix64.dll

Path F:\Games\Baldur's Gate 3\NoDVD\Online Fix\bin\OnlineFix64.dll
Size 11.0MB
SHA256 09d3a0e6a8d2aa0f08cc636e1232b684dea13f7b7b0deddc1d68afb6ab60f4d8
MD5 43e572459a59f7abcfaa1341b73a49fd
SHA1 f1b660679e734089f32b7984320f00fcc91e6da4
SHA512 5e753c4ff5c4c613af0164b8ec4cf515ac00244c954ab07d35c422a2cd0b6bc729c8ad48dd82837093c7752c87d9b609252022a4eda8de2a115edacc8b320fb2
SSDEEP 196608:ZjJVWQg/vgFVWigVLI62OllSk9RKAB4+3/IcDJGUFYCL6SXtM1Ug2U:KXguxIuldRF4+3ggzKCNi9
TLSH
T114C622E804E612B4D0E30B20718A93A97A82754D85FC1D193DC66C922F5DEBE614FFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64.dll

Path F:\Games\Baldur's Gate 3\NoDVD\Online Fix\bin\steam_api64.dll
Size 291KB
SHA256 e6a1be372c6080dd830df4d4cafe4ca6e219583672bfed67c5851b737b454cbb
MD5 d4129749f93980bd6d6ecc6ebb7e085d
SHA1 449f5be5666f9b14996efd7098e22302a71c4dca
SHA512 99b5087bf8ac055f0cb0bee3c283f80be4cb6976906ac9b26fb6198e319c0ef8d06895e8ca97412f7366b15294fc2eb27e98f6ed9d4a3b5f2badce63558677ca
SSDEEP 3072:B8Y+BDOgGIWcXSEJeRhqTMdU55UuT7+7JtN3RUOj65lhTbCMTiGu2ZvJpKCZyq+x:BYPNrQheMW5vTKxRo8CgCZyqO2CMnOYS
TLSH
T128545976A2750CF4E076C13989565E0FF671744B23219EFF226053368E67AC21E3BBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64.of

Path F:\Games\Baldur's Gate 3\NoDVD\Online Fix\bin\steam_api64.of
Size 291KB
SHA256 a44e5537939ae4eebc69000589aa9b2437a667813a1657cc779198bae9b815a9
MD5 f3db5801dc9b75da671b39041e2e8bcf
SHA1 40d0ae44e090db49b2309fb152fbd3e11124a376
SHA512 9abeb8542ce48f3d263e9924a82cafa80b42b730636f1df6e594679482b6638997563b5d752d5505f25596a5d0e2f56f1255e4a94bb9523d47c180bc131e22f9
SSDEEP 3072:B8Y+BDOgGIWcXSEJeRhqTMdU55UuT7+7JtN3RUOj65lhTbCMTiGu2ZvJpKCZyq+g:BYPNrQheMW5vTKxRo8CgCZyqO2CM4OYS
TLSH
T18B545976A2750CF4E076C13989565E0FF671744B23219EFF226053368E67AC21E3BBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eng.bat

Path F:\Games\Baldur's Gate 3\_Langs\eng.bat
Size 55B
SHA256 eb815d6ee4a124f16a310af4465fd82dc9d0b134df0bf917bfdd0c15e357303c
MD5 6f33a31c4856478880d914912d5bab61
SHA1 0cbf82c4a339377a4bde7b969d368e733f0a0dc2
SHA512 3d0db67fe7f9ab04e9efd4a0900ce280945539fa2316bbb1827188d7d306468d3cb4fcbc2498ad2c6a6b44c56e4abc15b98da225a2eb37a9bf1eb29d2e4ee189
TLSH
T168900262A102411E64477BE324D2AD159072808A42816B50470160243AC3D445511B00
MD5 SHA1 SHA512 TLSH

