e4728765a28a078c5c089fe5c4e2ac2758455882530a76d1e1dc5c05ec4b44fb

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 5.4MB
Sample261018-1dl2csts2n
SHA256 e4728765a28a078c5c089fe5c4e2ac2758455882530a76d1e1dc5c05ec4b44fb
MD5 9629e19914afd06ccb291788ff1c24e9
SHA1 1dd8d84e40f950d46680f7bb4d358da7287c5854
SHA512 e1721fc5ca69115fefe419be414d43b0bc534399a98cf37c33be7aea2883e64640c9c7fe51c3777f922f2f3a35e1e01701497223a4c2ed5cb8e071b1857c84a8
SSDEEP 98304:bf7wCQInrje/CAVMJy1WGsF3V/gdQer9qlkb5RUCkN:bfn6/VSlGC3V/gdQITDg
TLSH
T11E463301E3C3143AE4601935AD67D5B86D13B7FB2AD060295DBCDB8F0A79183BDB66B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File created	\??\c:\windows\system32\drivers\etc\hosts.check	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts.rollback	hosts.exe
File opened for modification	\??\c:\windows\system32\drivers\etc\hosts	hosts.exe

Executes dropped EXE 64 IoCs

pid	Process
3984	setup.tmp
5448	fnr.exe
6084	FlushFileCache.exe
4144	unins000.exe
4960	_iu14D2N.tmp
5036	hosts.exe
3244	hosts.exe
1580	hosts.exe
1044	hosts.exe
4476	hosts.exe
3524	hosts.exe
5672	hosts.exe
988	hosts.exe
5440	hosts.exe
1788	hosts.exe
5612	hosts.exe
5100	hosts.exe
1368	hosts.exe
1340	hosts.exe
5724	hosts.exe
5304	hosts.exe
2776	hosts.exe
1792	hosts.exe
3244	hosts.exe
2224	hosts.exe
6136	hosts.exe
1648	hosts.exe
5932	hosts.exe
1820	hosts.exe
2556	hosts.exe
1908	hosts.exe
5472	hosts.exe
3184	hosts.exe
1840	hosts.exe
2548	hosts.exe
4968	hosts.exe
1184	hosts.exe
3756	hosts.exe
6136	hosts.exe
4616	hosts.exe
5468	hosts.exe
3712	hosts.exe
4184	hosts.exe
3068	hosts.exe
2596	hosts.exe
2412	hosts.exe
676	hosts.exe
5100	hosts.exe
5984	hosts.exe
1720	hosts.exe
1112	hosts.exe
2088	hosts.exe
2216	hosts.exe
2956	hosts.exe
1744	hosts.exe
6020	hosts.exe
4572	hosts.exe
2072	hosts.exe
4104	hosts.exe
988	hosts.exe
5488	hosts.exe
1620	hosts.exe
3184	hosts.exe
5348	hosts.exe

Loads dropped DLL 11 IoCs

pid	Process
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp
3984	setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1328	cmd.exe
6004	cmd.exe
4692	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	setup.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	setup.tmp

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4280-0-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/4280-88-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/4280-979-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{4945674C-92DB-4F7A-8A40-C31D58149FD4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3984	setup.tmp
3984	setup.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6084	FlushFileCache.exe
Token: SeProfSingleProcessPrivilege	6084	FlushFileCache.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3984	setup.tmp
3984	setup.tmp
4960	_iu14D2N.tmp
5424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 3984	4280	setup.exe	89
PID 3984 wrote to memory of 1328	3984	setup.tmp	91
PID 1328 wrote to memory of 5448	1328	cmd.exe	93
PID 3984 wrote to memory of 6084	3984	setup.tmp	94
PID 3984 wrote to memory of 4144	3984	setup.tmp	97
PID 4144 wrote to memory of 4960	4144	unins000.exe	98
PID 3984 wrote to memory of 5424	3984	setup.tmp	100
PID 3984 wrote to memory of 6004	3984	setup.tmp	101
PID 5424 wrote to memory of 2424	5424	msedge.exe	103
PID 6004 wrote to memory of 5036	6004	cmd.exe	104
PID 5424 wrote to memory of 1160	5424	msedge.exe	106
PID 5424 wrote to memory of 4668	5424	msedge.exe	107
PID 5424 wrote to memory of 1160	5424	msedge.exe	106
PID 5424 wrote to memory of 1160	5424	msedge.exe	106
PID 5424 wrote to memory of 2984	5424	msedge.exe	108
PID 5424 wrote to memory of 2984	5424	msedge.exe	108
PID 5424 wrote to memory of 1428	5424	msedge.exe	109
PID 5424 wrote to memory of 2480	5424	msedge.exe	110
PID 5424 wrote to memory of 1428	5424	msedge.exe	109
PID 5424 wrote to memory of 1428	5424	msedge.exe	109
PID 5424 wrote to memory of 2480	5424	msedge.exe	110
PID 5424 wrote to memory of 2480	5424	msedge.exe	110
PID 5424 wrote to memory of 5164	5424	msedge.exe	111
PID 5424 wrote to memory of 5164	5424	msedge.exe	111
PID 5424 wrote to memory of 5164	5424	msedge.exe	111
PID 5424 wrote to memory of 3400	5424	msedge.exe	112
PID 5424 wrote to memory of 3400	5424	msedge.exe	112
PID 5424 wrote to memory of 3400	5424	msedge.exe	112
PID 5424 wrote to memory of 4796	5424	msedge.exe	114
PID 5424 wrote to memory of 4796	5424	msedge.exe	114
PID 5424 wrote to memory of 4796	5424	msedge.exe	114
PID 5424 wrote to memory of 1940	5424	msedge.exe	115
PID 5424 wrote to memory of 1940	5424	msedge.exe	115
PID 6004 wrote to memory of 3244	6004	cmd.exe	136
PID 6004 wrote to memory of 1580	6004	cmd.exe	117
PID 6004 wrote to memory of 1044	6004	cmd.exe	118
PID 6004 wrote to memory of 4476	6004	cmd.exe	119
PID 6004 wrote to memory of 3524	6004	cmd.exe	120
PID 5424 wrote to memory of 4116	5424	msedge.exe	121
PID 5424 wrote to memory of 2444	5424	msedge.exe	122
PID 5424 wrote to memory of 4116	5424	msedge.exe	121
PID 5424 wrote to memory of 2444	5424	msedge.exe	122
PID 6004 wrote to memory of 5672	6004	cmd.exe	123
PID 6004 wrote to memory of 988	6004	cmd.exe	177
PID 6004 wrote to memory of 5440	6004	cmd.exe	125
PID 6004 wrote to memory of 1788	6004	cmd.exe	126
PID 6004 wrote to memory of 5612	6004	cmd.exe	127
PID 6004 wrote to memory of 5100	6004	cmd.exe	164
PID 6004 wrote to memory of 1368	6004	cmd.exe	129
PID 6004 wrote to memory of 1340	6004	cmd.exe	130
PID 6004 wrote to memory of 5724	6004	cmd.exe	131
PID 6004 wrote to memory of 5304	6004	cmd.exe	132
PID 6004 wrote to memory of 2776	6004	cmd.exe	133
PID 6004 wrote to memory of 1792	6004	cmd.exe	134
PID 6004 wrote to memory of 3244	6004	cmd.exe	136
PID 5424 wrote to memory of 1516	5424	msedge.exe	137
PID 6004 wrote to memory of 2224	6004	cmd.exe	138
PID 6004 wrote to memory of 6136	6004	cmd.exe	155
PID 6004 wrote to memory of 1648	6004	cmd.exe	140
PID 6004 wrote to memory of 5932	6004	cmd.exe	141
PID 6004 wrote to memory of 1820	6004	cmd.exe	142
PID 6004 wrote to memory of 2556	6004	cmd.exe	143
PID 6004 wrote to memory of 1908	6004	cmd.exe	144
PID 6004 wrote to memory of 5472	6004	cmd.exe	145

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\is-1IPSU.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1IPSU.tmp\setup.tmp" /SL5="$400C0,5136807,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\fnr.exe arc.ini fgrplc -1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\fnr.exe
      C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\fnr.exe arc.ini fgrplc -1
      4⤵
      Executes dropped EXE
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\FlushFileCache.exe
    "C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\FlushFileCache.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:6084
- - F:\Games\Thank You Bus Driver\unins000.exe
    "F:\Games\Thank You Bus Driver\unins000.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
      "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="F:\Games\Thank You Bus Driver\unins000.exe" /FIRSTPHASEWND=$402AA /VERYSILENT
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffdef5bc188,0x7ffdef5bc194,0x7ffdef5bc1a0
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,4513400113152742365,6981241785609556975,262144 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,6850253814016825987,18042521456964130804,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:11
      4⤵
      System Time Discovery
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,16164580411533213289,10840909692265399343,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3212,i,8487649160788656574,5623988058797407999,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3216,i,14002297557388689047,18243969338604614422,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,17839433150586279374,16349402937315974129,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,15040268858702505414,15428834821156848913,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5240,i,4696304021194213879,2916861701393155419,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,4922725395553236483,155127716328016632,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,5133141253003785879,2542375011750411411,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,4203149421575997701,7822463146780902104,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,16762763851136203723,16740041016223847865,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,16762763851136203723,16740041016223847865,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3260,i,6482642086868053267,14753280384922494264,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,5676279796385786577,11604439672565031683,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4736,i,4453759946857830802,10852587818353716972,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5392,i,8761748633595199680,12247815924844196564,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6828,i,14126627701744820478,13437990900994292756,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4136,i,156228867951816850,10065962556773883692,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3488,i,2390097071079150098,17777538117532496473,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,17093732652872682781,12814016095632453415,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,9994271294314068760,10080039000772533029,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,13357462671446949936,5069773823725430921,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5676,i,13553524985751523559,4999611266454745960,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:1
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6904,i,12430133721680019672,14062389144283394036,2097152 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,17651152669846468594,586345988312611567,524288 --field-trial-handle=2720,i,8625266570692301212,5554449411833402380,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:5312
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:988
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:676
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:988
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      System Location Discovery: System Language Discovery
      PID:3872
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\host.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:252
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.co 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.to 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.website 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add ww9.fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.xyz 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlpack.site 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repack.org 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.pro 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.games 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:244
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks-site.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirls-repacks.com 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.cc 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepacks.org 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.org 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirlrepack.net 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.com.de 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirltorrent.com 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.in 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.fun 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.live 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.download 109.94.209.70 # Fake FitGirl site
      4⤵
      Drops file in Drivers directory
      System Location Discovery: System Language Discovery
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.info 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.online 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.tech 109.94.209.70 # Fake FitGirl site
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe add www.fitgirl-repacks.today 109.94.209.70 # Fake FitGirl site
      4⤵
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
      hosts.exe rem fitgirl-repacks.site
      4⤵
      Drops file in Drivers directory
      PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/fitgirl-repacks-site
    3⤵
    PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2488

