a7439ad10f8374bd27dded63d74f44d35d884093d6f78b44707fad66ebdc8a43

Analysis

max time kernel
147s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 220KB
Sample260723-g57mlascrd
SHA256 a7439ad10f8374bd27dded63d74f44d35d884093d6f78b44707fad66ebdc8a43
MD5 47046d79884fe1e14545b55408e6c0ae
SHA1 90c6e22b07012c6d9a73b99d215439f61dcf7127
SHA512 5163303d424ba6a3f4719e01a28de82ee809f2c56386011c4397374d2531102c28a5dbcd27e869d8bfc4b84307af642ac57d570931e9f55ec82609dca4fae1db
SSDEEP 6144:3bE/HUG2OWmmldovHY6av4TVeO7+FU1FKLJBOFg45n734:3blO+d4YxgTVeO7+F+KnIg4b
TLSH
T11E2402017660DCC3D8E387727A3E973A99BDC27E52746E871304AB2D2E522116B5FB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5428	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
90	3704	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Fast!\nwjs\nw.dll	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\vulkan-1.dll	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\bn.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\da.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\et.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\fil.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\sv.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\images\license-btn-bg.png	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\vk_swiftshader_icd.json	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\es.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\nb.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\uk.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\css\notification.css	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\images\notification-bg.png	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\sr.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\sw.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\images\network-error-popup-bg.png	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\images\prediction-engine-bg.png	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\images\survey-bg-second-bg.png	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\es-419.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\fr.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\icons\checkbox-checked.svg	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\images\fast.png	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\id.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\nb.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\th.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\cs.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\te.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\vi.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\swiftshader\libGLESv2.dll	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\d3dcompiler_47.dll	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\lt.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\ur.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\zh-CN.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\en-XA.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\fr.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\hr.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\id.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\ro.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\swiftshader\libEGL.dll	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\js\ui.js	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\af.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\ca.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\mr.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\ru.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\css\normalize.css	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\images\general-settings-bg.png	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\da.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\fa.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\it.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\nl.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\pt-BR.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\ml.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\mr.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\pt-PT.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\images\sidebar-btn-bg.png	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\ar.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\lt.pak.info	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\vi.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\icons\fast.svg	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\ui\icons\icon-tray.svg	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\ru.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\locales\sl.pak	SetupEngine.exe
File created	C:\Program Files (x86)\Fast!\nwjs\ffmpeg.dll	SetupEngine.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5072_805457196\manifest.json	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
4348	SetupEngine.exe
3372	diskspd.exe
2076	Fast!.exe

Loads dropped DLL 28 IoCs

pid	Process
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupEngine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fast!.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3280	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292614991323484"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{EA126365-2624-4986-B395-E740DCFA57FC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
3704	Setup.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
4348	SetupEngine.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe
4348	SetupEngine.exe
4348	SetupEngine.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe
Token: 35	5428	powershell.exe
Token: 36	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe
Token: 35	5428	powershell.exe
Token: 36	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe
Token: 35	5428	powershell.exe
Token: 36	5428	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5072	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 5072	3704	Setup.exe	90
PID 5072 wrote to memory of 4628	5072	msedge.exe	91
PID 5072 wrote to memory of 5364	5072	msedge.exe	92
PID 5072 wrote to memory of 3280	5072	msedge.exe	93
PID 5072 wrote to memory of 5364	5072	msedge.exe	92
PID 5072 wrote to memory of 5364	5072	msedge.exe	92
PID 5072 wrote to memory of 5124	5072	msedge.exe	94
PID 5072 wrote to memory of 5124	5072	msedge.exe	94
PID 5072 wrote to memory of 1500	5072	msedge.exe	96
PID 5072 wrote to memory of 1500	5072	msedge.exe	96
PID 5072 wrote to memory of 2884	5072	msedge.exe	97
PID 5072 wrote to memory of 1500	5072	msedge.exe	96
PID 5072 wrote to memory of 2884	5072	msedge.exe	97
PID 5072 wrote to memory of 2884	5072	msedge.exe	97
PID 5072 wrote to memory of 5816	5072	msedge.exe	98
PID 5072 wrote to memory of 2768	5072	msedge.exe	99
PID 5072 wrote to memory of 5816	5072	msedge.exe	98
PID 5072 wrote to memory of 5816	5072	msedge.exe	98
PID 5072 wrote to memory of 2768	5072	msedge.exe	99
PID 5072 wrote to memory of 2768	5072	msedge.exe	99
PID 5072 wrote to memory of 688	5072	msedge.exe	101
PID 5072 wrote to memory of 688	5072	msedge.exe	101
PID 5072 wrote to memory of 4472	5072	msedge.exe	103
PID 5072 wrote to memory of 5136	5072	msedge.exe	104
PID 5072 wrote to memory of 4472	5072	msedge.exe	103
PID 5072 wrote to memory of 5136	5072	msedge.exe	104
PID 5072 wrote to memory of 1180	5072	msedge.exe	106
PID 5072 wrote to memory of 1780	5072	msedge.exe	109
PID 5072 wrote to memory of 1780	5072	msedge.exe	109
PID 5072 wrote to memory of 3288	5072	msedge.exe	110
PID 5072 wrote to memory of 3288	5072	msedge.exe	110
PID 5072 wrote to memory of 6120	5072	msedge.exe	112
PID 5072 wrote to memory of 5920	5072	msedge.exe	113
PID 5072 wrote to memory of 4120	5072	msedge.exe	114
PID 5072 wrote to memory of 3720	5072	msedge.exe	115
PID 5072 wrote to memory of 3720	5072	msedge.exe	115
PID 3704 wrote to memory of 4348	3704	Setup.exe	119
PID 4348 wrote to memory of 5428	4348	SetupEngine.exe	121
PID 5072 wrote to memory of 5208	5072	msedge.exe	124
PID 5072 wrote to memory of 5208	5072	msedge.exe	124
PID 4348 wrote to memory of 1756	4348	SetupEngine.exe	125
PID 1756 wrote to memory of 3372	1756	cmd.exe	127
PID 4348 wrote to memory of 4088	4348	SetupEngine.exe	129
PID 5072 wrote to memory of 4308	5072	msedge.exe	130
PID 5072 wrote to memory of 4308	5072	msedge.exe	130
PID 5072 wrote to memory of 4308	5072	msedge.exe	130
PID 4348 wrote to memory of 2076	4348	SetupEngine.exe	131