Submit Download

esp.bat

Path F:\Games\Baldur's Gate 3\_Langs\esp.bat
Size 55B
SHA256 f2972060a25a7f51366b386a6e438ae94ce25c5311ed625b5b54531bef7c92dd
MD5 5b06bc21a09233cec6f900841932d7d9
SHA1 2352c1ce09d0c4cc44cd03aaca0e3be486c4e37e
SHA512 75507dd7636e2bd932bd4127476a36b0c7bf6d27d2023c10b12dd44dafbb9d72cf456ab379264b40b5454715ce99a2c9e1c3affaf737239830c20d711572bdcc
TLSH
T1D09002A29102411E64076EE264D2AD549075808A41C16BD04701602839C3D445502F01
MD5 SHA1 SHA512 TLSH

Submit Download

fra.bat

Path F:\Games\Baldur's Gate 3\_Langs\fra.bat
Size 55B
SHA256 2303d0626b78b4bbb049cf52474bda22e3d5324057001ffd958aab47d4f57f6a
MD5 4888b0db089f8c339f5eaab2b3886fb1
SHA1 d0e6a4b6160cfae59ef57a9ef252a0b9f26c5385
SHA512 d5dec16167c7b3c7887ce5fa5b071a894ec5893b004a5f7a0445fbca53e68ba422e2326f47610e58bd96022a054b92c262c30335c74f91887db0bbf40285f9b3
TLSH
T19F9002A39106401DA4076AE124D2AD10E071C44E41816B50C701602439C3D445941B50
MD5 SHA1 SHA512 TLSH

Submit Download

ger.bat

Path F:\Games\Baldur's Gate 3\_Langs\ger.bat
Size 55B
SHA256 1cfc5c8c9b091859ec41870d7525923348cb1dc579f8a66bbcce9f8d543fe9e2
MD5 062108a6abe3e95f41d49bf6049e917a
SHA1 643ad21e32f625328e68b6ee27d65989beb03048
SHA512 2be7c909bbb4faeb8e2b937b153bea132f9a16ed098501d07271ac1915241c41a9bbe76e50dc1020d8441dbe89d6e2c472fdfd936bf92695ea4620bf6ab50e79
TLSH
T197900262A646401D740F6AE168D2AD109131804A41816B60570160293AC7D455511B04
MD5 SHA1 SHA512 TLSH

Submit Download

ita.bat

Path F:\Games\Baldur's Gate 3\_Langs\ita.bat
Size 55B
SHA256 93b2a8b618e6dc885306d1b18eae12c657478f435f1195af5c4a31d1a1908aa7
MD5 5c4832fec5aaf35af051d0d461667784
SHA1 1374242e97e94e078c1a1fff11e95d90eddde5b8
SHA512 851e2405dfb60f4b1f0a727bb4cd007083943769c553f7dcf619ff0e37258a905b22e5b8b2d44e399e7e8818dfb8b7c832b45a45e34678aa56de96212f696d68
TLSH
T1D19002629112401D64176AE124D3AD10E171D04B41816B504711602439C3E445501F42
MD5 SHA1 SHA512 TLSH

Submit Download

jap.bat

Path F:\Games\Baldur's Gate 3\_Langs\jap.bat
Size 55B
SHA256 62f03395a990f8b2a380a36fd1da08ab1e3c0ae1ce18d1864728e34b60b3a38a
MD5 796e88363d49dd1247736d43137ec5b3
SHA1 9f4aedb3a7385f367a9a734e503e947308a519eb
SHA512 478cfe4b8031e066092bf3c24861f97d36f34941db09bed837d26d5b9da5ac6f57e2669ce15ee66854c3b0e6a3303632b9e4950365b7ed2ada3483206fc4cebd
TLSH
T1919002A29103501D68076AE125E6AD109031804E41C16B905701602839C3D445502F20
MD5 SHA1 SHA512 TLSH