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

48aba48c-393b-4f8c-bf7f-687894cb5670.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\48aba48c-393b-4f8c-bf7f-687894cb5670.tmp
Size 37KB
SHA256 daacfaa9e381fbf696d29c7380c4fe2263984fa6eb1aea4564e2c2d77ffa46b0
MD5 2d90474116ac2f7525ac38ee2af79ae6
SHA1 cde434eeca5b9f1f04e09eb8eb651dbf8ec8c4f5
SHA512 14a0444916f97baf5af9478880c56bc9903cbe2fcf371a9650e35338e4bdc51d9cf9066794a83d9c537280366aaeda57ca1400d10236e4f93c066a74dfb686cd
SSDEEP 768:p/UxvxjgC+k3Xvf9cMqHyEMbxyJugQVTJ7vvmevBSHtBk:cZj3+k3twyEmxyJJq17vrSbk
TLSH
T10003CF35ACA59C3388F792843649E787EFF505A398C62BA485DD6F0E128B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53262998-0867-4a9b-9a37-07de4ab8086e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53262998-0867-4a9b-9a37-07de4ab8086e.tmp
Size 40KB
SHA256 3adfcc662c8ab8c7b79920aa4d9e14b89cfa73232d1af21775b46ccfcc922d61
MD5 122005b37daeb98d08138d2b51d80b8b
SHA1 840d06ee31b43f2cc7f9e2de13ff4dfce8a6f8ed
SHA512 35aa6657437071eeea52ce41265455a9b9b853ef70cd22d6652ed29fa8d377da132d46a62a0cf94b5162ec1d576c1f3b04e37c49f33f0893ef0d41f2fcfb49e4
SSDEEP 768:k/UxvxjgC+zUs3PCMf9cMqjn0yEMbxyJugQVTJ7vvmeXExTrs:RZj3+zUs3rG0yEmxyJJq17vehs
TLSH
T1E313BF396C659C3388EBD2487659A7C7EFE805B358C61E98D4D85E0D06873ED270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