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://veryfast.io/installing.html?guid=11111111-1111-1111-1111-111111111111&_fcid=
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff4be4c188,0x7fff4be4c194,0x7fff4be4c1a0
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,3748331066579230710,13132379940428368296,262144 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,14854059900676339190,12131460005980439016,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,10090394769778238436,18342336249381428016,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,16278177388416111105,9726541491910922940,2097152 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,3435011771332417707,1467124785851021166,2097152 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,3734931078767316209,14920461370836800443,2097152 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,8130116601827501850,2256262884983777300,2097152 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15409598132969307020,18293812841356739046,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,9463928379627219493,1022499733659823687,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16851130740345201533,8421191530509659570,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,1330562203029936463,6998784876863354736,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,1330562203029936463,6998784876863354736,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,5930388288198919257,6653278836350780452,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,938913010695602930,14492526873733462954,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,13982176102587794370,4815657224434891182,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,7380104385170897625,3119060115524838974,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,10803498238044678336,732703680199200625,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,14829145985087953116,4462824714771061595,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,3398469960572793092,11627993497724218052,524288 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5908,i,9583801174271980849,14504235350523525316,2097152 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,12008444307195939062,8584168262504598726,262144 --field-trial-handle=2416,i,5575979291263697879,12239318970911644324,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:10
    3⤵
    PID:6008
- C:\Users\Admin\AppData\Local\FAST!\Temp\SetupEngine.exe
  "C:\Users\Admin\AppData\Local\FAST!\Temp\SetupEngine.exe" /fcid /instdir C:\Program Files (x86)\Fast! /startup 1
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Register-ScheduledTask fast_task -InputObject (New-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files (x86)\Fast!\fast!.exe') -Principal (New-ScheduledTaskPrincipal -UserId ($Env:UserDomain + '\' + $Env:UserName) -RunLevel Highest) -Settings (New-ScheduledTaskSettingsSet -MultipleInstances Queue -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)) -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\FAST!\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\Admin\AppData\Local\FAST!\Temp\testfile.temp" > C:\Users\Admin\AppData\Local\FAST!\Temp\dskres.xml
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Users\Admin\AppData\Local\FAST!\Temp\diskspd.exe
      C:\Users\Admin\AppData\Local\FAST!\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\Admin\AppData\Local\FAST!\Temp\testfile.temp
      4⤵
      Executes dropped EXE
      PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://veryfast.io/installed.php?guid=11111111-1111-1111-1111-111111111111&_fcid=
    3⤵
    PID:4088
- - C:\Program Files (x86)\Fast!\Fast!.exe
    "C:\Program Files (x86)\Fast!\Fast!.exe"0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2076
  - - C:\Program Files (x86)\Fast!\nwjs\nw.exe
      "C:\Program Files (x86)\Fast!\nwjs\nw.exe" ui\.
      4⤵
      PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2540

C:\Program Files (x86)\Fast!\FastSRV.exe
"C:\Program Files (x86)\Fast!\FastSRV.exe"
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FastSRV.exe

