b53a2d95b1825729052bf204be8aa46320abe6034f4a2af894a5e9bdc36abaa5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FastClient.exe
Size 33.6MB
Sample260729-jht44afa66
SHA256 b53a2d95b1825729052bf204be8aa46320abe6034f4a2af894a5e9bdc36abaa5
MD5 db3469aa71d096ac2778791cd0115ca7
SHA1 a4c74b55f5914224dc79824238a470c43f747cf1
SHA512 9e2a013321d66be49dbfdeb7d4da83a3f1eab04314c7441f892cb996ddbf50225c3942741d5c99c47349a0b96e3af80cc216defe84b3446833969aa0cb763bb2
SSDEEP 393216:5GmbE3mMVdAUd0BJhE5ddGbgOObQdVRBzExtFvjM3DBcYFKF9uCZwxIJCKGOuJr3:5rYVAUUhcdGgbp3vjsaF9uCZwxIod3L
TLSH
T14F77E013F65251EDC06EC575834A9232FBB1B88A47347AEF6BD04B212E19FD06B38749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
41	3200	FastClient.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	FastClient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_550209230\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\model.markov	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\ranked_dicts	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\surnames.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\test.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_550209230\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\female_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\male_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\passwords.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\manifest.fingerprint	msedgewebview2.exe

Executes dropped EXE 4 IoCs

pid	Process
5064	FastClient-3.0.1-installer.exe
4416	FastClient.exe
5704	java.exe
5880	java.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5496	powershell.exe

Loads dropped DLL 22 IoCs

pid	Process
5064	FastClient-3.0.1-installer.exe
5064	FastClient-3.0.1-installer.exe
5064	FastClient-3.0.1-installer.exe
5064	FastClient-3.0.1-installer.exe
5064	FastClient-3.0.1-installer.exe
5064	FastClient-3.0.1-installer.exe
5704	java.exe
5704	java.exe
5704	java.exe
5704	java.exe
5704	java.exe
5704	java.exe
5704	java.exe
5880	java.exe
5880	java.exe
5880	java.exe
5880	java.exe
5880	java.exe
5880	java.exe
5880	java.exe
5880	java.exe
5880	java.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FastClient.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FastClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FastClient-3.0.1-installer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297845255209045"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5064	FastClient-3.0.1-installer.exe
5064	FastClient-3.0.1-installer.exe
4416	FastClient.exe
4416	FastClient.exe
5496	powershell.exe
5496	powershell.exe
5496	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1804	msedgewebview2.exe
1556	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	5064	FastClient-3.0.1-installer.exe
Token: SeImpersonatePrivilege	5064	FastClient-3.0.1-installer.exe
Token: SeDebugPrivilege	5496	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3200	FastClient.exe
3200	FastClient.exe
3200	FastClient.exe
4416	FastClient.exe
4416	FastClient.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3200	FastClient.exe
3200	FastClient.exe
4416	FastClient.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1804	3200	FastClient.exe	86
PID 1804 wrote to memory of 5032	1804	msedgewebview2.exe	87
PID 1804 wrote to memory of 5060	1804	msedgewebview2.exe	88
PID 1804 wrote to memory of 5060	1804	msedgewebview2.exe	88
PID 1804 wrote to memory of 5060	1804	msedgewebview2.exe	88
PID 1804 wrote to memory of 3736	1804	msedgewebview2.exe	89
PID 1804 wrote to memory of 1100	1804	msedgewebview2.exe	90
PID 1804 wrote to memory of 1100	1804	msedgewebview2.exe	90
PID 1804 wrote to memory of 3664	1804	msedgewebview2.exe	91
PID 1804 wrote to memory of 3664	1804	msedgewebview2.exe	91
PID 1804 wrote to memory of 3664	1804	msedgewebview2.exe	91
PID 3200 wrote to memory of 5064	3200	FastClient.exe	102
PID 4416 wrote to memory of 1556	4416	FastClient.exe	105
PID 1556 wrote to memory of 700	1556	msedgewebview2.exe	106
PID 1556 wrote to memory of 5000	1556	msedgewebview2.exe	107
PID 1556 wrote to memory of 5000	1556	msedgewebview2.exe	107
PID 1556 wrote to memory of 5000	1556	msedgewebview2.exe	107
PID 1556 wrote to memory of 5092	1556	msedgewebview2.exe	108
PID 1556 wrote to memory of 1560	1556	msedgewebview2.exe	109
PID 1556 wrote to memory of 1560	1556	msedgewebview2.exe	109
PID 1556 wrote to memory of 4360	1556	msedgewebview2.exe	110
PID 1556 wrote to memory of 4360	1556	msedgewebview2.exe	110
PID 1556 wrote to memory of 4360	1556	msedgewebview2.exe	110
PID 4416 wrote to memory of 3832	4416	FastClient.exe	111
PID 4416 wrote to memory of 1064	4416	FastClient.exe	113
PID 4416 wrote to memory of 2772	4416	FastClient.exe	115
PID 4416 wrote to memory of 5496	4416	FastClient.exe	117
PID 4416 wrote to memory of 5704	4416	FastClient.exe	120
PID 4416 wrote to memory of 5880	4416	FastClient.exe	122
PID 1556 wrote to memory of 2572	1556	msedgewebview2.exe	126
PID 1556 wrote to memory of 2572	1556	msedgewebview2.exe	126
PID 1556 wrote to memory of 2352	1556	msedgewebview2.exe	127
PID 1556 wrote to memory of 2352	1556	msedgewebview2.exe	127