289d4def-2bcf-4fcd-a714-c4e6b324fe04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\289d4def-2bcf-4fcd-a714-c4e6b324fe04.tmp
Size 12KB
SHA256 3829c625c172afdb1049626ebd9c98cdfc6f6134c098ff0a3b0289ce917f07d5
MD5 6815225869ec38ded8212ce92380d87c
SHA1 95ce792950886e7c93a5cc7929707463b7511924
SHA512 671d5564239bbe37753040d68f1ec08494066285cb1300437bedbf14adb0d097bc51486c15b1eb64a93bd3bf9630c6dd607ec1ab6eb0163b7a92b75159a4ab73
SSDEEP 192:sxRtRzC//f3sCS7ZyzmuzoA8pgpG/g6+WNCrs3tz/eL15dQkFyRFGJIgDaOJ:sxRtY//f3s11KmTd/57/idZ
TLSH
T19642C819AD38697B8CCBD21DBAA5BF63D2F91072A1D51F44A6FC891C04E76DE520380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35b827c6-362b-4f13-87d5-8e5e0ad8fe7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35b827c6-362b-4f13-87d5-8e5e0ad8fe7d.tmp
Size 29KB
SHA256 285affd41e74f9362a03cedcf5afdde472ac623c0c33a35c232318f401c54823
MD5 42344c5be5c6c1ba815d3b493dfa2b24
SHA1 5437f53cb04ee8dc0fc4ac13bca4e4b1faa2de60
SHA512 febe6eb249637924c093c910e6a5e58561caf8181486096eb08b51d74f97935d2e19a9431fd51bc10fbf866f96ca5ce3e0624ad367740fe154665459cfb1c962
SSDEEP 768:+l2PYq7pLuLbDKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OVv2I0a0tro+Px3:+l2PYCEbDKWgwef4eu1jas2Ih0G+x3
TLSH
T1F4D2FA7B640CCB7F4F904ADDA8297E8F6DAC02CB9698C94047FA941D03C67EB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 20KB
SHA256 7b07da52d59801c665d44348bb3a1f20158bf0d58d7108949730cc87d5410f81
MD5 829d8d09ce262a1b434c4fd5530e068b
SHA1 f09b867aea3fba167729a7aef17aa23a09123ea3
SHA512 1d5813558bdb60fe032cd5c6413a71e8c926e106addad58b9cb9ceb2c53b8b1b8cd69d77174c08e74a732297884dc83731bfc9f6a91c3f04b7f59b780ac5fd25
SSDEEP 384:qrN6LFMFVcnV5URcsYxj+xjntoodlN2P2zasKme0bJhWbN5bLZ1vRVRoYPR6fN:q8LFMFVcV5UtYxj+xqm2etKme0lAx5PW
TLSH
T12D92F6A620FCA8B53223C0F667A27B1ABA2D1047B14490E0F47D4F459F59EC751E3ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 26KB
SHA256 36afc57d2ba5f57bc4b68298a491cf9b3b66ab4ccc9800b9f8ab04c6f433b6d3
MD5 03535c21648e5c45353f05a29dc71812
SHA1 ef98877e4a6fb6fcc4da868480927c4dd2866b70
SHA512 8e49a33da92ed9c25646e6858cf6c4b6f1a03128d926c78452a967121be73edc8cc26c9ee3a7354cdc9a55494ecf085ecfbe5087d1a801c8ea77c17ff2a7bc37
SSDEEP 768:EfSs3T8HPKVySdJpavSmpsBZWwGNeTwAZcFGWMSmLGBU:E8PKo6OvSmpSwrYTLZGGWWyS
TLSH
T1EDC2E1DD98778305EC4C92D0ABDF1E6BD229C7B426A48B7B8108C4D9145F2E12BEE582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 16KB
SHA256 5822c1ad5bfd86aa17808a851d6f05e560c2773f61a728f23cebf493dc9a4ec6
MD5 a6c2aae1b41d9e328c4f8e6c34e3d12c
SHA1 7c75d35e20e45df9c90af96eb32b81baaa55b50d
SHA512 6f37cda5a60bdac2b015f5476d99e5ddebb1725afb38dd95f83fe23ed6d51e235e6fa64f7f9e70e4ba25a5bcfafeb024496b830d49fdecc1b41bacaf9ae860d5
SSDEEP 384:9qo6FtEwxqU7r+kIOwdJeTNqIxQuZAPV9wyt91vH532m4ABbM9:90tEwxR7LxcQNlXqPV9ZlZmmf49
TLSH
T16272C07891E16F2CF0C2DC35C5FCA5BEEE12241F9A342A23266D942CA657655FA050CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 115KB
SHA256 29cc8b1bd7ec0fad3f9f429eeabe98f11ffc0eff31696826b58ca315b3142783
MD5 a9c96ca703f743755ee3ce4f22325e25
SHA1 5126687933242a249920a6f3a25e7fc14833c19c
SHA512 dfadd8659cc95d9d7a571fd750e7f11a6d4b293755d4927302493c1a738e5f093f72303fe86e8f55bf8c2a33b20f707b36e94d7a1bb3d4491d3b8fce17a82932
SSDEEP 3072:j4PKjpdnQGvbUBkH4Ud9pw7jDhmVN3G9QluQYdjvynG:jm4gKbUBkYsIDhmfkQhJnG
TLSH
T133C31288434B4918D343AB4196FBD8E37C2B5D3AF6D43A3B9508CB6DC2688C4D9DB1B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 177KB
SHA256 e60454beb863fd44867f54987d72248bf544533e9633c22ab8c98d8abd5e88c3
MD5 8b4a702d92045739f8a4350fa3d14262
SHA1 ea93545c0c57547251521e69ee84db20b742314f
SHA512 3f7cf09194103e4e57475c38387167c23b40dc3051f0444aab568db3fd18e2d99951e64d98abc2096dc3f3a356d834ebea3ae38fb722642021bbc65d033816ab
SSDEEP 3072:d1QeREgdGl70AEC1jD2W1eiYvYBvW94mf7l3lzkTEwwNljSqgLcToLjd+Zu6hesZ:z8g0BNj6W1vvO7l1QTE/ljjbo4ZutsUa
TLSH
T11C04128589DB43D0A5E71FD82D8354CD89A83E41C493236761B3E436B46253EEDAE32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 47KB
SHA256 f9d6398aee6dd88863adcf566b668ada50bf302af959243895c7d87f20a2524b
MD5 e8c7becd164d1e8e3e867b1031ef3ac1
SHA1 e195c1d819fc7140dbf1288a899a607222c63862
SHA512 571d8db5c40f62fe978c2ea157c50c9a4f57370044f6b2215c8dc1c724704ee19878eb22d3b09ffcd9d9b0197a323215bf02ca3ee85803abff5ba452e332e6b9
SSDEEP 768:8X2sqUbNCfsmI3wUlZTGlboPQ9ojiFSA2ZHSnSspcra3DXgkp+xHf0mCqLwONMmy:8X2s3mI3wAGlboIDFDs4Ss/9p+x//5NY
TLSH
T1AD23F2BB60F16A5E62392D1C540C86AB4CB9E338D725232DF19EFE4401E5FE7AC285D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 18KB
SHA256 da82eb142ae08f5e8172fef67ce537b0b2a33e972c91e57adc92c815042fb0ac
MD5 87fe2bc193128f01671c6bd1dbe61a5d
SHA1 64a8c898b8dd8c39bf4bb0231dafb2f5c5881566
SHA512 a6eddda04934dbb7d269ccf8c9ac7cf919defc376277788b8e5f29a23516b00521ba702fab423dec3065ce2b5c70785d6a606edcec56f8914293a1e33db694b0
SSDEEP 384:X2lvYlBGHOKFPAKVvCr3mHwQqsQZeVDITdgp:XCoMHdPAprWfLaCDI+p
TLSH
T13A92D026F9C44BD264EC78E36DC8AB80A1E5E0BDE91C9458CC373C1D22D61B5843E25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 29KB
SHA256 d497d6bc810ed94b71d2e001768c9fc043aa8ca888864b44ce143b695ce01599
MD5 455cc6c3d25e197d9647dd42676644c8
SHA1 7c5d524bc0a529d921eae5dbabd02b0df9c223bd
SHA512 e8d198f81f73d8daeb351b8330d9791f59d59f511a7fdeba6faffd9e177512f800f8ae142a1d58df97f249f3be7a3bbc8b3139ff0f3a3bfca898d077aa4cd743
SSDEEP 384:s/8Qq2za14MTn/PdzYGVViixxpy2lMxviSNS5VxKj1RouxTRsb5GCwDI9:s0Qq22aM7PdzYyry2OxBWUDouzyGCwK
TLSH
T166D2F1C7C4ECFF26E0D5F9232928E4206AC74449866D675C6A0DC1CC36553AAB17B2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 34KB
SHA256 ea7991c406d76572a7d81ea53e3f78d70b4327fd50f759fd941047d66bf9b754
MD5 8feeb31c2c2b1eac8f5dac3b20f6016d
SHA1 9d9797e1a9e800bb6f9c5aea9eb9a0a1172a11fe
SHA512 1a54eb0938f08f0d54b241b8512393263621845756061afb772745a379c124319f4c4bab312902b99c057e96dabfdc1f6414dff9f89605be6196307d1a759ff7
SSDEEP 768:oLtIAYS1rDia4/tR/0Ohlt3A4nSYYCuWwfhqc2sR:oRkI54Fl0gU4nHPYqc2u
TLSH
T1B8F202846453AED3D5BC4C768F000E8CA78EA3516A8C164BDB8A093FB5D2C9C69713E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 59KB
SHA256 3db58b350ab3e83d5956c092c42c5f5763d74c7893cd0e96a5cba38c436dd733
MD5 1ed07779bd06038f7e3f2cf56de5fc98
SHA1 2406b3840b548aed419b41c0a7c611f75335f452
SHA512 932d46716434ccbda0ea75f1a5678ac36d476565a0a31106c7e72ab638e2a5d3f4415f47adbd6b27cad541c1415ba91ca9dbf691c3ff5d502927a567eda3026d
SSDEEP 1536:MQYskGUutiMzCGmZh8BR2NIqEfSnfyHGAryt376Mq:MQKX+iaxmrJ0fSnKHG6yt37rq
TLSH
T1C353F12FFCF80E32C1EB15BC9BACA1C79C4FAA57579C018B112E54F222162AA857505F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 20KB
SHA256 bddd8699e94f39eae40fc3cfa2d55e4bc0ecb41724c54a4002675b6901236ac9
MD5 65b8f5daf46216d781b54911e952ea74
SHA1 53118280dcea06f00c421fa73437c9194dce098d
SHA512 ee2b7d126626915236da10c0066a2b11e2aed03e44d5602aa5a2405a5717e5baa0750e71dce5c0706b56f74a9d6459e1408d0da3918187dd1f6c27d27fae598b
SSDEEP 384:8RkYDTQdHtAduAJ/7HYwG4DVAg+CBKkhMRay+WLWc05VSyc1ucw4IGLv:8uYDq+N7HYwG4DVALCUkCRdosIGLv
TLSH
T1AB92D0890F989E47D3DC697E0257F8203A6E28B8913B572282EE5D1DB6991FF0838085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 22KB
SHA256 c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
MD5 de69cf9e514df447d1b0bb16f49d2457
SHA1 2ac78601179c3a63ba3f3f3081556b12ddcaf655
SHA512 4aebb7e54d88827d4a02808f04901c0d09b756c518202b056a6c0f664948f5585221d16967f546e064187c6545acef15d59b68d0a7a59897bd899d3e9dda37b1
SSDEEP 384:adpABC4a0HkBpR1HWtGu06B6lsoAKiwY0HcLKglV6Z+DVb35PJZDdiZeJ1vqYg:0AHa0Ezf2tZn6lsoABwTKK46ZQb3V7wD
TLSH
T1FCA2E1C05CC1E2D4AE02DAF7FDA5A4EAB4E2F01123A8F65F8F114B75D505993640FE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
Size 23KB
SHA256 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
MD5 e1b3b5908c9cf23dfb2b9c52b9a023ab
SHA1 fcd4136085f2a03481d9958cc6793a5ed98e714c
SHA512 b2da7ef768385707afed62ca1f178efc6aa14519762e3f270129b3afee4d3782cb991e6fa66b3b08a2f81ff7caba0b4c34c726d952198b2ac4a784b36eb2a828