Path C:\Program Files (x86)\Fast!\FastSRV.exe
Size 117KB
SHA256 557a853758271c6c7ae1e2130786444bdd4340b364de579900d9dcd386180933
MD5 c6e3c8b213d6cb03553328f467742c15
SHA1 cdf8c5a7e7a8896e532705577db2d04cb593c9a1
SHA512 586b4a537a4e79f9668960f5671be533fb73bb7ff042e42ce9ca46a5295d414b8952db0c17362754c48c23a889bf299638dd2a9e64bf08545abfc28ee08bfb80
SSDEEP 3072:O8Z1ZI5I8YQhP3470Gkokrx4pRQhOvQSqvkcrr5Isz:OoP8Yi5o5uTrr5Ii
TLSH
T10DC32A41B7C188A1F563D731146499645A6EFD10BE204FAF3FD402690FAC3E19F26AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fast!.exe

Path C:\Program Files (x86)\Fast!\fast!.exe
Size 960KB
SHA256 d9b2c0fa29b64996b73927ce4a6595047a64908e84a724fef3a7e8ff80a9eece
MD5 34c84c0f07080cf0db09d963affe6aeb
SHA1 5dede49f5421782dd073d929f2e58dc841907354
SHA512 4ef9b8a380bdf8c590e35803d221986720fa35d7c53606fe6c1b6fa2b3ede192073bf256cc17bf7f2aa7e98f6a389c84a41afc175ff3cffb6e9da4b98c76c3fd
SSDEEP 24576:izVQLPcQ3fiJxLko8SRpwtTRybta8BN3AaeP6qQJJLnUptJzO:i+cG+LkE3OUta8BN3AH6qQJZUptJzO
TLSH
T138258D213646C037D4A682B29A3CEB7E517DBA311F7209CFB7D42A7D4A605C21F31A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak.info

Path C:\Program Files (x86)\Fast!\nwjs\locales\bg.pak.info
Size 978KB
SHA256 e957cde29b8732cc46e61c98629cbbfaa23333776ae5db166a2b2169799c8290
MD5 e3beb49ba64cb7a3af04be34b2fb2ff4
SHA1 ddc36967b80ff1062461bf0b691736a9f8f3d57a
SHA512 9dbc8f89809926e8b19609018f6c82bf9411a8c9690c6ebbcc93f2bfcadd194c27a8220ad581fc60d168aa06ae3d35072bb298a9619e4d6a8664ec6af6a49fdc
SSDEEP 12288:HPwCbHEzqTGHhxK7gCBYVExtHnOwkxwkYOjTlz4:vOjTG
TLSH
T17225AF78293C225BEC584C89C069AD439AC20C13F57B6EF9F0DE72719FF15C60169DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nw.exe

Path C:\Program Files (x86)\Fast!\nwjs\nw.exe
Size 2.2MB
SHA256 221027fd7e324a31614fda2dac69e3b9af082895ff7c45b6c19d42aa27592da3
MD5 d6644e8a0c3c48607ec424bae0feb47e
SHA1 c041efb63894032be1b8e517b8cbb45454ccf330
SHA512 d689575c7f1430bf0b92aaf50a757f7c9e3dd5e8af71dacf0911ea484db79460369455f91b2f480b0f224fe7d0c0199afd9db98b65fba3f3bc3ff430838c5c04
SSDEEP 49152:9W3aFEhyflDCQ6n85K353JCJ9f98Tplhpgh:owrGjG8Tpmh
TLSH
T114B56B07F69950E9D09AD0B8CB069236FDB2BC550B3466EF06906B192E77FE41F39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nw.exe

Path C:\Program Files (x86)\Fast!\nwjs\nw.exe
Size 448KB
SHA256 d6fa4eb29932a4d1cdee0994ff11617a69aa220b4db9a951f9d577126728d88c
MD5 ef9973913f9cc2132eecf0f59ae752c5
SHA1 ff4c4692adc0f0c2432e6b3b5a759453978826b4
SHA512 b04661ac7cd90c61c444fb35349285cf284cb39cef188bf72ac301a47e634e94b91559af9b18fcf3376f8e05b699717896165edf4328c81c63a370a042d9fe48
SSDEEP 6144:RASLsjkds6a4sRAKJCuQ+asvmqd1bTyUEQQKd5ZyUilXcqFf4Q:RHLGkmH4ZKg0asvmEhyUElYkGQ
TLSH
T1A9A45C17E2A911F8D02DD0B48B469533FD66749A0B36B5EF0A9487243B7BEF42739B04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nw_elf.dll

Path C:\Program Files (x86)\Fast!\nwjs\nw_elf.dll
Size 1.1MB
SHA256 bbaf4e0d60d4362e23671301e9aba75252b1059cd6e1dcf6ad0accec5e115152
MD5 7509d69c2896e7b903398da350b42c8a
SHA1 6bb535ea3728933a6aa9162950cfc44328e4d347
SHA512 438cefec05e62904a8f2f304607ea4e9ab691793f8950ea2ff12b3740b5bf172f29ec40f17921d4da8a09590bba01889d81da8315ea6585076c0b758d9e6a1be
SSDEEP 12288:KVQ+6Nq2vF73pppDh8oLG9UTlcPwaKD1CK+D3SJ3NVTRmcIMI+nk/owl+GlBfG:KVQDNqyB7zLG9qD1CrDQHNmcMzl+6l
TLSH
T1AC358D07B29941A8D06ED1B4CB674632EE72B4550B31B6EF06D087292E3BFE45B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nw_elf.dll