Submit Download

kor.bat

Path F:\Games\Baldur's Gate 3\_Langs\kor.bat
Size 55B
SHA256 b41baaa5139df4b7cd0e6d703488b6082fb6eb10ad8e2a1778740703d7c5c794
MD5 22195539e118bcee5a7e022a99a6eb75
SHA1 334050495a07b4ee8ac5abdcdf94be8081e2ad57
SHA512 9eb33a707764c1ab6231aaab5b9b820e9abb6d443b061afc021654c9030736c2c29dce562ac63d6464a4d01c719b35b6daf048ebb8314f1fff561bb05c7cde45
TLSH
T1379002629B52401D644B6AE124D3ED109431818A41C96B904701602539C7D445501B01
MD5 SHA1 SHA512 TLSH

Submit Download

language.bra

Path F:\Games\Baldur's Gate 3\_Langs\language.bra
Size 585B
SHA256 bd24731ab6d3ab81cded3c5818532c871f7c160fbe63da8eee5fb64d79c0b520
MD5 28c739447d2b433e12f022872bbf8d0f
SHA1 fe6b6a1b5498a6a7c8238645bf85225dd1d1fc07
SHA512 a7eff27497b02b8c82c9b585fa4e69918f4d20225f09eea14fb4392c3fcbb19fd7b91f4af303561b6eb0cf1f68e5b39ed369ce45123613e34625826bcd57d1d7
TLSH
T18DF054154CD0EE661E300DC85B66C48CFFA96253460006D8B04D63370FB764038977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.chs

Path F:\Games\Baldur's Gate 3\_Langs\language.chs
Size 573B
SHA256 fe78dfb00848a1d24eec5d309b93ef483391382dd4ea6be576479453f0dbe399
MD5 4a17b36213cebf1de10ebaf6d25ec479
SHA1 6ecc54e776b407c4ac7b54bd2a54cb174b2c6d55
SHA512 9058cd883da16e99a3554e224761520a0fa6f22a6671442be1210afa92b3696ace411898936b792b2d07012045f47995df9226ec5dc8e0b6bfe244e1d0b167b7
TLSH
T103F0EC1588E4EE665E710EC89B65C48CFFA96297470006A8B04D63371FB764128977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.cht

Path F:\Games\Baldur's Gate 3\_Langs\language.cht
Size 584B
SHA256 7be8a76d25a58a5763fb2d18678b68d8a52396cef19b8cbd49f19a03b99b05df
MD5 3ae8c38c4951117413e66da6ab5abf3e
SHA1 d179bbbb0306b1e64916c2481c90f3b34fb45c01
SHA512 6ec4daa5fcfe8a63fd1d2afe17035fa01262cf748331a3bb1f4133cc3f1b47cd0ae5e0ab0b0ce7566e45f24354a953eb583e839d87e09027ee23d20286923caf
TLSH
T1F9F05C1588E4FE761E310EC89BA5C48CFFA9A293470006A8B00D63370FB764028977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.eng

Path F:\Games\Baldur's Gate 3\_Langs\language.eng
Size 573B
SHA256 574055988b09013769991473aefdf6de322dc012c16f6336a4fae1a8e8644603
MD5 c6b72147297b03227354854fe2e7fd23
SHA1 5912658360a24c9e44f4e0f5e43e6ecb409a7ca6
SHA512 e081c1a8e0baac7b15b7cbcc885825958248da42756adc82277d67a866f870d95d80bfa448994333796531ff3d9ddb73a7bd290e59215f0777594045dbee6e16
TLSH
T101F0E41548D4FE671E710EC45755848CFFA592D746000698B04D53371FB764128977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.esp