SSDEEP 384:dRkIAJ8pVwWTW5VVjdVn8+2yvAMdriCEOY0kfW9GkAPqpPHi2vUuUSzB8:dKIAJ8pVHTZ+riY9oCpPHiodUeK
TLSH
T191B2E1CE5D546E3A8028213785C17B488273572E9EDF42C6DD83A6263A7092CFD3D96E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 21KB
SHA256 08664859baab5ed98f0bf818ed77e38464ff1826dc6406d5ecbd651409afbd92
MD5 1c6c65523675abc6fcd78e804325bd77
SHA1 898d9808304dc157f5dcb18ca169ec6e2b96b3d7
SHA512 1505e8496c9bee214c5f8815f8d88a31ffe2baeb6fba81a8228bd52220b9b2bb10464c1e1dba11d6881583dfa478cdfb30a79cfa6f069c362fb65443feb06918
SSDEEP 384:ZbL6k1TUlBxUp5VLlLJGv2VulERzgWuXlY9zehEsapJznPEUAAnUgf0n6iXatBbF:pLfTuYfVVJGv2VuIzgWAlYteh6nPEzAF
TLSH
T18AA2F18A13D7A414878983F12C5ED63D7FAC7CC7994282D2A606BC494E3DCB6B430BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 22KB
SHA256 115f6a626ca115d4ad5581b59275327e0e860b30330a52b0f785561332dd2429
MD5 716309aab2bca045f9627f63ad79d0bf
SHA1 38804233a29aaf975d557fe14e762c627bef76e0
SHA512 adb0bc6cb9b230eda5dac7396a94a9a4dba9c8ba0b2eb73f5f21a20c3ca3d14651420bc6a17e67a71b5bba624f5a4e92d55cbbb898985dcca838184f6dfb2b15
SSDEEP 384:AHLaTYDpoR9l+9cJHxkGk3kbFpW88POLvFd9EDtwntxiFyLs86d975a2sfbAh:AHLKSSD49c0SFQ1wFnCajiws86dJ59WK
TLSH
T18AA2E10A0B99E00FF53655BA7504DAA0B1C554B9C3ED69A2A12115C7B4EEECBF83138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 23KB
SHA256 bca1d88ada544d9c80872d4da27133fab6d347361fa26e932b47ec9559088fd0
MD5 efee2d080d7bebdd2e0aeb2e030813a0
SHA1 f8d38f9f9584e48c2e469877ebd94232265585f1
SHA512 16c55ad46a26e0af340f2b8a89bd98c1ccad5c976b434aafa7d1d8cd5049b40a58c5350fa42029710c9dd8040e7cea05e57979731b941086ca096239169f4f3c
SSDEEP 384:lwfLHrvMt+iWkciwtprblXNenWbFrqBY34OlZDsnNBvlUg0/qxFul2sOgZl06t2b:6bjU6PflXNHFrZJLDsT+gpx59cS6t2b
TLSH
T155B2E06F8EE485008CD9CC61F39BFA6E96D73D9F437D96C2CE8311360E9A199115424F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 61KB
SHA256 db03af9ebd692f72a4fd12c2ba0b5aa9fa3d181b87e40ebcd5f4f8ded659cee9
MD5 7c7183e765ce1f7779e651eee53902f1
SHA1 52cee1d18db8c6aec388688dd915057ec4c3dae8
SHA512 b539148e5250218418a6c92298a363ad228ea7d7ff6df0aa9ac727f27945f61164ce159cf8ebfb1cf4e7e1e6dc906963ce7d9ff31344ab916f1ffa644bda71c4
SSDEEP 1536:uaDTEKBkFF+IbZGrMAMgE62WMajRRY0b9zLyrZ8WSmEIW/z:/DAR+I1GgvQ2ZELb9zLIvEIi
TLSH
T1A95302CE83989D47FC37DEB9CB755D428522FC70964498BB65912C3C615C38A0AE8BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 16KB
SHA256 f10b01e47f45ca034d0747c88ebdabe4ec544845c61ea2b26a93e89631ef0892
MD5 1c6af115b41b1e24c1d64758cb882b41
SHA1 69d86d7376d8ecf89b97225e0089c831f05bc4fb
SHA512 9e79b43002c67ece89094410c90ba2de24e414622043c64506c4e4fab8f164ed1e3b1ae46d58578120e2ee3034f9f8c8a11dfa8bf06dd14cf9b8a454aaf3eba5
SSDEEP 384:8Z2Yx11pI/cqUp/2n+vc83xhZE6o3f5deVvnn49al9ULR3OhTXrC9leT7cX:8Z2EVO7nHMEjHcnnYaly+liaO
TLSH
T19972CF7D8F1B4C02B1F88737C439E038B2961A6D54FF400EF542D914F558E9E8E4AA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 107KB
SHA256 8810ba3440bf482ced33d2f74b7803bba711f689d8e4caa7da5c6ae6844a1b49
MD5 12ee76445f0383c58529169d700b6650
SHA1 7f7208e7b28e0862b82e05c8d1715540e22c111d
SHA512 0ceb728dbdfc60849cf074ac7fd91b73928ff67c4eaf481f1f2972838fc58000bee8d372b0be2264a57cd5848f15ce437fd5f856d7ea8c49e09937a0e106df3b
SSDEEP 3072:N83ShlsVrFMGjJ/+gan9ErWlYGMaU2WHSCfd8u:LsVNJGpuizZHWHXSu
TLSH
T160B31291222480ECF57B3D623FA325FDC6964E25654A370A332B7FBC815A71C28D745E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 125KB
SHA256 f7328a8aede31792bedf551fdf63a9d09c65cd2b83f9889e987b964bf43da3a0
MD5 c5158d988854d6daa024b0926e430b0d
SHA1 86e63a4dd75fb50d8f9b01cc1eb475e1b106bf7b
SHA512 6b8e333513fcecc3a93acd1f1821f4487f4b9f7e6b5bfb97e12ba9d94b7aa9defa132243a6ca32e50db05711a65e2120b12d9c999eb487e2dc43d9339c6ff8e1
SSDEEP 3072:/rNICUKWrOPVz5lxjzmKX9SduvVzeb4b3PHlOzxd0OBgv:DNI3KWrOPVzBHTSduvVzeUbflOTPBgv
TLSH
T1C7C3124FEF88F8D1F56E763878DC2BAE23F76F86E24B08E5805817094096684C65F572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 111KB
SHA256 db1b2c26301fd475b8e11f04b0e12b08493f24f560909d88dec2565870d0feee
MD5 00426da1448cf08a83e6a80d4327afac
SHA1 c0ee1c463ac4a9a4e7e0defa35ba578792ae9037
SHA512 1f49bc256db876bbe1a8bb094e3801ea03df6d702f8e91a790c14aa2d79db47d71a51807759f05f23856926e7eeb1a35b2d85d654e453ef27a61a2fc79bdc99b
SSDEEP 1536:jz09tOSUBiqosA9y9z2GAtFRLjlXeL6ttr6ZAHrezh+rFfQpdQuZhY5tsde4M1zz:XI1IRh3AXRPlFrTHrIhEOQdtLRz
TLSH
T19EB3124DF6C7396B407DAE34770DF3C7C86A74DEFA629E420A6C0308E47880A7A5B854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 57KB
SHA256 79524cc3bc9af497f4ce9ac9f485684590c62a272902d363f3e1708d3e1c3919
MD5 cd5f3b8386f16d4bdd4aa2618ce96eb3
SHA1 ce7fa86419f1e88955df97ba48f21276ad38b116
SHA512 c9abc3fa3114070060e44050008b40be9e8506aa2576dc235bbd24aa43f066396c52e3cf4010174af4fe9996e98ab10198eab7d14c41a1acab00ad63639005ac
SSDEEP 768:NUeNeaaIm2TteN7NgLtWN5Q7o4FnhytbOwG30yaPqWmpqpm717R/uFOdA6IH17CE:NUeVLeN70tW3945EBOwMS2Apo7vGuVk
TLSH
T1A8431258182DB723209462EFCE64978C774784F098053D5267865283B8F5DFA723FBB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 150KB
SHA256 2185fde23675fcd48cf569fe937534632d7e7ff5dad16ee520032edb9a99b516
MD5 4eb54cd6ed38be8c2e049d04081563ca
SHA1 868bd074ddfffd770f51379a79014c0857eb919a
SHA512 e5f5e6edfd88f0f7bade66a52ac40d9f2090501ba94eb9cac954363f2f5e9b9cba06e748088675353c226331db205a1bb0cde08b2615a09cf26936de6da82442
SSDEEP 3072:S118SqDUIKnfEoi6mi9T9ywmyGaKVKvblBjJwD:SjGPs7bmK0AGanjlwD
TLSH
T14BE323B1434B5E0EE0CA7DA69DFD546F6E937F140D02F04B2D585B4A824C97D84ECE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 470KB
SHA256 f519361733f4bd70760c9375750b9e1ac67e40b11c0039aec70381f8d2fa3c6d
MD5 b4dabae63b04a860d551182f605bbc4c
SHA1 b37223be69524fae2ac3bd209277093ff1e3ff03
SHA512 2fed5c3c1b4e83020370b9e9a88e8dcc000dc73223444e3257020c93eb351270d9e6e82187af00b6c59057f1ddc4ee0787731c8b12dc08e9d8aba239dccc1440
SSDEEP 12288:kCKvTh1YgayZaaXxSvj4Pf+y5HrcGj0OM:i7h1YEZrBS83h2
TLSH
T1EEA423C2676819F41A47CAFED1BB87B3C3779A00DE8140B0E7DB1675804A2E9712DBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 19KB
SHA256 7759dda788256733f95fec0ae0091a0b7b34619d7a1c321c6f9ceb811947dec9
MD5 16c0593305085da9030bfafda1888873
SHA1 41cfc6024c14c063dceb458986a3316bca3cded1
SHA512 d7d5651f483a504c3f5f3c2248aca003033320cb39861410ab3b78f69cb833143df05a46b754cf65e2525dcbbc2df8d91d4a3e4687465413c847ee26c7e50fad
SSDEEP 384:BrMGfUQN0MgC2YSdfLcZMdZ+S7BDvuE6QBHbAK7BLbS:B4Gv2Ld8O+SdDcQB7AUBXS
TLSH
T1DB92D1A7C7036040FC26ABF6039D3B1A3BEE6467700670F667E668AA1F26786544C744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 16KB
SHA256 df6910df85862598d795604e2cfcc04ae66907a96c80da902a65aa940b40d16a
MD5 9531840afa3233817e453ab920fa380e
SHA1 4314cd08f9abbcc40cdb863c3aaaa2f0a9f6a257
SHA512 b5566922f50bc32ca4ac5f49e8859b634cb842f80afa837930d19717af0658531fd8fe2d52c09b73d3136e7781c33ff1c2b17fff6156827b2b10b685d6883fd1
SSDEEP 384:zHEzJztDs6UPum6BX/CUOnJ7sbTFLTd2rqXo2Tsqppyt6F:z6JztDs65X/Un9sbJLTxo2TGc
TLSH
T1A172E0F93B035543C5A9CF754D6902076B8219FA86C274FEDD8F7824CA5E357DA13148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 16KB
SHA256 5fa34aeafc65caa4046ad7dc38fce54cded0cf516fdedcc89f8a9244cbd37c9f
MD5 96745c734273481e75201342bf1e307d
SHA1 f2322e82d9058b433836c8c9beb17b94c0eb0df5
SHA512 6bbfe6df928535223bbfcb3b6a1b5b7474d74536d003f6ee0a7b0a0991dc37d2fdeb4a10a59d4ac173dff9c6fe34f17e2d7a31dfa039a0ed86221ee5d5d26df4
SSDEEP 384:10CSIpOw0i5qi9dvUD3Cww45AjP7HQi8wX90IdvcDEHfl6IishR:1vSIpkMFtUzM4oPTQidNldkDEd6IBhR
TLSH
T12272E170F363420350AA4179689C7C7BAD9FD6C2EF6DB3D71CB98905C0251AE2475E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 17KB
SHA256 336bc0f158fb0bc53fac0aa022f2912bb1b94f72f07d2376f5e45a6ea028cd7c
MD5 af83f713332ac9f6d2d2ca95532f3b18
SHA1 41c3a7992310a844850a04ffe6d1fa60bbb7fca7
SHA512 7896ff28500aec996c0142c294836865ae0af2fab88459e7a1d502db187307a5ae9ff485bd7b62f5ca1dd7f9725fa893de8b6412e40f811dc3e7fa12b69dd9a4
SSDEEP 384:EcShJj+O+3h3NqSPCcOpvqglDTGdLQOZLeaMFdMZoZxIa:FK+OsxN4vNNTGRQOU9GZcr
TLSH