Path C:\Program Files (x86)\Fast!\nwjs\nw_elf.dll
Size 192KB
SHA256 ff2f4c308eaaa83b324606778dfcbfd23f2c54c34a41338def27efa7607d32cb
MD5 5c6a69f74d0d7d2218c554e19798e8ef
SHA1 6b0ab614d7f9e26ad5f170059559dedc380548ce
SHA512 5eddcb171929b699a7238a7d9375ee108420c4112f78d30ce5beaf2b3d5a356119b0be8485f0a649b78ddad7cbb71e152d6c38b6ef7a1070eec5b2889e42f2b1
SSDEEP 3072:KYMqS73hIGAsXDzYj8khhmW/p5Zoe85UKSPM6V95EuFg2Y:KVL7dzKPmnDLH6VzET
TLSH
T1DD145C07A29C90B8E06CD0B48B8A8622DD6574DB073AB1EF06D516552B7BFFC1B3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_DEBA334B4883243AD4D11DB4DE070671

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_DEBA334B4883243AD4D11DB4DE070671
Size 471B
SHA256 a55b5f3f193494c54ecee72a7cdd8a839962b262cd80bb97dd554a3652022f4f
MD5 5854db1040251be184735c92a0adad0d
SHA1 7976b2724c6a140202a5d5b43ee045a121fe7b44
SHA512 2b2f49f485c17a9911791aa0303d04fb0feec7e5f0467e047580d67b857d2128d6227c18437a42fd50c7fdf9ee080e62ab9787af51c77d0fc4b1bff577b03695
TLSH
T14EF0D44160D83439A831CDD479DC467D3407DADD12164205383D0B6859AAF9E9D05324
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 e32010efc0445b0c82c07a8bee237376d01b26f4fe5be10f56a88069ed2215ed
MD5 80934e2f25954dfc8b163b2a6ad595e6
SHA1 7f2b26d4175a7adb016c811c1b7628393a39e72b
SHA512 e724b535a8ce16da11f193814fcc02c5dd2f7aefb66f08516f1b2f905fb4ed4b9ba50abd6386eeb76cae59ca495d95e1a441d12844bfd06bc136367fae6dc003
TLSH
T15EF0DCABC03DE0D212D658EC17EC077F2CBF5AF800980E88252C08B09824436B22E03B
MD5 SHA1 SHA512 TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_DEBA334B4883243AD4D11DB4DE070671

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_DEBA334B4883243AD4D11DB4DE070671
Size 404B
SHA256 e5e0b0fe3bbe17b71be5885b83048a738d50b9eebfa9876b6aa7e1800ef76cb7
MD5 dd06b328a54d4b9aec6120114650df6b
SHA1 b67b29018289236cdfb472a7efb190b1d807acc3
SHA512 34efe8786a55fdd56e65b57dc99c7a1974dd05589eb25f9d9396b43b70207d599294d80a3442f15701bee7513610e4054b34fb7704cac5350907bdd0ce0c54bb
TLSH
T1DEE0C01A16E8025CF6B2A97907EE56511E0FF0331C0186EAAA11021F603A544EC31230
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 0ee6df57f6b7674fbfee7ae5558549a9877f504f3d64c6db3cd08361af9250c6
MD5 eb676a81dd0cfe60cf3d7e4b258394ca
SHA1 6549df0dc8baad1dc4fc26ddaa5742c480288145
SHA512 2b956b20297c03d54060471713e814b537cd8e84db97786ebb9b5d4d12f40f69412fee07a327bf9c96c4dbd8ccd8a731bed51baf4c5ec929b939510587434780
TLSH
T1ECE0C02813FF421DF1E5E4345FD4B03189ADF0250411B1B01AC0A700B306A00DC93D72
MD5 SHA1 SHA512 TLSH