C:\Users\Admin\AppData\Local\Temp\FastClient.exe
"C:\Users\Admin\AppData\Local\Temp\FastClient.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FastClient.exe --webview-exe-version=1.6.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3200.900.14397705878102700244
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb209ab078,0x7ffb209ab084,0x7ffb209ab090
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=1.6.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1692,i,1206085728932113930,11373134292789432767,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=1.6.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1888,i,1206085728932113930,11373134292789432767,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=1.6.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,1206085728932113930,11373134292789432767,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=1.6.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,1206085728932113930,11373134292789432767,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:3664
- C:\Users\Admin\AppData\Local\Temp\FastClient-3.0.1-updater-VVzcGv\FastClient-3.0.1-installer.exe
  "C:\Users\Admin\AppData\Local\Temp\FastClient-3.0.1-updater-VVzcGv\FastClient-3.0.1-installer.exe" /P /R /UPDATE /ARGS
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- - C:\Users\Admin\AppData\Local\FastClient\FastClient.exe
    "C:\Users\Admin\AppData\Local\FastClient\FastClient.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FastClient.exe --webview-exe-version=3.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4416.3488.12966486289781465983
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x74,0x7ffb209ab078,0x7ffb209ab084,0x7ffb209ab090
        5⤵
        
        PID:700
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=3.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2004,i,16325704690769418048,10452235803456441595,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        5⤵
        
        PID:5000
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=3.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1792,i,16325704690769418048,10452235803456441595,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
        5⤵
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=3.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2328,i,16325704690769418048,10452235803456441595,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
        5⤵
        
        PID:1560
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=3.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3508,i,16325704690769418048,10452235803456441595,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        5⤵
        
        PID:4360
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=3.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4504,i,16325704690769418048,10452235803456441595,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        5⤵
        
        PID:2572
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=3.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4520,i,16325704690769418048,10452235803456441595,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
        5⤵
        
        PID:2352
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      "java" -version
      4⤵
      PID:3832
  - - C:\Program Files\Java\jdk-1.8\bin\java.exe
      "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
      4⤵
      PID:1064
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
      4⤵
      PID:2772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -Command "Get-ChildItem -LiteralPath 'C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing' -Recurse -File | Unblock-File -ErrorAction SilentlyContinue"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5496
  - - C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing\jdk-25.0.4+7\bin\java.exe
      "C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing\jdk-25.0.4+7\bin\java.exe" -version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:5704
  - - C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing\jdk-25.0.4+7\bin\java.exe
      "C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing\jdk-25.0.4+7\bin\java.exe" --list-modules
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1556_1585734053\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1556_550209230\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1556_550209230\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

FastClient.exe

Path C:\Users\Admin\AppData\Local\FastClient\FastClient.exe
Size 37.5MB
SHA256 222e843b930f3af4626d9eb1086fc1ca31dc84393114efd36d302dc9d247f278
MD5 96399655d8fcb565278e5affe2e19449
SHA1 aba72ad16477784ab798b7b9190a16e8694fc5aa
SHA512 f2d1cf0e568df35a7f7aa89cc419e31f567f3e58f4a9fe4438d17c31f308bac2a32be7d779033373068d5b1cc34d1cb306b1a067c0ba21faf55d95c6b5b280f6
SSDEEP 786432:bAsIRgVyUUhcdGgbp3vjsaF9uCZwxIodonr:ssI6VQhcdHF3vQQ9uFxRdonr
TLSH
T18287DF13F65151EDC06EC175934A9232FBB1BC8A47347AEB5BE04B212E69FD06B38709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FastClient-3.0.1-installer.exe