Path F:\Games\Baldur's Gate 3\_Langs\language.esp
Size 573B
SHA256 77b1f8c67c27f6ef6901a2afb65f4b526625e105f1a1edea227c8ab9ca1fa185
MD5 164daedd6a7c1f9dcca2400a3fc9cb1b
SHA1 d0510522b39d0041050b4717840c59b8e6fda92c
SHA512 d30c5fb27cdba82ac4ea6505a40093d790d8a57d100112ad99b3fe941ba9496d447e1ca4d927a8c0f5bc88e3c838d94eda5bfe376f05dfd891e75fab4b2505fc
TLSH
T1BCF0EC158CE4EE661E710EC89B66848CFFA9A693460006A8B04D63371FB7641289B7F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.fra

Path F:\Games\Baldur's Gate 3\_Langs\language.fra
Size 572B
SHA256 07f136a9cfccf8eb7d70fd158c540212d443c95795a90532c69b9a22c34b3dc7
MD5 d5b60bd000a8900c1887148560a623d1
SHA1 5012690e1eebbf7b4ab0ae9a444c525e538dfeca
SHA512 eb0d4185eebe97dfae111cb9cee2534235e480033317a0b8a15d88f1b3d62044b5a116c97a99298c65b6b116230f25103dc52010b29436e4855c59e5ba3f9139
TLSH
T143F0EC1588E4FEA71E710EC8AB65948CFFA96293460006A8B04D63371FB764128977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.ger

Path F:\Games\Baldur's Gate 3\_Langs\language.ger
Size 572B
SHA256 ea412038f993c6abada9d2ea5b2593fdc2a543fb9a7fe44f9da98167428ad7b9
MD5 2c7c399555d946eab5fc3be48b727529
SHA1 f6f0f0fb82859b637f1c3ba516ad513460783533
SHA512 ebaaa7256ae7ea41bd41a6e249008273da5f8286e680903a48994e3bc4358b21f900ae0c56b0398ad40aafc521e6d694119620cf9e56c880ff9038a8a8a2dc1e
TLSH
T1ABF0EC158CE4EE665E710EC89B65848CFFA9A293460006A8B04D63371FF764129977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.ita

Path F:\Games\Baldur's Gate 3\_Langs\language.ita
Size 573B
SHA256 091128c9c8352e11eef06c3b4d2d1f469a1431c8f730bb048900234b7b11d167
MD5 fbf733a27e13aea351fa0f984cde9e86
SHA1 8eeb9a9b100a59c34e29dcb4d5a297cc18876a9b
SHA512 bb93b6fae483443e3fa49d4c2707718befc68523c0167918a3847504574c9806c4f8e82cf5a79b248d744e0f960690c7a0a6ab17e2fe9eee286053348ae0b999
TLSH
T120F0EC1588E4EE761E710EC8ABA5848CFFA9A293460006A8B04D63371FF764129977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.jap

Path F:\Games\Baldur's Gate 3\_Langs\language.jap
Size 574B
SHA256 a10d94eb58469a6d7ab06153ef3f4109545e16f98b66a1109fe42080fba3cdd0
MD5 eb8ad72d11f004861a96dd92aa57bf40
SHA1 eea7339e23ba5a54bfd7fb01a486409462daedd2
SHA512 4916f68b1ab25196b936c4a179dad7b1330ca193276d123a5138606875a6f7d20c6945b01babdfb392eaa343ea1a7829fae8abae225a11688d36f16e7bfa411b
TLSH
T1C1F0EC1588E4EEA61E710EC89B66C48CFFA96293460006A8B04D63371FBB64128977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.kor

Path F:\Games\Baldur's Gate 3\_Langs\language.kor
Size 572B
SHA256 cefd30a5b4bcf35eddcc86cc8bf28e6128afb0b29109e64504d07b6ed329271e
MD5 1389017914ca1947a33e44fbce8e6fa1
SHA1 b7fcb48d89a9c705ee85ee63fb3d75e247157626
SHA512 e6ac791dbb26710d7787b1417afa0aeefe3008276a536632bc33d6e936247bb48f55e355f175823bf2cecfbaf9d3ff234f5097906c07aebb602cd70914aa6c4e
TLSH
T115F0EC1988E4EE661E710EC89B65848CFFA9A293460006A8B04D63371FB764129977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.mex