Submit Download

diskspd.exe

Path C:\Users\Admin\AppData\Local\FAST!\Temp\diskspd.exe
Size 141KB
SHA256 fa159f50e67fb5829f0f2511e25111c719411e6b6152fea97f3a296264c7d7a4
MD5 fc41cabdd3c18079985ac5f648f58a90
SHA1 51a619ddcb3661aa8675c2d7483840ac4f991746
SHA512 691090b54ce52d7e8bcfff2711ade7a6a8bb21b409358d7bffc2053a53c116c7c22896f21ba36945a54f094d963cd9361a132d2e165365fe287c02f3c60356ed
SSDEEP 1536:4YRHFhhMmofU98VLVFqZ3/FnKk2vlQBOJ2LcjNal+laLMQ03hc3J2tjF6+hjIEKT:NRlhhMmh33NnaE6O0vF6wBYqW2popg4
TLSH
T182E37D23BDC984F9D9A360B2252C71B1E178D1B2471541E3735C8BFCBB686E1AE385D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32270e51-822b-4292-875c-5d7ca1fe56a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\32270e51-822b-4292-875c-5d7ca1fe56a1.tmp
Size 38KB
SHA256 c8e398b7d8fc62448acfc046308e3c8a90e3a1b363a1cafa1b6c5937e8f0d958
MD5 f1cd9e79b6c3ac485617b25b5868b6ce
SHA1 8417afb5778079bf3c2551326b3d365eb487fbcd
SHA512 1808d1566d25381579c63393d45d93cbe870c7607740c502cd03eed651ae12d4b3b2545d818bf74df050e44309edec243642b730c885cc9d498206727963e5c0
SSDEEP 768:Irv+4UNbdD30c4Np8+p3bd66j+4BRv86aLIic62bwCl1:Ibsbp3kL8+p3Z6n4yi60ww
TLSH
T1E803BE73F8A899739CE6C644B2467A433FF851A396C10EC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9af1110d8c61a09abf0deeae0c3ba1fc0f018aa8423040fe9ed7082f5803600d
MD5 295779d1a8abc08656889e0cfca875a9
SHA1 317be4402e8a022517c0782fb7f9cab5df15b214
SHA512 f532563c92946be4f7bbfae24b3eb5489c43a9543c05110b90ac102c6e6f84d529b4bb5e3cecdc63d6d01087b0f4f6d8f91fb365af08e3ff4a19d7ed21db525e
TLSH
T18351C7E3431B1DC2C7E5827254E1ACFA7A39C6FA01CF9ED1785E94B4964231E31D5024
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a568d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a568d.TMP
Size 2KB
SHA256 376a1c71d029549a59662696cb6767f376cd1565cb636fb40b36cf671dc16218
MD5 1f11c4103450a6468f896bd033819163
SHA1 f5d722991b23980a07aa9e224457377deb96f52d
SHA512 dd88ef2733403c4ffb8ebe87c5a5b1ced9cbaeb00f3d1e6bb8836c57fb70f05f30e449a86b61aecf298bf3fc0a37fdd38c236f3b41a2886c121a8014ee2d6ba4
TLSH
T18C51C8E303171DC2C7E582B258E0ACFA7A3AC6FA41CF9ED5788E94B4864731E31D5024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7aa8b463-0d99-4d85-8675-2f056e43271b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7aa8b463-0d99-4d85-8675-2f056e43271b.tmp
Size 3KB
SHA256 10a1fbd2590e76f766228510b670db2d209f90d7fbfe515f5615a479d7da65fd
MD5 1f7ad15145e4e5c14cf55d1bd148c60d
SHA1 4b114558be2626cdd6a4ab7758cff5b207285066
SHA512 b39c9d5f1f61994357688f801211718838e2c94e82a83b1932aad3a18503aeb2cf131110f1c9929fa0c729ddc76330b736a630e8dc42559abfb0d3cee0650180
TLSH
T10261C0F3C3E4862DD90156F4AB157E2BCE1D0914432C3D6AC8E4AF5BA3E2871D24165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c01253a2d1f8ac88b1d5725e57d851de553df29ce5b964aafb3991cc33d9df09
MD5 98e22b51e54ab2fd05534490dc6df9f2
SHA1 8e911b2ff59cd1915c18f092b1c4ab5db3585d62
SHA512 c65062adb07159aad274db8b5a74b84c242340f3aafb2e0f90cf00bac689563fecfe5c9ad1b235f4c8a8aa744806759f76c8928b6290ee5d1ac34b0bf31a7d93
SSDEEP 192:sxRJR/UCC/fusUgHJZu/zoD8pqlp/g6+WNSmG/YC8uOzGdIgtJ:sxRJ5DC/fusHHH+G/5u/yA3
TLSH
T12C32B8166E28A93B4CC7D21DFA56BF53E2F95032A1D45E88A7FC861C04EA6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f2842739567e41f3c4c2f17e97bd9a57750d9c741ad0436f35242096e8c75849
MD5 c0cff304470eeceef40ae0fc3a98983b
SHA1 4e8eac8a089a1986a328a1c83c6f557bfcf2616e
SHA512 59662bd45f4ec4bfe76d305ca39b5fafff3c0a9bed6ccedd0858117d832312a2697e92dddf13a539e3098f56108e1cae0edc91d3b63c004fee0df198c0e7929c
SSDEEP 192:sxROR/UCC/fus4g3JZu/zoD8pqlp/g6+WNSmG/YCiuOzGdIgDGJ:sxRO5DC/fusT3H+G/5u/MAO
TLSH