T10F82C04E4333AC04C1568FBD045E6C8C8F9C6769AB95BAA7ACE0FE4521E31B648856F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 16KB
SHA256 de181efa3a11007e35a0b6060a4e645962ab1468e662fbac0b69884b6b363476
MD5 710ffd5f53d512b5eaa81a3a84f1cc5e
SHA1 e70a8cf9633834995baf75985d25dba5dacdd698
SHA512 6db5b50269f878eb09f53fe77ee3b4acb321a1613a8d60fa118f4a6b367b52db69a4150eef45334bbd5d46b052f7b13b36f8836b030939f0b1cfce924bcc68ef
SSDEEP 384:Ym79Su2NViEuK9/dS0JbW5EaqvnZbmZiCE13LIH2i+GgG1:Ym78u21d/S0pW5ElhbsBEplG1
TLSH
T16D72D0CDEB57D920D5AA130784A226FCF23C7F62680231C09CD055DDD85EDE68529FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 17KB
SHA256 2261985decd1ffe7c70c16553a0eb8a1b5d3b6e7f64d06d51075d35a38ec54fc
MD5 3f0da8f2d6455f6f69a02c151857b10a
SHA1 ba57e920251c8a9f32aa2a733a6c181426441f92
SHA512 e0e10deee4876363cd85e5f3771485646bb9bb6ac0ff2547c621d648477f17844ea0d134addc289609b5ac64f1d7fe0cf86802727cf1e23ad61a1e23538768d6
SSDEEP 384:LavJaQ7pMr8VtLsV7sQstnKYLxoWRSvoh+njJ/UjQBN:mOr8j+enLtRS6+jJ/4Q/
TLSH
T1EE82D03B9371170BDA9D9DE784596B5673D0F740980B349EDBAD148CE682ECAC0E805D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 21KB
SHA256 461b181a8e3c1a0e813976adfd795939ee33c5c03ac96ce365b79224b7e4baf9
MD5 3c24efa3d611ccaf94a6ee56af31d1a6
SHA1 3396b1db99f356a54e78de1f036a629c98793f71
SHA512 5107f18de8ff01d80a5e3233d58aca302499ce3b6b4f38ee30e005ddddff246aee4e0c26858ca1e26357c3c1a8bea1c227dc4859ea7781c6d2a190f9aaab7f3d
SSDEEP 384:uCA9dub0jJ3Ggr+ReAU3cMY//0GbtbzpoT6qVGk7hNNPfL8Zoz+Y8OO6skH0WCmN:u99zj4g8ijoZzpK6+ZhDfL1v8nVk9CmN
TLSH
T188A2E0EAB3188BC0F1DCC06D864DC11A712FBA28FE24764A0978643235CB5FEE1D5506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 6.1MB
SHA256 a081649a6f4536518a9f925a19042f03f779ce617b72f05197bdd40e25d59603
MD5 37bb475c9c112d4878cb45bfca8aa354
SHA1 f4cb58deeb9e1d982fb52b31d155e408918a492f
SHA512 b08a52cb988e3419ebd375ded77d258ed3378c3dc7fe79f860a014fd8d5ac062d7ca2261462754b8c815226d5fcd7d1093b78f001567514bbdb67d4266a909cd
SSDEEP 196608:ModZQ7uai87VusjPut4Sbob5BtTYzRSm3gVx:ModZh85Hjtv5BlZhVx
TLSH
T14D563325D41B8620EC7A74F8D9A3574DBE0B7DD438F10917658BEB8F306E0BAD0A7980
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 1024KB
SHA256 c0129435b6825a733c9da5bb5e1c8ab1907f33839cea21f7d8b2a28f9bfc291d
MD5 82239d87301d74f700a9094ed34416ed
SHA1 b70a59f7bd8562b9698f1e1cc54a85ae9559b865
SHA512 3bf6e9154b6fa7e5c2c74987c6471201133829fb6d3e8fef0c445cf8e3c0d76355e99f0815ce43c3226d3c508442583ac249fdeb84c6b9afc0a19ed81c94e1c8
SSDEEP 24576:dPolXmmmZEQmd2AyO3pdnEuCc6K+tu7KnOUYNSQMqdyLsyAT6SSB:dimR5md2dO3fpYftu7KNQMqdTyAk
TLSH
T19F253379768A0C31DDA1EAF9D147A20D39BC65262D89CCD4437069E83B8F7D7C81E60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 295KB
SHA256 41e33bc91a5698155eaf6326f50e15d0720dc6611e24d4648d4aa30d5aa7e693
MD5 1eb55a558b48d8532e06295874712b8e
SHA1 a6c559af89be01e4fbc4d79e3fa9e860a4df89c1
SHA512 e3da482b41d5a54f79b9316f3a9c846b5c0df4ef084d70d7563260c24e9156dde8cc98250cd3f1acefe228d1cb7cac55d1f8ff2ff9c3706c39c18c91e7e215ad
SSDEEP 6144:R//PV9BBmMxQsDMlnL1wwMUdCYH+58nlFBIb1nYkM:RvblDc1nCDynLKhnYkM
TLSH
T16F542334C3CB0B18CA16CCBFD65AC6E35A5DDD3660096A96FD78ECA1C651B8E3C5A103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 1024KB
SHA256 5749eec2238f82983664f94c1d7cde781893d4f23c012f73043da98583ec2aa9
MD5 000045b4f0c98cf5ee6ddc8611ff2b2d
SHA1 478f80400ea0066e950b222b034567a65dca73a9
SHA512 97da6d72ef9cb7e6be2d7377614c9c2f0f230f2f0c1bd340c3a98aced62ba5a84069729d662f90305c46c6568ebd0b7d7501f6736fb26b1a26051699621e56c0
SSDEEP 24576:MeKNsN0FoWX3fQbtBogbnfpT78JPyWKM6JtY8QZOb979ALE9OsvmbpU:bN2JnIRBogbft7W6LK8uM9AgHspU
TLSH
T14E253325BAD0CB66DCB275B7CFE902FEF020EFDC3E42A0837DB494A5B5512655A0C906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 1024KB
SHA256 ec99f30869d1099dc4729a988f032d42bd5813adda9f1610cf4b6ab01be663c7
MD5 673db8ba19b6a449064bde617991ddd5
SHA1 ab08a61765e1dc4d90cb4f3781852fd6ea85a56d
SHA512 cf7d9d48a8e6a05e8032db2517ec41d4f214fc95ee1eeb052080fac7f75fd3712ff3c32d6d9911319af703dd7a0e64766b7b912c9106eb1832d377ae1bf91990
SSDEEP 24576:NQtYF3C9JvltcexyVVVR1f9gjZTcIc6ob9UEhzw9lCAwBs:sYlC9JvzceUNgFTcT6o/K+AwBs
TLSH
T1BE2533EBD86E6826D68D7D75CE270812ACC71F6D75C83CD89B5839929EB5D0A08334C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 890KB
SHA256 710faba4fbbf27c5fd738e82f760b05b1226b2f2375c17d6ed27faee8454cad1
MD5 629bec94aa2892be742434e6d71e47ff
SHA1 ff76c2337e3b0a37ee30509cb43b73b8a6e67e1c
SHA512 10e97c49e7f1bac18cc0a75692e7dc3eb37ebd01301fc4418fee24e8d81161d9c6d7732e2a1aa8a0953d83d11ca09bb9939ed8d38867ea6936467a0241ec7955
SSDEEP 24576:k6QRFHROVnG3t30yKF5H5jzMDkM2y5XuWpZX2sz+bZqt:knFHuGIH5PMDkNy5XuUZXZCbZqt
TLSH
T1C01533DD3207071368F68938AE67676E2DC9C785DF0345593D8039FBAA3D11B38AB816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 765KB
SHA256 c97227a92a957d1e0c4602ab938399bef00945b2eec0f801b2ba31d6bcbd375d
MD5 86edbe25c3aa47e80e65cb8eefcb9d5d
SHA1 fa7a9dd04ccd6231c44064c91cc66d0e3a07f82f
SHA512 a37ee9424b31d4df95dea7c6443426b4d66d0227d548e6f45d2dd1800b71205aa61a6c5eccd4ac02de5a33d996ebbbe8da21bdce4c61a80c3d09e62d43f4ff6b
SSDEEP 12288:cS0OksbiF5WlcxDdeoF8SYxoI84p6n8RRsaRdUgpvePWF3p7GUqW1w3PVHM94dZy:cSnk1Wl+DMbZjp6EjRBOW1w3PVH7Z+d
TLSH
T141F43361A6D9E044FFD8C04BDFA09F9A72499542863C327396DD523DA2A07C0126FF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 1024KB
SHA256 bdad1acc9dfca6407ee3119501c8815166878f4505d9e6b5aeb6e8ec5c470c13
MD5 c62c42b1999a9845bc20d108f1568573
SHA1 5d7cff157787329bfd42da9c642335d26334a52e
SHA512 fadd350320f3cb1f6f838b2bd2874b3c5b0021629ddb4fe65b57b0f41eb54a4533dbc8fb2f3509b6f4c83ff099eb52e9dae7003cdc72a5f2d03bc1c63fcf1c52
SSDEEP 24576:wbRMLQkJmCSg65g5fFkQzcgla01BoiQxsmDeoVPEuI:w1M8khSg65g5fF54g1BorxneoVPdI
TLSH
T1602533484057E3A2F73605F2C69358F67DAE813E3690702E5CA75E458EF39A1286733E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 387KB
SHA256 348dca21fbbf09f8c0c0c676d378350431595971bfdc26d1da5d63f98991fac6
MD5 5fe78b23e6bddc2cc8e733979fbd8cf9
SHA1 480fcd7193f6bd3cc4d238409eb1c0aa643ee347
SHA512 9449ae1557ecc96164ce2ff3dc96b2819f601e0704601c76a490192654cdb9749a80877c5827d4754d9260d4afac379f46af291750b643e8c677cacba6cbc987
SSDEEP 12288:vVr1uO6r+pzBWcQZ3ZKsUlVsctEQIiUjnneaVWaB8:vVPa+pzscaklVssGbne0lG
TLSH
T1AD8423CAF3BA8799CDD6C7B6B93A8244B9274175CE80DEF45E42EC4BF4401720ABD454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 1024KB
SHA256 98e4d2041da24833476697156d6ebdf6711f579a270ee505fbcd803873b7f51d
MD5 1f573123ed3945129e0b27159ecd2582
SHA1 1ac86714da78514a7a6f1108c95c73d69107a078
SHA512 058678b85533237a9cbe9630b51728353dcb6fee2f00b3c8e047ec8e1bbf6f60d68559eb2961c6b1ad6678ef7efe3d2df70ccfc59ad6099e6bcc39ec1b33fb8d
SSDEEP 24576:/UUXlo0YiMa8jvtAk+fqDjbBeU9vs7cX/hP3vkrg:ty0ZijvGrfqD5kWP3vj
TLSH
T19A2533730D0AA4EEDFC15AFB85BC87204D35706C2606DAE4A2724F021B397BDB0795B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 751KB
SHA256 e9d2f22228e925d7d224369aea4d194ef482fbe467be1e274ef1861684f122ea
MD5 f54a1182d5bc6555b4ceb96c23ddb477
SHA1 bb44da3d790eda5ae3cfbc4df78b9c2d424b2bf5
SHA512 83e7497570b6d0ca8ed0589aeae2c8c39ce023551ab668b58ab2d4fe9cbc6fd6f5337aea038489c1718dfeb836082bb67c03d877e3b8c9cbd6b8c0115271505e
SSDEEP 12288:iNxo3WtIK03mKWohN8mDqh2fFjgRTRWYXTd0cqYWW7ZHoJ/2NUbdYMVdElz9JU9V:IoWqDZW6NBqhiFjgR1W2jbZoANUZFVCQ
TLSH
T1A0F42389CB23F5B7548A13219DF17392B371B453CAC01BF0AFE1256AC992D744127BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 27KB
SHA256 c83d6f5d9b61177a3a9497885f7f67121e8c72a48b956256fbc8c93d27984850
MD5 8283c146d72155a134980aceaf24f1f0
SHA1 20d8171534fb90736e9768c7f286d14156261a1d
SHA512 8bab6a762ef12e011bc212a00f484364c85d86117b077ae81e288e98eee96f2f785b0846db552178994dff86fd8e694969bf83eb13d0b00f694033919b36cca7
SSDEEP 768:6VVhT3pfN4JP/QRyOHg6+lehdWu1vFEupbcSM+g:6V3p14JPYRPHlgeLZ2/
TLSH
T158C2F20AEED1555CDD744D2C3E1CD4075926905C92A593182CABEAB0BBCBBBFC4918E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