Path F:\Games\Baldur's Gate 3\_Langs\language.mex
Size 578B
SHA256 a5de9e3a81516d65d4f919ca51db320673c8b1294fe5f820cc7d95303a1b2ace
MD5 5ffe4499a313a1d73e1147e938a0640b
SHA1 57c6d2379647f2bf8ad5f6c1226395d6dae6d5a7
SHA512 065309a3fa7034129dbf5e34501b6d8018eb1660965aa584b46f4e780b113f88f820d004ba43b032ff8224f9e2ff768fcc88bddec1aed1b3dc85ac2260f21754
TLSH
T148F0541548D4EE661E300EC45755C48CFF655283460006A8B00D53370FF754028577F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.pol

Path F:\Games\Baldur's Gate 3\_Langs\language.pol
Size 572B
SHA256 a189f8fc05eebf081b2e1a510979ea5a5182f932f11f74aa3a0ad79459ed4a4b
MD5 f29e86450b347bdc842467a30b7c9377
SHA1 c5035432969364d61711e69c9a84c8e70370cf7f
SHA512 40bbf18e94a9fb5977d4cdf3149b70cd205bc67e7ae4f69d982c331f1ada7d58bc601ceebe03a1a7ad5e1579cbdb8ee6e33a5f944e9662744e94d5e95a900c05
TLSH
T1D1F0EC1588E4EE6A1E710EC89B65848DFFA9A297460006A8B04D63371FB7641289B7F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.rus

Path F:\Games\Baldur's Gate 3\_Langs\language.rus
Size 573B
SHA256 40e85c7174f92b6df21ee772a2fdce96bfc5970c3ee57e9c0026ebae027017bb
MD5 d1e71d8b45aef4fd7eecd3ca8c051739
SHA1 8388c4ab5338a3fb9934b5f9cba760542b90100e
SHA512 f5d26580e81b33d0a310ea92c8484f50047a78d546f04f5b5d14382dd58e32f932eefd8a68bf47bf4cbbbee61aadde51a0f560ee6d761cc313b1b2ae8bc91124
TLSH
T11AF0EC1588E4FE761E710EC89B66848CFFA9A293460006ACB04D63371FF764129977F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.tur

Path F:\Games\Baldur's Gate 3\_Langs\language.tur
Size 573B
SHA256 dc2900b4600e287e83f0dffef7ee35917966e5c1138329bd3a0deec455d52946
MD5 d47e96ba0b771a60fb0f622eadf5976f
SHA1 2c85332c4901a1133c468bdbe1db2e41a922f8d2
SHA512 cb259207c91060721fadc63714cfefa972884e518d10b230acfcdbe3cd93d77f05e1b319eae037ca5b77304cf5be7b0cd2dfe464e1ee0d9758630f63efbd9afe
TLSH
T17BF0EC1988E4EE661E710EC89B65848CFFA9A293460006A8B04D63371FB7641299B7F6
MD5 SHA1 SHA512 TLSH

Submit Download

language.ukr

Path F:\Games\Baldur's Gate 3\_Langs\language.ukr
Size 575B
SHA256 827e7ba53d7dd157ffe266d551a9faaa58fbaf2298abbf2fb01dca0c2a680556
MD5 4d93b0ca6ad9c6005556ec4ba1304204
SHA1 b33a30dab6a5c94d067bcadedbb22964a502af3f
SHA512 d68f09167dd485f0a72ee25fad3d0ae285380e6fea57b0fd9aabf3de43db3207966b29bc5e42c49bf41f50cc0740c45ecb9fc3763296aef0de76b87790d0ba1f
TLSH
T13FF0EC158CE4FE7A5E710FC89B65848CFFA9A293460006A8B04D63371FF764129977F6
MD5 SHA1 SHA512 TLSH

