40c6b8bec9237a1e0fadcb40c367b8efacde417e2a00cc624563b026d3fc1977

Resubmissions

17/07/2026, 03:54

260717-egln4ses8w4

17/07/2026, 03:49

260717-edv4daes4v4

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fastflag_injector_gui_enhanced.exe
Size 277KB
Sample260717-edv4daes4v
SHA256 40c6b8bec9237a1e0fadcb40c367b8efacde417e2a00cc624563b026d3fc1977
MD5 ed3913e420b237fa72fa51fc52829272
SHA1 a06b7037f5299dd6c507f3daceb10120e1929106
SHA512 aca8dac0cc673b8314c5148f0c84e8b1b6ea27824a7147ba2b1291d523254625d1a2a15df28f04f4e2923e4506574d541257aa0948c45c59acce9799e24ea0ee
SSDEEP 3072:AZ/BEIveCNoHG6QIAn8CI95g1u9dgxvY71uSJevefbuFMPi+0+fKhpNQ6aJ2ooOu:qBE+23pJKvY71uW0VhpNMFay
TLSH
T18954B71FEAA614E1D4B6C038D153B12FFCB170A64331A7D797815A4B1B62BE4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-sk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_298313293\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_298313293\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-pa.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2008	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Control Panel\Colors	fastflag_injector_gui_enhanced.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287338240240568"	msedge.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\NotificationData	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{501839E2-B060-4C24-85F5-DE0F70BCAC18}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	fastflag_injector_gui_enhanced.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5936	msedge.exe
5936	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4632	fastflag_injector_gui_enhanced.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5848	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4632	fastflag_injector_gui_enhanced.exe
4632	fastflag_injector_gui_enhanced.exe
4632	fastflag_injector_gui_enhanced.exe
4632	fastflag_injector_gui_enhanced.exe
4632	fastflag_injector_gui_enhanced.exe
4632	fastflag_injector_gui_enhanced.exe
4632	fastflag_injector_gui_enhanced.exe
4632	fastflag_injector_gui_enhanced.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 5848	4632	fastflag_injector_gui_enhanced.exe	90
PID 5848 wrote to memory of 2140	5848	msedge.exe	91
PID 5848 wrote to memory of 2500	5848	msedge.exe	92
PID 5848 wrote to memory of 2008	5848	msedge.exe	94
PID 5848 wrote to memory of 2500	5848	msedge.exe	92
PID 5848 wrote to memory of 2500	5848	msedge.exe	92
PID 5848 wrote to memory of 6788	5848	msedge.exe	95
PID 5848 wrote to memory of 6788	5848	msedge.exe	95
PID 5848 wrote to memory of 4676	5848	msedge.exe	96
PID 5848 wrote to memory of 4676	5848	msedge.exe	96
PID 5848 wrote to memory of 4676	5848	msedge.exe	96
PID 5848 wrote to memory of 2520	5848	msedge.exe	97
PID 5848 wrote to memory of 2520	5848	msedge.exe	97
PID 5848 wrote to memory of 2520	5848	msedge.exe	97
PID 5848 wrote to memory of 6836	5848	msedge.exe	98
PID 5848 wrote to memory of 6836	5848	msedge.exe	98
PID 5848 wrote to memory of 6836	5848	msedge.exe	98
PID 5848 wrote to memory of 6884	5848	msedge.exe	99
PID 5848 wrote to memory of 6884	5848	msedge.exe	99
PID 5848 wrote to memory of 6884	5848	msedge.exe	99
PID 5848 wrote to memory of 1740	5848	msedge.exe	100
PID 5848 wrote to memory of 1740	5848	msedge.exe	100
PID 5848 wrote to memory of 1640	5848	msedge.exe	101
PID 5848 wrote to memory of 1640	5848	msedge.exe	101