104363c0-a74b-430e-b4a0-db0659f3eb33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\104363c0-a74b-430e-b4a0-db0659f3eb33.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

71914b7e-f4c6-410e-8677-80f2bd3f92f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\71914b7e-f4c6-410e-8677-80f2bd3f92f1.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

84aa7754-0450-4bb2-a5a7-3d2a7c14743d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\84aa7754-0450-4bb2-a5a7-3d2a7c14743d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 170B
SHA256 f2e03dc31deb0e26a1d91c715a1c8c32f17258b5bba68b971769085b1da92214
MD5 29f2012761d8bf3d7d3aa8f9d42b3c55
SHA1 bf6f06afea5bd32db6fdeed729cff501db5ffba8
SHA512 4e2b6be3464af4441d265e3d14e5447e7f4cd629dcb2abde1051e6a2e30dafc7899968d89f03820e1f162c7691542715400806933ad7e984c8bacee4857f798a
TLSH
T17EC08CFB873155A607A0A9E9903AB52EE22B9E4CECC8C8F4C414F0E121B86229101921
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 86B
SHA256 98b890bfcca43595cf76b755e94da14a41eb83325f6ee1b8c4e87b4350ebff6a
MD5 a821fcb99c66f3cb3d439fcaddeb7fda
SHA1 44584097272c7f8087ba5d04e566db8fd168821d
SHA512 6c958296cd3cd17129099b7c664bf1bc5efd64c5b5096985a85e7e2e7c09fa1fbed4d956e15e060d98721d00d807784d73d504045dc6021eeedfc88793cab36d
TLSH
T1A9A001FB8A64899A0A61A9E86139B22EE18F829CCCD8DDF0C40881D66269A221006910
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 167B
SHA256 ab9990f24d0d487b04b19cc8afd191b6fef5c7f316262ced00b4a37aab85c0c2
MD5 d386eb0897f0dfaf859e35833e649074
SHA1 1659275d7032a317ed2f843ae707a87e69cd73fa
SHA512 162a1bb1271aa7e9d030fe79e4c5d84453a613b046f02d246e0226eae94336a7c077d916bf7919328c9364ce900e5b363de0a9a34fa1602bca3856392e7b3884
TLSH
T1B2C08CF70A3009C68B766ED46039B52DE55F8C2CCCC4CCE0F808B19222B462340045A2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 244B
SHA256 7882de4761bdd8272248ea93d95bf8a485ecabed99dba07d26af3d48cfd97c5a
MD5 1ccc2679e9b895d2c295b0bac266dda7
SHA1 c36026854aff4300bfa84cd864a531daff003389
SHA512 d83373be6df53d0bb9a318659907c2dce610c6d91da101590b4e6cdc1e67756fa8b542c02e0d3b2999a5acd16d33bbc9532f161fbab1b3a00516d64b3c167e44
TLSH
T103D097E64B3048A66238FDC1282C302F901B4C2CDCC4DCD4EC08B1A322B821380011A6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 160B
SHA256 f8d26b0db05c0ead7fde662d407e5837720645138a881b08e7909e31ff47955b
MD5 2ba5fdc166cadddac2eac3097aaf023c
SHA1 5f29597fca9743c346f7c855f6153a7ba018f77d
SHA512 485285aa53666e4996cd7929df176e677fb29f5987553dc56ebf5ca191db2341868c4bccaef5007ebb9f98050c7396c3bd9c60c48978f019631031f412118c90
TLSH
T144C08CE70A2089CA8A79AED82429752DE14F810CC8C8CCE4F80C819222B462300015A2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b6a99d1b-e3a6-4a29-80f8-8818d4f97f0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6a99d1b-e3a6-4a29-80f8-8818d4f97f0f.tmp
Size 13KB
SHA256 daeb60036a53af51c27aafb95b9bcc16e5cd38aeee0836c57590f5a1531eab1c
MD5 e5fd5bd9884bd2a6c2102bb28884043d
SHA1 7bda0b5ae8bc616783d782f39d9876c5e6f30eb4
SHA512 b879379df77eff3b15091dd882f11dde84c405f8fd83c705153150d0afe6205276a41e9ffae0fa9a9e005c3c277d8253455ad7c1f52f26894d14081d5d63d255
SSDEEP 192:sxRtRzC//f3sYS7Zyzm8zoA8pge7/g6+WNAfp2lfeIVrrrIxJo5GLkZFgVFGJIgP:sxRtY//f3sr1Kmt1/5o+feorMmU8P
TLSH
T17F52B85AAD386A7B4CCBD21DBA65BF63E2F9107261D51F44A7FC891C01E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba5b0429-0d65-4d94-adba-1d569bd33a36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba5b0429-0d65-4d94-adba-1d569bd33a36.tmp
Size 11KB
SHA256 4686ce5c1461390cc76d92712ed79ce0ef47bfd6b85d9ef3f2dd71c9c54a73fe
MD5 9fb4a3f4703315880a9bdda90dc19569
SHA1 7f6e003ea836a45df1f76be93d14cc729182b53f
SHA512 4649a00eeb519ea8abcae3bdbc65f05b44a686e80c9072880ea5ed5edb2012c445e8649208b25e11c0e878b12fc907df8b8d49ef907ecc6cd8c774aaa052a661
SSDEEP 192:sxRORzC//f3sxS7ZyzmszoA8pgj/g6+WNWtz/YFyRFGJIgVOJ:sxROY//f3sE1Kmda/5I/WQ
TLSH
T18332A619AE28A93B8CCBD21DBB657F53D2F91072A1D51F48A6FC891C05E76DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd560537-c39a-453f-be0b-6f9a88370dac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd560537-c39a-453f-be0b-6f9a88370dac.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3f283a8-8ef9-4670-b8f3-69517bcc6b77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e3f283a8-8ef9-4670-b8f3-69517bcc6b77.tmp
Size 13KB
SHA256 fc8b8a473685d03ba2aeacfcea4d3fda4166cb5b17074bdc30b4cfe0e60748e0
MD5 75319943c47dcb6209c52dd3f92f2f57
SHA1 aa5f01cb5c48676d50a40b87cdc09038f7442929
SHA512 882698dee1040bf2b8b2eac42c485c6c87df19b11db9035609990397358ede25a770a6e85d91cf4fb83f812f62a1c52aa1b720e449aff32a80763a9dd222c27b
SSDEEP 192:sxRtRzC//f3sYS7ZyzmXzoA8pgeG/g6+WNCrs32lfeI8L1rIxJo5VkQkFgVFGJIy:sxRtY//f3sr1Km+I/5afexrMm8P
TLSH
T19552B75AAD386A7B4CCBD21DBA65BF63D2F9107261D51F44A7FC891C00E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

062aaab9-7a9e-43f8-8f26-bb33d926932e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\062aaab9-7a9e-43f8-8f26-bb33d926932e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af0f9e45-b687-4728-b47e-9522d8bc379c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af0f9e45-b687-4728-b47e-9522d8bc379c.tmp
Size 38KB
SHA256 3c08379cf94def392a78f40f33fbb11856015ad1c5f41349fa2cb9677c5818be
MD5 e63de6a36b0dc8e29008d1d2cb532ac1
SHA1 2d2e4da3bb3b8ffa226cd2acb56776bb5bbaddec
SHA512 462c857732361065040c4c2c0d2bdba3dbb19ee02a58cd8f308880d0e896a579d1c26e6ab913fa885d8f940e4a94374420599de5027f0f1ea650a3008740dd30
SSDEEP 768:7/UxvxjgC+zUs3y9f9cMqjnwyEMbxyJugQVTJ7vvmeXETh:uZj3+zUs3GGwyEmxyJJq17veTh
TLSH
T11103BF35AC659C3388BBD2847759A7C3EFF805B398C61E9884D85E0D16873ED174B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b45af051-adc0-4fec-8c1e-7666469eac75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b45af051-adc0-4fec-8c1e-7666469eac75.tmp
Size 38KB
SHA256 0022afff754a0b881a050bce1d138fc9f4982e1147857211ca55ab8238360e52
MD5 42d9e086b9e9e45746447355f3843896
SHA1 bb6041b1674a39acae452c4b6c8f00657d078177
SHA512 e9ae5096e183c90e155513a892f2d279f2e80ef15ebc1bc88e0315e101d46862db340437f9f55d24b200d2601343ebfb8315c98d3badec96bee4542c474d814c
SSDEEP 768:A/UxvxjgC+k3hXf9cMqjn3yEMbxyJugQVTJ7vvmeOESHtBk:tZj3+k3vG3yEmxyJJq17vVSbk
TLSH
T1C503C034AC659C3388F792847699E3C7EFF405B398C61AE884D95E0E164B3AC270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c2c70a4-1d37-48e3-9984-0d5c810a7f2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c2c70a4-1d37-48e3-9984-0d5c810a7f2f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6060d3c0-ef58-4128-8484-7a3884981efb.tmp

Path C:\Users\Admin\AppData\Local\Temp\6060d3c0-ef58-4128-8484-7a3884981efb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9f199ae0-39cc-46f5-a661-75bdb46687d6.tmp

Path C:\Users\Admin\AppData\Local\Temp\9f199ae0-39cc-46f5-a661-75bdb46687d6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1IPSU.tmp\setup.tmp
Size 1.4MB
SHA256 09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
MD5 ae9890548f2fcab56a4e9ae446f55b3f
SHA1 e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA512 154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
SSDEEP 24576:sH9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextx:0IEJxCWluyZ8UbMK
TLSH
T15B654A12A2A28833E1733F359D2B86946C367D642E74988B3FF45E0C0E79B417D39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASS.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\BASS.dll
Size 103KB
SHA256 df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
MD5 8005750ec63eb5292884ad6183ae2e77
SHA1 c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA512 febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
SSDEEP 3072:75yP416sLgrTWiKc0rUH9rRq/SJIJmECqc2QOeH:czsMH0Yl2QE3zY
TLSH
T193A301CA68D54913E28B2D73B59B61EA63D8A3C4DB63DFD11E0A030A76FA5D406B3304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS.ini

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\CLS.ini
Size 1KB
SHA256 7eec0856d7d87ee4859cfe5306e71402735c5a4cab2b3803a5202378888e14a5
MD5 211ef44788d8a6687b0a2501f49ca02b
SHA1 025cbc46ce7553306809d7e420a687f66d00226e
SHA512 904b644861ff6c9fdd3f01625b6c6b112d40e6e42ea16fb7f83b7b48e3f871a5323281a795f64a12c15fb8e987172727aaa3a98c91ff70e87efb5319c201810b
TLSH
T1F11181045AAE05682100506364E17D1E5C7ECF64C116EE1C33A704FF24C887EA1FB2F2
MD5 SHA1 SHA512 TLSH

Submit Download

CallbackCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\CallbackCtrl.dll
Size 4KB
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
TLSH
T1F281BB43B3F81059F5B75BB07EE39B8729BAFD315E39C61E0A50011A2830A55AD36B33
MD5 SHA1 SHA512 TLSH

Submit Download

FlushFileCache.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\FlushFileCache.exe
Size 29KB
SHA256 a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8
MD5 df77f2b6126f4f258f2e952b53b22879
SHA1 fedda8401ebfe872dd081538deec58965e82f675
SHA512 623c5a2b3382b610bf2a2812db94ea77e52051f307fd1ba7767927719277a7d99e844f9286a52549f888ad818c4d4d09759c031a8ab6dbc58911257987028a37
SSDEEP 768:kd82J2m8FCija+1I9ETzJHI6JeLzT3O1:kd82J25TzJHI6JeLz
TLSH
T18FD25A9282D1C0FDE762C5714F389411E97B3A31153196BE3AED55DE4E98760AB0C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\ISDone.dll
Size 380KB
SHA256 c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
MD5 63dc27b7bc65243efaa59a9797a140ba
SHA1 22f893aefcebecc9376e2122a3321befa22cdd73
SHA512 3df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
SSDEEP 6144:YAua3SAQSoYo+1Cjnqakl6j+vn+nLE4FZZHYg5mcQXQJSnI4EUiy:biAKg1C7qmvLE4FZR5mcHSnI4EG
TLSH
T18884BE27F686C1B2D10221319D56E7F66279FB804F2904C3BBDDEE1C5D3AB916A38253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MusicButton.png