Submit Download

mex.bat

Path F:\Games\Baldur's Gate 3\_Langs\mex.bat
Size 55B
SHA256 427724dabc3b2f3dd157dfcf357461a52c5235c1fa4aa6335c2b9f7170469549
MD5 97ab06057de961d0d03a3a3b5de31932
SHA1 9903c160966884165ad039ec5b2b4cf3705fdc77
SHA512 ca76934b8ec534b225ff8d2dc3c47fd920f588b4cc7644dc10063c7da23bd96086fae58088abd9eb2a273d87d1b9a0c53d3fdce2fb79809f5cb1d735d98a4fde
TLSH
T1A79002629107401D74076AE224D2AD109031944A45D1AF605701603479C3D445501B10
MD5 SHA1 SHA512 TLSH

Submit Download

pol.bat

Path F:\Games\Baldur's Gate 3\_Langs\pol.bat
Size 55B
SHA256 a55e8aa9de7493ae02e40c22dc0b6b307728d5634a37b7d81d554fe2ffce9fe3
MD5 74fa02f92159ffb63cead4eba3b9cbd7
SHA1 c646947d21f9962edc870e7c8229032fe8921bd3
SHA512 b0b9b2dbdad166cf61cb41b1b0303dd1204647be7fbd520d8b9343e26b725a9a4a4724d374cfbebaad5e737a648e5ff973580f892116a6bed5ec591ea8fb5cdc
TLSH
T1AD9002629102441D74076AE138D2AD109031844A41C16B504702602539C3D445501B01
MD5 SHA1 SHA512 TLSH

Submit Download

rus.bat

Path F:\Games\Baldur's Gate 3\_Langs\rus.bat
Size 55B
SHA256 dd654c715b7dea5fa97a3843ac01eedf2a5b4aade807406d0bc0b5c422727188
MD5 1f01b02e0d0498576da98e3a7ee9fcd0
SHA1 8445d5e36d0b609f255aa452f80d37887d9c9bcc
SHA512 1cf21ba8c7801443aa7aab38c3fba4985ab237efd943aa4b5cd26cb8c9bf4b72581dedc8d1c64fb375c535c40c3b7fd9fe4a17b03733d9a41f5ea1d6688bf513
TLSH
T1479002629112401D64076FE164E3BD119072804A51816B504701606439C7D445601F00
MD5 SHA1 SHA512 TLSH

Submit Download

tur.bat

Path F:\Games\Baldur's Gate 3\_Langs\tur.bat
Size 55B
SHA256 57b8482c516156d10e6f83d369d17ae32b473ed8364118044f39b1f7d5d12f19
MD5 31703d9a796eaec5ec2af48c72942989
SHA1 7c1fd641ba4908c506a5959872fee0d0ca4c09a0
SHA512 5e8363a3ebfd9da509cdf094207acfb1a03b949a8fe3b2847d7b0d4d0bc66ee3ec21d76677537dbd28bf33452b326be38215e089a45fb7f08e77833d4024c38d
TLSH
T16E9002629652401D640B6BE124E2BD149071804A41816B504B01606479C7D449501B04
MD5 SHA1 SHA512 TLSH

Submit Download

ukr.bat

Path F:\Games\Baldur's Gate 3\_Langs\ukr.bat
Size 55B
SHA256 7642c3cea4764b83fd6217d52144bf053dd7dc09d5d9601051e1e634778421ce
MD5 245505b9d56f26e4b49de595322efbc1
SHA1 1468b73f48d46998d6fb29a0c7e2bf3b44f712f6
SHA512 7b15585dc7e97476e5e537521c229134ad78d360d1926700f3b10083732d1539b3da84e926c54455370663102664ca12377a93ad4061dda361a65475bb0f7250
TLSH
T1959002669A93411D640B6AE664D2AD10D031804F41816B504705602439C7D445501B00
MD5 SHA1 SHA512 TLSH