T1DF42D8166A28A93B5CCBD21DFA55BF53E2F95032A1D01E88A7FC871C05E76DE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b5e3b3ba6f8713dc42a3681280e03e87f28046245b7c9e15d83994ffdaebae24
MD5 4a49e7436ad546081e77d532aacc70d1
SHA1 024bbd17e86e27067a760a87b2e67fefc46e7d17
SHA512 7690791c8a69021124556beb2d15855e6e02d8e477166a04ef819f47dc8110d1d45ca7d182bc3b9c0acec99f4115140f58dc2983fd22c9f92a0b3ecca0d2fcb5
SSDEEP 192:sxROR/UCC/fus4gHJZu/zoD8pqlp/g6+WNSmG/YC8uOzGdIgDQJ:sxRO5DC/fusTHH+G/5u/yAg
TLSH
T12842C8166E28A93B4CC7D21DFA55BF53E2F95032A1D41E88A7FC871C05EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 45a9f5371bf6784cf0721044ba82c75f22c1dcf0ec934793700e800e6daafc55
MD5 2ad42cfba5c0da6d9c25167da70882b9
SHA1 566feeee389a0e818db7b4bb92a168cb66cb73ca
SHA512 8f8d4d3bfb57bb55b6b38a41aa34906d5ac732bba407d44df8993a5313ead2f64ff0da3312bdf749605e3f01480213c3c108b0436e0434676d422a19981bfb1c
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZh0QqcMroZr:jC+vf7E7JQWgQ+f4+u1jauh0VcX1
TLSH
T197D2EA7B640DCB7F4F804ADDED197ADB6DA802CB9698CD4047FA841C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5301c7e4-b8a1-4e65-9b66-45132496eb68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5301c7e4-b8a1-4e65-9b66-45132496eb68.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 df4dae0e73f7a03946bdc4c77fcb0187b4f4afb36a4f33388fda8414e151ace9
MD5 a4a19f6a44165d10c5abc6b325ab1351
SHA1 27a4f40aa0e9c7e304445eb8e32ff26d56a7763d
SHA512 4eb078d609f35ab188206d1d6a82cc4dc436e6f7e6c1db059246b9c52a35e66dec89b533197ca9cb44c924568b21959719f18233a37192170c1aaca52a147ff9
SSDEEP 768:pt33/J81p8+p3bd66j+4BRv86aLIWcXb9MOH:pt32D8+p3Z6n4yGXb+q
TLSH
T1D8F2BF72ECA9AD739CE9D614B28637436EF411B3D6C40EC8E4DDAB0D055719E1B0B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4edf1821d67e35417d67d01b967a330870e27c63715b308b53d1b2b741b30152
MD5 d39dd10a8ca4f4bb1f54178e9163fffb
SHA1 a706f1239238cb8d2664835ea5bac1088dc3721c
SHA512 9550fa8f098216e9dc8c37b477708e23878481b4fff654ae4fdb83e7816a12c58576160c1dbe53752b94e300ff29eba36cdbb94d88c01a90b08049ad34fd778c
SSDEEP 768:irv+4UNbdC38/J8yp8+p3bd66j+4BRv86aLIWcXu:ibsbw3zM8+p3Z6n4yGXu
TLSH
T11403AE72F8ADED738CF6C644B24677837FB420A396C00ED4E4D96B5D419A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a90225e760a233ccc84d11e2a87242153bf14957ab24b68a9d24554eb869d236
MD5 0eb282d5c12fe7ab933fe61bf0edd194
SHA1 7c66ba28c09763c81658b8ec7a893791042e03ea
SHA512 dbc575eaa4c5d7624e0601e072e24b00b768b0b46a97b03957ecd9cb87cb11ff1eb987b9a15b08b2d38cd2ce4ca6c9f2b0a23b06b2c8d14de37e4f3076f82ca9
SSDEEP 768:Gt3+/J81p8+p3bd66j+4BRv86aLIWcXb9MOH:Gt3xD8+p3Z6n4yGXb+q
TLSH
T12DF2BF72ECA99D739CE9D614B28637836EF411B396C00EC8E4DDAB0D055719E1B0B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2eb37cbcc7e4d216aed215b7edd02b12b47c6d730e91b8a9f71f79cb1a46172c
MD5 c4020a02cd8b4387d30ccdfc53059d7e
SHA1 663872e665882504c6d5816d3e4c0493ce3a7965
SHA512 9b6fbbe62ca517aafd063e5a1dfc42a9923e345668891aa64c813a30365b1d29750aba05a052c6d51ac1c9364e7924c3eb6af45024ec368313d0252032830fd8
SSDEEP 768:dFQb3owgdM0Vp8+p3bd66j+4BRv86aLIWcXb9MOH:sb348+p3Z6n4yGXb+q
TLSH
T17D1307F6D8D79A36D8AE8743A37D2E425EBCD163B5844984B7C85E0CCC421BFC70A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 fc1b5e986ea20036b30095c24f94329b01df2f2c90025488eeb95632d9a6a79c
MD5 e3b941d7e35db654e041ae648592a37f
SHA1 a0b4ea719051ee6a966d32846d9854792bf6de81
SHA512 89d4136e58d4b5cdde7f5307240717bedcec1bde84cf30d01baf8d4397287238ff2e0106640288784b483ed6522353c0233aa006a9ac1f3dd6eeb67e45cda9d9
SSDEEP 768:Vb33M0Vp8+p3bd66j+4BRv86aLIWcXb9MOH:Vb338+p3Z6n4yGXb+q
TLSH
T169F29F76E8A5EE779CE6C745B3467B47AEF4116386C84DC8D8D86F0D008719F1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq3FE5.tmp\SimpleSC.dll
Size 1.1MB
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