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\MusicButton.png
Size 1KB
SHA256 7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
MD5 473a683962d3375a00f93dd8ce302158
SHA1 1c0709631834fd3715995514eef875b2b968a6be
SHA512 24ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
TLSH
T1AC21657F52385772496C03A18FAD75C10F94B65903A563CDA65EFE2807E48A60179045
MD5 SHA1 SHA512 TLSH

Submit Download

arc.ini

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\arc.ini
Size 4KB
SHA256 b363dc5403eaab9985a7a38b104515180747386ba1dfa875982cbcb63e489d7d
MD5 d3f0a05230447055ac7424c583de2c4b
SHA1 4fa6782a9ce8d9ec589b88b6844cc238e5bdcd0a
SHA512 cd699673faa220d67a74e65ff631b9391ed83554a75d3cacc0707dfb7a0b74603109edceec9273b40ab5bbe0b729f4f3e327e4dd61c8387701464aa9c6862b75
SSDEEP 96:xK90KJuKYaQKue7qK70KwKcL9KuK7mKFKQHuKPuKtK+mKiK3KaKGiKMJKKmKskKl:Lale+1wbtKDt
TLSH
T179A10776386FE60441694300FF958AD9D5CD2907F7290711728FB78F8AF2A01E8A6D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\botva2.dll
Size 37KB
SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
MD5 67965a5957a61867d661f05ae1f4773e
SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
TLSH
T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fnr.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\fnr.exe
Size 4KB
SHA256 699d99dd95425a15a12947bffa8205d8fa3feb86b8b3948995a29c9348b188d1
MD5 e30e3bb220ec04971d724c2fdc063349
SHA1 8d045b493e06010946c37bb7fb203473c337088e
SHA512 564b21849f9f9e1e27f9ad1df32b5594e068128578358873b20dbcb01eece738da2eb8e38c07b49becfd82544bfbc44916ca67606fb4142f778d0f8832bcfa2d
TLSH
T18F81B92D9A569035DF1F98F83E52D59A3378F2D066D0A1164371CFF42F2B8F021A811E
MD5 SHA1 SHA512 TLSH

Submit Download

host.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\host.cmd
Size 4KB
SHA256 4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855
MD5 b1377c69e6897fdb715452b1776fad57
SHA1 9e50e4dc1fd1dd782b6181bd59011340486b8e3d
SHA512 13d3b1cd9b011180e517eb8aaef5dec4c03ef53153e099c5d85b996e27571291d227ad54e70c0618b2c6749197460ea1686496644efe26a8ca3c1ec27f3afdf4
SSDEEP 48:sBxWxexnx2xXxaxAxVx+xPxixtxVxXxUx9xUxBxwxmx3xfxCxAxXxeaxXaxZxLxZ:uG1ez
TLSH
T1BCA1F4DF93A9FE52E49854F0F33A2AAA7DDFB423C9C5BDC494350066674B4B0C3A5608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\hosts.exe
Size 32KB
SHA256 49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119
MD5 a7f30bb876775a914422675a13dd56b3
SHA1 3ea28fe66a04ebbad2507a7dfdebf1622c701d43
SHA512 6decbf54a3b62cfe549f1e45d1e5e99b2c33c792a67e9f29b9be3cb51d7e89ff0238cc4479f4a004d2b70989517531ccbbd6e420675fd3d37949cc20c90a6656
SSDEEP 768:Oa236jCLhhCBOtYcPhswK7kCQn5A11E4O:OaeY6GWT5R
TLSH
T131E2091133E8826AC67E0EB178F2521045F2FA276E32D70E0D99409F5A67BD4F412BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\idp.dll
Size 220KB
SHA256 f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
MD5 af555ac9c073f88fe5bf0d677f085025
SHA1 5fff803cf273057c889538886f6992ea05dd146e
SHA512 c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
SSDEEP 3072:00EeiIJYud1RvIOACb918qbQ0XY3chnBLqRAJUZxChtDUOZlLFv:LEIVd1VIW18qbQ0/hn4EUZxmfN
TLSH
T15624AE0079CBC437DA4F0378842AD719073AF99617744ACBEF985EAD8D352C39E36296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintb.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5PCI0.tmp\wintb.dll
Size 16KB
SHA256 1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
MD5 9436df49e08c83bad8ddc906478c2041
SHA1 a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA512 f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
SSDEEP 384:6j34r4daxbDGQhh5tfEMrg+dOVMVjG+nHL:iorhyepdOVMVRL
TLSH
T16072D68ABF6B24F3E37206F8D1FBB73F3A792910C821AD71DB094515EE33611920521A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-P931E.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5424_1338566098\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Thank You Bus Driver.lnk

Path C:\Users\Public\Desktop\Thank You Bus Driver.lnk
Size 629B
SHA256 88817d14b2328724ce978922137929cb05d1d1d4cb08179217952a40445e3c68
MD5 4986cd01140792bd0dd44b85b38ade71
SHA1 85f93bb355ff7fc572f991b0326e8a9b2383747b
SHA512 95876fa22bb0567d8f067f29ea1df8322d36cf21c37585de20601533b5d4d034463ce7befdef60fdbc28e4b899b9b51ff6e91acfa1475871f0eeec19eb17228f
TLSH
T17DF0652A8FDA1151F7B6DBB101F50BB495A73CE75EA5C13D0024220266B5996D2E1F23
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 bff79fc70cf6f8041ddc9b6d5e0d19abda31b990433b4cf7721784864066cbeb
MD5 a8188e9603be0cca741d046cee7f9067
SHA1 440aed91a276bfc2fb95bb78ba864a84d3457f60
SHA512 4ddb3edc267057913394fb96fb605f8d2881613d622caa4c78b9c6d3b7f405013d86b1e57f91d0aadc13703676f498caf81ff0efd2ddae143ea1417cfb13dddf
TLSH
T133517CAE4394BF6C95B14170D734253E31CFB45989CB768C7FBDD49A77861141AA1308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 76e799aa7a88dcf6bd789162f7a6f668743e7b353b283681f8b69d47e0623107
MD5 080176bff0af04f5bdda4a0d558c6845
SHA1 98c938c1b51649e5f3a3c2cf26113d31424519cd
SHA512 ee68b9d9dfe0f18aa15fff84fde1bfcd8efa4d4797960e18c14b9c8f62fdc8322c9347645e1defe475b62c64727461f3fbb9d5a59e5a7ad8bd49e026078f5299
TLSH
T167514BEE43A4BF9C95B14170E334257D31CFB45989CB768C7B7ED4EAB7861111AA1308
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 5e8cbf4f42c0c4ed16b786dc1b415be951d1a7cb22eeccba84b2dd4574870e7d
MD5 e38dbac0393ed0cb9fab4fafeb4b5d67
SHA1 350d816b12c092000446d518c5df4ffd262d0d2a
SHA512 ddd223494b7da7305fb87365146fb170c99d1d7c034b04a85558af8fee149fb9f9326f17935a8873f3dcac3ab869f532c06bc794eb76c2ac8202ad96555d0048
SSDEEP 96:vDZEurK9DvB1MLMKMhMYMNMcMsMrM7MzMZRzMHMrRJM7MRMVMrMDMDMPMA:RrK9zBeRu
TLSH
T1E281A5EE87A4BFACA5B04170E334157935CF7458CAC7B78C7BBEE4E9A7861111A91308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 f2489604a484903609e1ee141f5f3420245f1b86478305089729e35229f1d251
MD5 6b7df600512b93fb48950976351c5db8
SHA1 b7d5e3ef4377b8fedef32866d1f33505cafa10e2
SHA512 b8bc97b5d41f6f801f7923d3e4659b42f74e8709d9622320986783560be64a2ff2d6a1b808dd8baf54c1aa7f8c732a54b2d096e934cf9358a127db8862c91c97
SSDEEP 96:vDZEurK9DvB1MsMrM7MzMZRzMrRJM7MRMVMrMDMDMPM7MHMzMHM3MHMOMbM+MLMw:RrK9zByRS
TLSH
T1EDB163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 48794a6adb23ad473f5aa0cef3e8eabe07bc30df32557ca87c8e1d9bd7fbeed6
MD5 8be2228a1c73ceb9b14ed54e3605aa34
SHA1 656caa9bcab79d157a3cc0bb66465e4ce8a75edb
SHA512 34f6702fede64ed5fbad6beff324cd873115f7bfb1ebc3f85b740525ff82bdf93171c27789d9d08c6ca6acaa434504fe4f93643e8a62e80c4d22c807577e5045
SSDEEP 96:vDZEurK9DvB1MrRJM7MRMVMrMDMDMPM7MHMzMHM3MHMOMbM+MLMKMhMYMNMHMsMl:RrK9zBsRM
TLSH
T178B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 5KB
SHA256 db5f1d2bc5d96f36a4e9fce916c06102d26cf17594cb24004ae93dcb32c95e7c
MD5 44bbe6ee1e65e584941c696203312377
SHA1 2e20e67ebc0a14bacc75d4e74efbb0bdb8fbb1f6
SHA512 7161a83dd34ade8d402b84016c4d52f5104245e8bec89a22490b2cb1736949019184ad04f37be8832fa1367678ba5968af65650e4f4ad811c0c19f2744846e13
SSDEEP 96:vDZEurK9DvBVJM7MRMVMrMDMDMPM7MHMzMHM3MHMOMbM+MLMKMhMYMNMcMsMrM7y:RrK9zBVie
TLSH
T1E5B163EE87A4BFACA5B04170E335157934CF7454C9CBB78C7B7EE4E9A7861111AA1308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 09a37ae03d23e382c5c07d8bf8bad4eb426ca9abc37a2e74d1547c425a7a5171
MD5 58c038bdfa1029309ac8934d58dabc67
SHA1 a5c07b734be2e1f22a88d88c303146eb419f96a7
SHA512 efc8a28931256ccdd8adc1f6b7105059d015aab030ad2de43a319d46c6fe3a7118f0747767769c73259bc03d695389ac7f1340cbdb1852d00d063d25953ed370
TLSH
T1AF21EE2A0749A55D22B341E50918B42FA35FD0EF0E7B9D8D3F8E444F7BA2A0C5332746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 3be6bd7ba208511027f993fa34267df2381e66ac0cc0588081a52336ba975406
MD5 b05b62045ed529ecb9b6ebda9c7a03ca
SHA1 863d797d748b9e21ca61f29104353f5030070adf
SHA512 e087677905998ee05faa64bcc4b1f1f35db6e18303353c3b4d9f85b8d5dfb3824f70bac91f1448a87790d6c0036bc091f32c2a392de20216612bfcb9ed2f60e0
TLSH
T18921DF2A0745A55C22B242B50518B42E735FE0EF0A6BA98C3F9D444F7BA260C1372705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 f5a2d2df78c0920e4a3917939f169f39aa31be1df429404336341d3fa0efe6dc
MD5 90098a89e470bd12f2ab7e3e46190346
SHA1 5ea45e12a80ab1cbb560be1823dc68260cacd84d
SHA512 7e75c1775c840b0f7c4cc29ec69c5b72be84d008979cedcab243f32fde18286479ef7ca2efe607edbc73a7d328166d99b1948738261cb5c0139a20e135ff1970
TLSH
T1E321052A0744A55C22B342B45518B42F734FE0EF0E67A9CC3F9D444F7B9160C1772705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 4146fa56d2c9ea996043738e00bec69e0d183835a8b06d6afb3afed15dd1fe70
MD5 1bbd2f00a8506a80154d41bacb24131d
SHA1 3ebffecf94e0aa9d5d9b83acf99e450554ccdbe0
SHA512 c6743baf3c1de84141f3126b38b863e668e54b108fbe228ff0b0e430bc097ab70089e31f981f93a6e972bf874da02b096e0451c4ea3082fc228002d17f82744f
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 7a06a579c327934bec75b39bca99d09969f210e323946817ac257ad80c24959d
MD5 29476e3e293379d1bf00cb5cca2867cb
SHA1 0df705b8f203736cba3d2fbb7938e87867f9eeb0
SHA512 5986b1b5086158917308d88aae7695f84d363fa93711b959d69be5d91447b7cd3faa1f09bfa6ed217d9b52c235f7a4d3eb9d95d231d68dc682a6d4962c3edf77
TLSH
T11331F66A0754A55C61B242B45518743E734FE0DF09A7A9CC3FAD844F7B9150C1772705
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 5ed94bc1c5b7cd111711306682ee9ddfaaa71967e2626d936d87755be7cbb96b
MD5 4dfdcceb3a21e723d5eff18a6d1504f2
SHA1 6860f1e5d159ce202dd104db7d288b23f3580222
SHA512 934b303382ae250deb838de9c13852555e6862ca9ef4d9c18ac7d2d53e520111d928fa5c7e7026864490028f2d8b38bad00a809557fd19bf6147261ed6f59731
TLSH
T19331026A0754AA5C61B242B44628743E738FE0DF09ABBA8C3FAD804E7B925081762305
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 2468e5f2ffde0f1c564257a2cdcfe9f3a02dc61566879c16c1cde32826f3ea16
MD5 9fb2798481ae865b8b50c179bdbca26e
SHA1 f8f17fc83ab37645eeeb698c3cf81b46a245b656
SHA512 175e60002fa666c9e0404fe8413ca9b8699c32ff15c573c5954ef466ebfc128b74c2ac401ecc62303d61dc84b826bb725dfbc5676513f4f7e6ed9dcc577c75bd
TLSH
T17531156E0754BA5C61B242744628743E728FE0DF09DBBACC3F6D904E77915081762309
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 52abe4e9a74d2129d860536fac246f8b3746b0d3636348bcb1bf4b8ced0858b5
MD5 d4311f9afc2b6a3abdac082a777b863e
SHA1 ad58b01cabc00391fadd177fbd2619b44ea510c5
SHA512 3c482ec2e2760f16409dca398b1a1a6d9959716805bb0df5969858697ac581231d57701997ac70f28b9344ea93eb0c45fa94be52a68d09cf78402c471bb0f9a1
TLSH
T1BE31156E0754BA5C61B142749628743E728FE0DF49DBBACC3F6D945E77921081762308
MD5 SHA1 SHA512 TLSH