Submit Download

QuickSFV.EXE

Path F:\Games\Baldur's Gate 3\_Redist\QuickSFV.EXE
Size 101KB
SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
MD5 4b1d5ec11b2b5db046233a28dba73b83
SHA1 3a4e464d3602957f3527727ea62876902b451511
SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
TLSH
T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickSFV.ini

Path F:\Games\Baldur's Gate 3\_Redist\QuickSFV.ini
Size 155B
SHA256 74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
MD5 c5c28798bca6e9ed5d84fa67b656065a
SHA1 4b6fa3465f1b393e22e9f083b177462028a48e93
SHA512 c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
TLSH
T12DC02B3D075C40150D310E54D0CD71406D4C550F6438CC01AC0437009F10D232A18FA0
MD5 SHA1 SHA512 TLSH

Submit Download

dxwebsetup.exe

Path F:\Games\Baldur's Gate 3\_Redist\dxwebsetup.exe
Size 292KB
SHA256 ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494
MD5 56d52c503adf02184f19eee4767ef60a
SHA1 ca133f67a286f4f20282e19837b53b38a27a1caa
SHA512 246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f
SSDEEP 6144:lWK8x2ZFD7h/uMdnv0iyLI6utiI1ARjhaXcoUvedlVFdo:22ZFD77dnBhi3Us8/VFdo
TLSH
T14F54F15263E9813BE0F52B7929F747432B70BDA49C7DE32E534654880CB2788B87572B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fitgirl.md5

Path F:\Games\Baldur's Gate 3\_Redist\fitgirl.md5
Size 124KB
SHA256 5bca428551599ac04e87bf9ca2248f99b2a9e7061f761fbc23a51a9a653b3180
MD5 658b610acd8257793774ec06ed36b4d9
SHA1 8d29b64998e902604d47a59e811ea281bf957f66
SHA512 c039466df402dc2b1511933342c187dc18b0bebd656fc8121d21a74f607caa0e4f8bee9840a7581ecded769db7a962d9a00c8bfa8065cd2f17e460f68bd49389
SSDEEP 3072:rWB61ImMf0iA32lLbwIrjSukWYp/uabjGbc4LnfMWGAMjfsmXnkhxfnxxGUFy3RJ:rk61ImMf0iA32lLbwIrjSukWYp/uabjp
TLSH
T160C3AFBCE2076D31BD4B6B45A371A078104BD42D72E66A348B615593B8BC23CBEC52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game.ico

Path F:\Games\Baldur's Gate 3\game.ico
Size 50KB
SHA256 637a13a0627765d7c0e5982be134fe6adde4c490aac441f3f79de2bd9b87cbfa
MD5 c7eede621bbb4264753f569c21f3021c
SHA1 b3d0cfb063c67cb09f328dcd3b503442ca2e954f
SHA512 785f7c8df2174826b7f6dee287682b1dbf91b32e654cd921319b5b2d7287059475494a4ecee06bf66f9aa05c93e276abb9555e115fc2fafdbeef36449c222fc1
SSDEEP 1536:InRterT2XhqkeE+R2nD0InzKEQtLJpmMiz/MrWXhpWJR:agEm2nIYzKEYLmnzQWXhpW
TLSH
T11F3301CD3E5C2496E92725756B69AF9DEE1B087C6BC758F346E73B000B90F9C2B80911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game.jpg