button.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsq3FE5.tmp\button.bmp
Size 9KB
SHA256 cc5ec3ba7f3bcdcdffd8154e62f8a52a1c9e98306edbf1453d2f515a8a438797
MD5 bfcf1f0f62115a68fb836bf28aa9c183
SHA1 9e30c7f08cfebd79d8637eea8c2675f06885a75f
SHA512 9891ebb390ef38e116da4c50c8ab23a56d7261305fcd0cb2ab00c294dd5b7c9b5b317c34fde38fa9e85e9bd382b3cc62cc9a99d92bac04ab41c01f27f87aaa6f
SSDEEP 12:9tIfCi8VCCCCCCCCCCCCCCCCCCCCCGNKaUTkOUszTl:foCi8zAa7S
TLSH
T1E912FDABA36E44D0C403E4B8A81F5D74DAF7D9A5212A05D4BE72CF3F5D79E209136423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq3FE5.tmp\nsExec.dll
Size 7KB
SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
MD5 675c4948e1efc929edcabfe67148eddd
SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
TLSH
T15EE10A3574C02CF7D0CD49743816791B83F4C52527BA05B04A7B1AD576E1AE7FE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Banner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\Banner.dll
Size 4KB
SHA256 39e3108e0a4ccfb9fe4d8caf4fb40baa39bdd797f3a4c1fa886086226e00f465
MD5 a1b9bdee9fc87d11676605bd79037646
SHA1 8d6879f63048eb93b9657d0b78f534869d1fff64
SHA512 cd65d18eca885807c7c810286cebef75555d13889a4847bb30dc1a08d8948893899cc411728097641a8c07a8dcc59e1c1efa0e860e93dada871d5b7acc61b1e5
TLSH
T15981523BB2E04EF7E562023300831BD3259BA9146768461A4E6791ED764A997D53CB02
MD5 SHA1 SHA512 TLSH

Submit Download

GraphicalInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\GraphicalInstaller.dll
Size 105KB
SHA256 b3f434cffaec74b744edfeb916cd54b2fd0404319178c674e46f6bc65c6e56cd
MD5 6ff9aa6c53a5035789f57fa3339267a0
SHA1 dc7603910c8ff0ffb9364cb5e5e2b6afe6f6e72b
SHA512 981064b4bf3d2cae0afb1baebce2c0f7379eacec8d64c85293754a4c43f74a33fd07a2a6cb949504b9d8662600f3ac24512eae7e3143c1242f679c7473074d02
SSDEEP 1536:v2JZgqik14o+q5qbCfKIJPcFytROki+GNjFcspf8U5JsIyjWpk6:+JiCjt5qbOjJUFytRr6jFR8U5JsFqpz
TLSH
T124B35B15F2409838E0DBC13D46B5A2F1C9DFBDA287D058E73729AB657B726C09930B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Math.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\Math.dll
Size 67KB
SHA256 8d9a23dd2004b68c0d2e64e6c6ad330d0c648bffe2b9f619a1e9760ef978207a
MD5 85428cf1f140e5023f4c9d179b704702
SHA1 1b51213ddbaedfffb7e7f098f172f1d4e5c9efba
SHA512 dfe7f9f3030485caf30ec631424120030c3985df778993342a371bf1724fa84aa885b4e466c6f6b356d99cc24e564b9c702c7bcdd33052172e0794c2fdecce59
SSDEEP 1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
TLSH
T174639D2276E480F2D09E81B125955F1B9B7CA63087E64DD35F622C86AE30EE1F237707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.ole