Submit Download

QuickSFV.EXE

Path F:\Games\Thank You Bus Driver\_Redist\QuickSFV.EXE
Size 101KB
SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
MD5 4b1d5ec11b2b5db046233a28dba73b83
SHA1 3a4e464d3602957f3527727ea62876902b451511
SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
TLSH
T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickSFV.ini

Path F:\Games\Thank You Bus Driver\_Redist\QuickSFV.ini
Size 155B
SHA256 74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
MD5 c5c28798bca6e9ed5d84fa67b656065a
SHA1 4b6fa3465f1b393e22e9f083b177462028a48e93
SHA512 c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
TLSH
T12DC02B3D075C40150D310E54D0CD71406D4C550F6438CC01AC0437009F10D232A18FA0
MD5 SHA1 SHA512 TLSH

Submit Download

dxwebsetup.exe

Path F:\Games\Thank You Bus Driver\_Redist\dxwebsetup.exe
Size 292KB
SHA256 ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494
MD5 56d52c503adf02184f19eee4767ef60a
SHA1 ca133f67a286f4f20282e19837b53b38a27a1caa
SHA512 246f35664a9af548d402878a3e6ce6d8901a0978477b145db5fd4e5857021efc4016369e9e02e709a27cf5c84f44a32e106008668ba96e2b45d4d06599090d8f
SSDEEP 6144:lWK8x2ZFD7h/uMdnv0iyLI6utiI1ARjhaXcoUvedlVFdo:22ZFD77dnBhi3Us8/VFdo
TLSH
T14F54F15263E9813BE0F52B7929F747432B70BDA49C7DE32E534654880CB2788B87572B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fitgirl.md5

Path F:\Games\Thank You Bus Driver\_Redist\fitgirl.md5
Size 5KB
SHA256 2ea0ae26b67e22563ea42441daf10b88ec03877395b45d3e4cd630878173c58a
MD5 051b690d52fb60a1985ca551744a9278
SHA1 5fd03a8b0a5a431662b5dba6242b86ca11553ad3
SHA512 c1ce9be2e23b6c5963626c9fd6f60adf472f4a2511f501a4933c97b2eabed0b4198b941df92845fba9e606dbb6cbca44d49bdea12d63ecb1f7cc33251601434c
SSDEEP 48:Der1Jq1t7IwTpn4qmNEP1WYcoMa0UlnEVdi6LlkJVNRdV4kCvT+iErMK5XhLOC8/:iri1q37GNWAleVd/6PBI+t9hLOC0
TLSH
T195B1CB7C410B02BBC63E6BB5C211CB0671C995123B21CFD203285AD7FA87F66F9B556A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path F:\Games\Thank You Bus Driver\_Redist\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x86.exe

Path F:\Games\Thank You Bus Driver\_Redist\vc_redist.x86.exe
Size 13.3MB
SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
MD5 99f52708b06b9c695a8d64a44740bf08
SHA1 c2743ffc36d2af40ade0e370be52d6b202874114
SHA512 d0a609f6b2f05939ab82aa5fde1bb0595206653a2ab2ce859a750f71596c4491a8074bb825484e365a4fbcdb820d5de0346e7209ea22214b090b4fe853098dce
SSDEEP 196608:fLZBJflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4L6f6psSD5YM4565kIgoOgP2edk:lHlptVYmfr7yBG/4L6f6pXc65kngP1
TLSH
T1A8E63332E494413BFFB604336A65E9203E7DA628274149F6E3C8FD4D3A7219267F7612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.dat

Path F:\Games\Thank You Bus Driver\unins000.dat
Size 91KB
SHA256 ba68edebbf361bc8f9751f1764508f85966628fc24898734cbfc89d74039cecc
MD5 ff6dcdeb6662a8df16957c6fb22009dc
SHA1 91230a1e3a77940f6e9bcbc865f0cbbd19faf223
SHA512 97df5d0b67be1a23882faea25ca99ba7993f0a4eee2039555c30716b56926a06437b3c5e9e0cd4ffd44b36d0380d82cb825dbf7fbba28d35c1ff1da969a7e415
SSDEEP 768:sR/yfEjHi/3wtuN31h7xzNy1vOW4avv4QyfDfFRLt:xcjHiR31Vyf4NRLt
TLSH
T1C1939B0DAEFC5822D77ED735D9F7021837317DC1A662D72A279A4DBA4813B8888D7312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path F:\Games\Thank You Bus Driver\unins000.exe
Size 1.4MB
SHA256 c800ee2722092c7d2c4685fb979aa7f8b7172c1492cd863a4c00efab875e6a68
MD5 095e5f39d683f15876cad6b6ff858bab
SHA1 c2871d3fe8ff93aa6a0044f113b672efdf1182d3
SHA512 e2f0d3de8dee118b06d49440bc95e64cb1ed9b125f13f006c815cd14d73519edd66b102eee0108c5b9ccc270fe4c56cfc120ba66188dcfbd40be85c49e443091
SSDEEP 24576:0H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKRextxB:cIEJxCWluyZ8UbMKV
TLSH
T1AB653A12A2E24837E1733F359D2B82946C367D642E74988B3FB45E0C0E79B41BD39796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3984-179-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-125-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-947-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-978-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-8-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-680-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/3984-587-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-9-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-261-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/3984-216-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-209-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-203-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/3984-205-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/3984-202-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-204-0x0000000003E20000-0x0000000003E85000-memory.dmp

Download

memory/3984-23-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/3984-30-0x0000000003E20000-0x0000000003E85000-memory.dmp

Download

memory/3984-178-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-33-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-71-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-126-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/3984-679-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-110-0x0000000007120000-0x000000000712F000-memory.dmp

Download

memory/3984-106-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/3984-105-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-97-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-91-0x0000000003D00000-0x0000000003D15000-memory.dmp

Download

memory/3984-92-0x0000000003E20000-0x0000000003E85000-memory.dmp

Download

memory/3984-94-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/3984-95-0x0000000007120000-0x000000000712F000-memory.dmp

Download

memory/3984-93-0x000000006B080000-0x000000006B08D000-memory.dmp

Download

memory/3984-72-0x0000000011000000-0x000000001104C000-memory.dmp

Download

memory/3984-89-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/3984-81-0x0000000007120000-0x000000000712F000-memory.dmp

Download

memory/4144-199-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/4280-88-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4280-2-0x000000000041E000-0x000000000041F000-memory.dmp

Download

memory/4280-979-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4280-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4960-200-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/5036-266-0x00000000005F0000-0x00000000005FE000-memory.dmp

Download

memory/6084-180-0x0000000000400000-0x0000000000410000-memory.dmp

Download