PID 5848 wrote to memory of 6228	5848	msedge.exe	102
PID 5848 wrote to memory of 6228	5848	msedge.exe	102
PID 5848 wrote to memory of 6180	5848	msedge.exe	104
PID 5848 wrote to memory of 2220	5848	msedge.exe	109
PID 5848 wrote to memory of 5788	5848	msedge.exe	110
PID 5848 wrote to memory of 5836	5848	msedge.exe	111
PID 5848 wrote to memory of 6844	5848	msedge.exe	112
PID 5848 wrote to memory of 6844	5848	msedge.exe	112
PID 5848 wrote to memory of 2840	5848	msedge.exe	115
PID 5848 wrote to memory of 2840	5848	msedge.exe	115
PID 5848 wrote to memory of 6932	5848	msedge.exe	117
PID 5848 wrote to memory of 6932	5848	msedge.exe	117
PID 5848 wrote to memory of 5936	5848	msedge.exe	118
PID 5848 wrote to memory of 1168	5848	msedge.exe	119
PID 5848 wrote to memory of 1168	5848	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe
"C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/davedown
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc6301c188,0x7ffc6301c194,0x7ffc6301c1a0
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,14607491923250955697,4418310942544986289,262144 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,90765347616792776,16014379272710867499,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,5918267036615641668,15106037619194477574,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
    3⤵
    PID:6788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,3624770292056312385,9176336368992442944,2097152 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,2531887024512201322,3444824880625677649,2097152 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5128,i,18065102079487323393,15852629833283968932,2097152 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5400,i,9478128312831268040,3503458248118712347,2097152 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,4891970355827924190,8563392106613863717,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:12
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,8563747020235766041,10185955332436422091,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,6784311634712689586,10596493130179417484,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
    3⤵
    PID:6228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,5001659362980554905,636546227515058560,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,5001659362980554905,636546227515058560,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,9088895014652177248,15150408187153686510,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,16770908253543794979,4696518465743477950,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,16601695468622042606,18386468050782796966,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,2994130063448851541,9558033834337968658,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3566831902672934104,5386105190963999355,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=936,i,12205510987362175067,3759989657292225162,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6996,i,4892846846829841389,12926218969042766907,262144 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,9286417011141086300,6773457360224696890,524288 --field-trial-handle=2264,i,16961582683034609033,5255136327083734659,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
    3⤵
    PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9a60a2fe3039afbe9daf27e11c691d1422b2c26418878bebaaf2019de71eb9aa