Path F:\Games\Baldur's Gate 3\game.jpg
Size 34KB
SHA256 689cd08d5f26d390de5e4cf1ef6e8883053b19e96f974f37bf264c6919ea7a8b
MD5 5a9dbedd694996a1d2da86cfbd3b366f
SHA1 ee77e8216fe7c23020a24fce8f6ee77274a6f4ad
SHA512 e7cf88083b7aabaab72be9dca3b2248d91ff7e1a3d53eea6180b4e5eb3cacac4eef010c3d17bc2660520454d8d129d43f6f1a5ed96b94ff80acfc55d274cd8e3
SSDEEP 768:80gp3iKSgpol4Vh3IdLdBGnr2DSkDkowNAktSy:80gQKSFMhmonQSkDkowKkx
TLSH
T148F2E1C9EB691A3157F15C5384069BE0EB1BF92172A7AF4C818036743178FD9DBEC4A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path F:\Games\Baldur's Gate 3\unins000.dat
Size 118KB
SHA256 f49e5c846038ecefd8dc611797c622e0c93e36ec3043323594764e4d65975e83
MD5 8cef3fa3db1c565655e1877e74739f91
SHA1 3383993794036ff0921259a60579cb1f7da68d92
SHA512 43e6dd3d3f7dbba5a2b126c697b3fa35f80ce78a13e11aff6ddaf6355233e03b4d5fe81b0c5ae6c32ea4263eba491da4aa63873766159da3fd6fda2dcd5f3073
SSDEEP 768:wSRaVWnjz4lhG8K31h7X0n6gm0Wvf4Uf/fvRjiDKuTz7N:w34jz4K31M6BfBRjimy
TLSH
T124C3BC0DAFFC9821D77EE735D9B7021837367D819A62C72A27DA4DBA4813F4884A7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path F:\Games\Baldur's Gate 3\unins000.exe
Size 1.4MB
SHA256 78a30fe16cbd955a90d77aa40c50b572c516a96a152898d1c45bab4eff9c187b
MD5 08dfacf84e5ff85665a00e3c9ea1e544
SHA1 8ac582c1a2cc980d8d6b6c577ea67ce2e82a7043
SHA512 2df7b0817dae08c9fd06f56d11f6dcd3db2f5f8cd12091f27d8a57b18d195f952519f5bc2c8fe0e93e43c796edb409d5671e0be099c89921421eccb8f6d9eb02
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextxl:cIEJxCWluyZ8UbMKR
TLSH
T113653A12A2E24833E1733F359D2B82946C367D642E74988B3FB45E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-364-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3392-416-0x0000000000730000-0x000000000073E000-memory.dmp

Download

memory/4596-365-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-130-0x0000000002690000-0x00000000026A5000-memory.dmp

Download

memory/4700-107-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-306-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-304-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-305-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-168-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-169-0x0000000002690000-0x00000000026A5000-memory.dmp

Download

memory/4700-150-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-369-0x0000000007FE0000-0x0000000008045000-memory.dmp

Download

memory/4700-368-0x0000000002690000-0x00000000026A5000-memory.dmp

Download

memory/4700-367-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-374-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-143-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-136-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-129-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-8-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-122-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-116-0x0000000002690000-0x00000000026A5000-memory.dmp

Download

memory/4700-115-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-113-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/4700-109-0x0000000002690000-0x00000000026A5000-memory.dmp

Download

memory/4700-9-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-102-0x0000000007FE0000-0x0000000008045000-memory.dmp

Download

memory/4700-555-0x0000000002690000-0x00000000026A5000-memory.dmp

Download

memory/4700-103-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/4700-105-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/4700-104-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/4700-101-0x0000000002690000-0x00000000026A5000-memory.dmp

Download

memory/4700-99-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-92-0x000000000B3E0000-0x000000000B3EF000-memory.dmp

Download

memory/4700-23-0x0000000002690000-0x00000000026A5000-memory.dmp

Download

memory/4700-82-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-30-0x0000000007FE0000-0x0000000008045000-memory.dmp

Download

memory/4700-83-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/4700-714-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4700-33-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4724-303-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5020-79-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5020-2-0x000000000041E000-0x000000000041F000-memory.dmp

Download

memory/5020-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5732-728-0x000001F10D000000-0x000001F10D3BB000-memory.dmp

Download

memory/5732-713-0x000001F10D000000-0x000001F10D3BB000-memory.dmp

Download