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\background.ole
Size 20KB
SHA256 3ba4ecc6a8013cbebeca713e2b9354e00c1c746e16e32238c3a275647796c3d2
MD5 641995dca6e3100e845e78e5474a66b9
SHA1 721729d82041e064e8ff305cccf5b2564cd3bd30
SHA512 33959f4aafb494bbc12919c581b6d10064b4ebad752bc81d6caca3e5633d5d7deff2ffc78af4d0c97ae16f1cf944d1bc2177bc59be9b196da35b3c947d48da5f
SSDEEP 384:rL5rXzTlMoTfntrAmBTmAqPfIRB4JiSrWcbQ3aNrUn2Dk6:r48fOfIMJiCO3aNrl
TLSH
T10DA208178D0D8E83A668D3A8BF035EAC7B5A7A5CED123AFF45211EC93F245061C4E527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.ole

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\background.ole
Size 6KB
SHA256 a6dfcffa07df1ac46881e977801ce6c465ac7e9427bec164208f34446f098a3a
MD5 6760e84e617164f959e76298be77701b
SHA1 558896858de762c3c731572117f0209c021a8311
SHA512 5c8cb1d3fe9f84dee4958837e3b42b3734a2ae86e32dbb67baff6602c85fa6ddfdd39345ad24e2d90b38c693f024b6f2709e82135b90f42cf2fcd1f59dc49480
SSDEEP 24:dDcIhpKyo0XxDuLHeOWXG4OZ7DAJuLHenX3OzrBLsE5RnhCtOJS7/b8a5iFunD/B:1cduERADE5RnkMq/Jmu9
TLSH
T130E16C17DE011D8398B9C3BE7F038EBE5B8CBE40A1123BD316B04E50B3308969D5B158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fast_background1-inner.jpg

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\fast_background1-inner.jpg
Size 1KB
SHA256 6b6725f2d798af2665949f4dc798c2fd1a0f8532b8f476c585ac24b64baf6969
MD5 e750a9502809c0b97224053ea8a2fb50
SHA1 970580150f8cf3427e6a8e7b0f2594131025c778
SHA512 6a24630fe45acb513b489182c2bb8335df11c264a7b1d233b736e4e2d83db9adfc7aa912fec36ce688817b3a8436c71ec472196d17ab4606564da46c44b7cf73
TLSH
T1C031B81A1B021F60C8D280BA5C53C356AF8EA68D7AC3231F1A7751A3F900BF5990CA2C
MD5 SHA1 SHA512 TLSH

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\inetc.dll
Size 38KB
SHA256 a793929232afb78b1c5b2f45d82094098bcf01523159fad1032147d8d5f9c4df
MD5 a35cdc9cf1d17216c0ab8c5282488ead
SHA1 ed8e8091a924343ad8791d85e2733c14839f0d36
SHA512 0f15b00d0bf2aabd194302e599d69962147b4b3ef99e5a5f8d5797a7a56fd75dd9db0a667cfba9c758e6f0dab9ced126a9b43948935fe37fc31d96278a842bdf
SSDEEP 384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
TLSH
T17903E7419BE8456BF7F61638B0B99A53896D7C304769C8DB87134F8918A23C7EE34323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx7C2C.tmp\nsJSON.dll
Size 23KB
SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
MD5 f4d89d9a2a3e2f164aea3e93864905c9
SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
TLSH
T1D4B21746A6B054F4F57B55BAB4322E232E7EBD08286095EFC73319196860913BB3D333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5072_215250844\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3704-39-0x0000000010001000-0x0000000010002000-memory.dmp

Download

memory/3704-272-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/3704-40-0x0000000010000000-0x000000001001F000-memory.dmp

Download

memory/4348-506-0x0000000005310000-0x000000000542C000-memory.dmp

Download

memory/5428-478-0x0000000005EA0000-0x00000000061FB000-memory.dmp

Download

memory/5428-495-0x0000000007DA0000-0x000000000841C000-memory.dmp

Download

memory/5428-496-0x0000000007720000-0x000000000773A000-memory.dmp

Download

memory/5428-497-0x0000000007780000-0x000000000778A000-memory.dmp

Download

memory/5428-498-0x00000000079D0000-0x0000000007A66000-memory.dmp

Download

memory/5428-499-0x0000000007930000-0x0000000007941000-memory.dmp

Download

memory/5428-494-0x0000000007670000-0x0000000007713000-memory.dmp

Download

memory/5428-493-0x00000000073A0000-0x00000000073C0000-memory.dmp

Download

memory/5428-490-0x0000000073CE0000-0x0000000073D2C000-memory.dmp

Download

memory/5428-489-0x0000000007360000-0x0000000007396000-memory.dmp

Download

memory/5428-480-0x00000000063E0000-0x000000000642C000-memory.dmp

Download

memory/5428-479-0x00000000063B0000-0x00000000063CE000-memory.dmp

Download

memory/5428-474-0x0000000005770000-0x00000000057D6000-memory.dmp

Download

memory/5428-475-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/5428-473-0x00000000056D0000-0x00000000056F2000-memory.dmp

Download

memory/5428-472-0x0000000005850000-0x0000000005E9A000-memory.dmp

Download

memory/5428-470-0x0000000002E90000-0x0000000002EC6000-memory.dmp

Download