MD5 962864c91cbfc5f30fe0b37922acc666
SHA1 f178a4cd548d339f303bdfd89ae89d14a749bbe0
SHA512 e5960b772257b6e1cf5ca48c8418863b61386fef6b0327b67f5be02a492720113b81d5193bcec3b62592b45de507af94c06174ad0b2caa4db2c05f048e6b10e7
TLSH
T14EF0A9B6D921AC3719FC1B1870A54B4BE750136B3B41994F3B3C921D4FB463B864696C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 727KB
SHA256 ba37bfbd8f74dac179ab27c6003b20ca643b234dbcc4d758f7f3c60ffc71c62e
MD5 5bf0d07c4665a123033f1f0335241e2f
SHA1 7201629cd2b57d51f22e8bb5e75e4a875d0a0140
SHA512 6e9b9484846c36e520e9394e5260c2d8bf83753518f08216f19c3ec801256a70c99725cceb38958aa40d165e0bdddc824460e83cf1e6b914424578d3d1024ec7
SSDEEP 12288:DivWS/+NacSfSWej1z/fejWG+FIKmNSWjMjppXPOv8BpspnKwzgrOSC+OwZyS:DivWS/U1SqxF+jZHsOMjpdWcpsUwy5qS
TLSH
T14FF4232CCB3444A2D2459F340ECB5BD13A36FBC2A6455F4F1A466A6A58BE18B1F0F1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6c266eb0b0cfeaca85ff254a8f8d298f3d7db4d33d79e5f7b9b33b77a7466f1c
MD5 8a60d57b01783c75c3e958e1777f6e37
SHA1 1176822c9a2d9d11469eb6fdd80db5808d353205
SHA512 44a3e7aef2826b560181077e5e7c00eae22306042a12b12688cf760303d105844f165fad64a43de50b6f3291c29b7974334fb63fa6f2ec80ae844f4806509776
TLSH
T1B151D8984B6216E3EBB5C5B160E056953BF0C9ED91071F0592305FB8CAA6F7119F0363
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598ed8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598ed8.TMP
Size 2KB
SHA256 9bee0202bd0eff9f35ad37221cacc00af9359053fb138de48aeaca7f16485c07
MD5 8d3920141c970094cfd35ffbf5622d06
SHA1 ac107cd1f031f94d21ad2ba964d56463dcc010d0
SHA512 1e4b33bc6d37ce4cbcb698b1da2e3db285c5313dab144726ba7e91a4c4efc52108a15a1a0ce451c82004e4085a40e4c2195ea2f8c17de4a258058b1601f29d75
TLSH
T18641915853220AE3E7A5D5B260E046C63BF0D4DD120B2F5082705FF18A66F7108F0377
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 a2f625112e2018cbf15cff522aa38fb62d8d8203e8e4ab119087d398c5585624
MD5 fbd816662cffaea4d252d05a22e501a8
SHA1 bee84c6f30a027a27c5802e9bef19935d8f97cda
SHA512 8798112b733a096d989da6b452e1fe11827f3839e47e9c577dc1102d2bc82e9da84657a1107cb6764360d855665dcde1a60cb37d4b5111631269e5fdb5af1ee7
TLSH
T115B011A880828E2AE33002B2EAC2C0AC3238CC200382082AF2880228C0282A00220288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 6ff6faf9556af3990b0ad6bbfdf3c4d6e6bf272f604e46a30f93165dd2607403
MD5 a5ff76f0f0863814cfce5629a38be2b3
SHA1 c30b48533072caa9f6adfe8779c002be3973961a
SHA512 34f29279de0fc16c1eb55db83a665799b53c5a46a3d83baf2e01ac61462c15acb312d907775d08da120cd3b9d785152a2464a55f807c17b89a2eff17a8c50c84
SSDEEP 96:D1jOaeskoGaVcaij6ezBLlcLSiLwCwrAwCw:D16aeskoGaVcaij6e1LlcLSiLwCwrAzw
TLSH
T1B8B1BFF3C3E9866ED91152F4EA147E2BCE1D0515432C3C0AC9E4AF1BABF2871E141A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f3645e919b671941f27e873888b4eeb7aee6a8e249027a05fb2a7d1782d6bd29
MD5 5a0134b30d9b019b1979ad0886d4b357
SHA1 edd9cd191476b42894b01b3b80a5e54a357dc56d
SHA512 0132360e5f790b52dd89e5092f4cc63be251cb5d3b5482f36293452f924783884fedb92dbcb524a52e4a2f74f880f5e2c7096bf5890f1ea10da852d196c55ce4
SSDEEP 384:sxRoeD/fWsTeN/RIMD3/5X/2PgsGQ4Yje:sseD/flsWi/5P2PgsGQ4j
TLSH
T10D52C716A9289D3B5CC7E219FA56BF53D6F91133A1906E49E7FC8B0C04EB6DD210381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 adc6e0bb4c9c3906ded32a80ee39e8b9da6bd7a29c95d9b1944908dccd3175c5
MD5 905d404deea0a608beeb9c66c6e7a69a
SHA1 d30bf47968a03aa07fd586169033d1a3a1c85869
SHA512 714547d5dec2e1b48b59e68e621030a6350cf304c447ae556faa494f0809514a72fe0897037f32cdaa04472bc58f59bf72a35f4c10b5b0485e21a7557b363de8
SSDEEP 384:sxRoeD/fWsoKN/RIMD3/5X/2PPsGQ4IWm:sseD/fy4Wi/5P2PPsGQ4a
TLSH
T1B052C816A9389D3B9CC7E219FA95BF93D6F9103361906E45A7FC8B0C14EB6DD210381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a4126301b1493fbdac4d6de25e79cffca57a76a78aff3feae583c8af245196bf
MD5 96ffeeb35e4d905fee85b49b5d8cf8fa
SHA1 07d4f535769c55412b0bb02ddc84184b891d03cf
SHA512 86848ede175e12f0c8cb5f36d9bdcd29786aafd043bcc944903945fba9f97e5a082f57ae9dc443ad9bbce4c3ec06846158dd2169accad6832ed5ad26f4db137f
SSDEEP 384:sxRoeD/fWsoeN/RIMD3/5X/2PrsGQ4IEe:sseD/fysWi/5P2PrsGQ4Q
TLSH
T1A852C716A9289D3B5CCBD219FA95BF93D6F91033A1906E45A7FC8B0C04EB6DD210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 844476fa941a8c9791891aeb264df70ca0e210909b4349d6b9f27b823474fae9
MD5 82b735e458c9abf47b8b42f5e391ba0d
SHA1 9fe3a713fe835a1e2be62694c309c642ef2b544d
SHA512 5224be1683a74756bea0bd283eddd88217b064fcfafa61d98d10cf1115a1f9051729f4ba787e538172da4adc65dcdd0dea51825ea702ffd92ae1b2c1734fb6cd
SSDEEP 768:O+WYbx7pLuL7+TWg1NfpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVioDbDezroxa4V:O+WYbnE7+TWg1NfpBu1jaJoDHeAzV
TLSH
T143D2DA7B740DCB7E4F800ADDAC197ADF6DA802CB9698CD4087FA951C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8e0a4432eafc15403e644b6c6277a172673b59d2ac960b9b34c87a07a5941542
MD5 0eeef05ac1a768f2627563e5f161c109
SHA1 6a0f912bc61c48332de0a49d0775467ac81422b5
SHA512 32ccda068052ec092ba3c24a4d9c92f9ea0b0941000f6c8671087209f45b5839e6d778d70a851d633f31b24137711b039289ec0e0745dc7fedab8f9779288460
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9LDZ:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRE
TLSH
T197B25C11713F5680383EB90C9178D82E86C2B4637519E56F7BAC01A65F67E038DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f7a8e3656d0736724546043e94b24d4a5ac7c580d57e6552fb094cf5e6ebcb74
MD5 61f9ea5bfcf40b5112a8f4986b0efc40
SHA1 0c9ccabbf6d5a36f09dc7c2c7418c1ca39fb6c20
SHA512 41cf2bbc03d554fda91abea430adfcd534b0d63c4b93a2288415970e891b1768b9a400abc2e146360f14634af823cb0996563a0265b61000ad769133e09df6a2
SSDEEP 384:n6iF1tNn/s3n9S48NLn8TUNTUlIRWPvuTaYnuEqf+GGrpjBslRcijjFq4k8LEEIm:xF1j+99QnwgYupqGrlGjY4V
TLSH
T140B22A32D865DE77ACEB4EC4B74A7A87DEE05163848C9AD4D6D85D4D00CB2ED070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 93ab6584cb75279a76a028c64d22e8a4491f251be7b83f9842a841fdeb1cffb3
MD5 42b8e589eeabdb86a944e769187d23c5
SHA1 ebb1730910303d3db33354c8edf1ee7bb4f7fc74
SHA512 74f72f28619dacc0b9a548646bf2e206eb5253627daaa37b67ac7de948d3163a9c9d56ba5db540e33e548428c442e7da280c9791f92ccddf7a3145100b5d372e
SSDEEP 384:nviFFtNn/s3n9So8NLn8TUNTUlIRqPvuTaYnuEqf+GGrpjBslRcXXjOObjI9G6w9:6FFj+9RQnwgcupqGrlHj29Mh
TLSH
T145D23B32E865DEB7ECE78A94B75A3A97DEE01263848C99D8E6D45D0C00C75ED070B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3536d087d14bd4f8139344768bb973c82a9917413714ca45ea97af4299a04f50
MD5 783ee3221f9a12b683627e4349b01240
SHA1 31c3b58330f455da1f2e2862d21d82326a9a3c32
SHA512 03ded0aa541be3baca82bdb1a1566c4a8aeeeca3438431e39eb8c8b298b7ddb460afc0b880d3d601f58322b255b3f0277656a31713395a173d735a251b22d161
SSDEEP 384:nwiF1tNn/s3n9Sn8NgX8TUNTUlIRiPvuTuuREqf+GGrpjBslRYL2OObjI9G6w7hq:LF1j+9SXXwgUuXZGrT229M4
TLSH
T10CC25B36EC55CEB7EDE74FD4B34A7A46EEE01267849C5AC4EAC85D0D00871ED0707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6c1e06864981d5fffcd45f006333dbe0a219203f8fb3991b5790b70d0ba4c716
MD5 4965e27574d51c262d35e26a087a0058
SHA1 7fe311a63c24b21de41b3c1df1a8f68f2e58163c
SHA512 7a0910112c419a8d896bc792e880c37c181840b71b52eb577c38cba021ccafec4a23ca126b769509e5a8b44aacb3847cc6176c8d30c45df15beb315a1f45af06
SSDEEP 384:naiFFtNn/s3n9S48NLn8TUNTUlIRqPvuTaYnuEqf+GGrpjBslRcijjOObjI9G6w9:RFFj+99QnwgcupqGrlGj29Mh
TLSH
T173D23B32EC65CEB7ECE78B94B75A3A97DEE05263848C99D8E6D45D0C00C75ED070B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7a056677aa01e1222fae1eec790b5b030f84bf0af6197d257cee2336ef6c2bb9
MD5 d443cb9ddd9533305d290d3f1e67ca2e
SHA1 07af0c03eb54eefc7cf577346113a62e1bbc4d66
SHA512 6a4d35dad3ad4e73e6d2a452996b86388018be4cccda3f1e6311e2010bc4d90619b3cec008c820c671c61aeaa9c36728ec7ca040b6d39109147717cefe283246
SSDEEP 384:n6iFFtNn/s3n9S48NLn8TUNTUlIRWPvuTaYnuEqf+GGrpjBslRcijjFq4k8LEEIm:xFFj+99QnwgcupqGrlGjY4V
TLSH
T10FB22A32D865CE77ACEB4A84B75A7A87DEE05163848C9AD4D6D85D4D00CB2ED070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e09cec8aff471317f85a32eebd52762101655a5e735cb5ddd6933fe77873dfec
MD5 7a3d1a9a3df8573eac3f9aef35674db0
SHA1 1b63f757fedcb1530bb124f4702cd8d9a747f22b
SHA512 ecfe3804f2dc4c2a554d1660e2bcf20b5422ab907162241cf346df074fd814d2a13a38b3deb3ad0feb819df1db6fac6d7a5c75d928c7ff3b08f129c9a24c08e3
TLSH
T1CC4142E08C382AD1D4BE0E6E749B34FC94ECD726F4A0343D6858DA984A7964D654047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3402752a1b4d46ea9f26a831052f4982cefc98deb6e002413ecfb7ca0f36126d
MD5 05700aeaf179c8cd0e25a591ad6a8eec
SHA1 cf0acbf4e39e5a46246a11e2c6d645df8669bfbf
SHA512 333260ce34335fe463195f8f196077d7fe914cac61d57199c9e2c37e96384fadad983dc4b711d204b4b7c526dfdb5fe38b17cdcc86110992b9bcf6fe9f83f96a
TLSH
T1D34140E08C3816D1D4BE0E7E708B34FC84ECD726F890343D6858EA985A7970D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d2d7822c1054f8c1a2eb16531760e5c21d74c6144b9d0ab04aca0147cc61a897
MD5 ee11f6c1a2e38e96f03c81d9a5bbbeb8
SHA1 fc5a4b16db147ff90f2f4624fe1085a7b4ea61b4
SHA512 04c765bf30a5721884bd5ef7e1deaf727bd788d093c0550852c4b4fc4481f0d3b76df4991b54222de965270705d8061975cd7f8e8badb389f7f8df4a8eeeddd3
TLSH
T1824141E04C3816D1D4BD0A7EB08B34FC84ECD726F490343D6858DA985A7975D618087F
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 b01fce90851e3c0d75df8904b24b258a74a63a0b6263c7e24b4d3fdcd152319c
MD5 cf7b095e3d0aab33c48ec116eba6e306
SHA1 7006ef990f5f5f87a9e8948948df68dacd083790
SHA512 5b46a563b3c24aad5a0b467fa67bb2abba12c03b2cf25579bbe514adcfe8941911519d17c12c248f911cf42b08cdecb55bae61b34ef5de7ac3dd59987775bde0
SSDEEP 96:FJdKr1ky1cK9WuvG4rPTkqQxVG1AkvInAIP83rJVZVb8r3aU:FJsr1WK9WuO2PMcAvAIM/ZVb8rqU
TLSH
T18ED26516F414EA12DE062C36EFEAD9EC23313E61CD9A035779C6B7BF49B70C08868549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

injection_log.txt

Path C:\Users\Admin\Documents\injection_log.txt
Size 227B
SHA256 f80cb1d35a887c19c3d84ae37023d4e2f593ad5a585be775616ddf67e3c86df7
MD5 d2d2c5d195037b716544a8c559b68d3c
SHA1 dd7b300cf4deaf2ff8cc15209ebfa1352e0dc7aa
SHA512 f4fb846a604bc67d65688e0988aed569b6061bc23464f4dee797b67e3c65c1f8b676f66ecb9e932aac9046e95fc709fad7122a708cbbe1356639b59ba4f3c575
TLSH
T16AD0A76917C669838ADA4152D1949DD36C84402FC641C5DE318C5329B40A546D490572
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1561339122\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_2078839975\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download