Path C:\Users\Admin\AppData\Local\Temp\FastClient-3.0.1-updater-VVzcGv\FastClient-3.0.1-installer.exe
Size 27.4MB
SHA256 e737435a964d73cc0872560d0354ab4df00a5b3a98424f18f255f1810840769e
MD5 4e79a5e46429a2e1d702cf85361ddd37
SHA1 970cd516145806793926d0dfe8809602ec981fb8
SHA512 c96472cea8c936ebfe3a386c9a50c327dd9aff311151b8c6cd0ab61e4fa44a1e009a57edaa3587d3bc8379de4482e8c4fef600812a57f44df332313c1fe4cff6
SSDEEP 786432:poTkw87Odj6X1kwdp766Srp57NSOGxSRxCgZfWO:pCktOdjABW5T70OG0RNZ+O
TLSH
T14F5733D4117335B6DAA7A8B3F4EF0561684F9965301203461EAADEFECFE0C0439CAA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_oafd0qu5.3uh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oafd0qu5.3uh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp9DD3.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp9DD3.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 789ebaa561e348956c41e0a07fc5fd39b1011d4740e8cc0e3f72bcf0d96212bd
MD5 030658592cbf1002df442a5df64f04b3
SHA1 871d3209a4ed343ea708fbd7e774675af407acfe
SHA512 d5848c7ff89b2e86aaf4cf079700bf8f4e0ced676dccc43757eccd161504dcd953d17275276a2075d5fee963b04d57f4f81afe1eebd934f42770d1c2813c0923
TLSH
T126D012267701023CC0103D331443B1480442C60B400A40005439D52E5B548600E02441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0cb7cddce85bb1ad3b2dddea3e498b0d4b018cefe334f2d01e90b43f679fac16
MD5 b2185dd7cc833c3088ae86e0e906d801
SHA1 6adc01b7242cebcf4a45e51f145a8deca11820e9
SHA512 551d4d6e49cff9e40d9f9aef4c183962b25ba13fd3073146954e6e0aade849ebc3486c134caf2ddc74c77b998e5cbffeeca22c145dfbe9f46baf705b1e6cbdb6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ff97d96e350c8a1e1553183abec97aaaa127acd48993252e381ee8d235af8e16
MD5 44cabd2f01e122960ea176bab801d9bb
SHA1 6179b088690f8a2be3e7e12c67f5c4bca996d646
SHA512 bc1248cea652b14e33814f50b1bce0affb5cd3331e99338e8b52be23e679ef149a25fd16c2a753ec9c8b39413ea27205ad37899fc066444826cb0e8713a12b53
TLSH
T1ACD02B762319063CC2143A3744C2F1985002C61F000B40001E36F92D4B808F10D81941
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 27580b41bb82b22c8f086ce023b41568ec29836a5965966529673899de15a869
MD5 b67d8addd18ed67b25befdf3ea92d2c6
SHA1 2c314af0cdba1070d445616dbe60cbfcdf39df48
SHA512 09afd39f9e05c92b19a3b37507916230a9cd90a481470cb2d9b4e09b92423cfa9a928fabcd2f1f0b56fa1e83b433ceffb7d0c7b061e45ec6404681956311893c
TLSH
T1E1D0C0F933090A3DC324393380C2E0842181C20B108B41281D35FA7C0EE4CA30C994C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c4b712cf339dc8546b39d2c45f9a4aefabbe9e392a483694c72518654d988710
MD5 736cae5174d031eaa874044fb5514f68
SHA1 6078da57217cd965841b8bd25bd8390ce04e3716
SHA512 8c02c0b7095ee642982ffb1c3c10ba9c473b656044f072662cc5543901289a4337150e5ec5bf36d0753d0bd66793dfe733b553fbe75e5096663c8c31a7d9bcb3
TLSH
T1F0D0C0F93309163DC3243A3280C1E0842281C10B108B42281D35EA7C0EE4CA30CD94C0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 21ba7769baf8c18f5077bac1419ef2e1c3bd70e8ae7c358df7e5e3f4bac75e93
MD5 de62ccaaa86eb46d5a0672826e40c15f
SHA1 8557cfed2b15b4898ba5ee21a86b7f6946a4eae0
SHA512 2a7e272f106f6c4d1dea2ef9fed1bd7c72f46b1ecd0c1b521279adb4a1c3832167b363b32f14c7df25d6b04ffab20192386ea87056390c44b8b249efac1361b4
SSDEEP 3:LstlNllkll/lWj/:LsX3lEtWj
MD5 SHA1 SHA512 SSDEEP

Submit Download

35eacf35c1b78f52_0

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Code Cache\js\35eacf35c1b78f52_0
Size 256B
SHA256 4179d909c67ea7c1adc6c0aaf92122d9108c40f78b2acc3ec3d917ed35f2610f
MD5 d4355c50c928411ac80f4ad8ae404185
SHA1 ac7f5f87fc21ee808d97a92bb576d2e72fc759a3
SHA512 b05f0dc9792cc9be8e705737ae9ca78d409e10a7ed844a09f58b7503e9d973c81c042e6a59bc655adc4b2725b254d1057385bde5ac5eea3e6247f7f86976fa29
TLSH
T19DD0A7CE4C655800C598EEF2FBEA8C17578FB1D0115DE0295101E46177945187D1D75A
MD5 SHA1 SHA512 TLSH

Submit Download

3e6810944fce1d3a_0

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Code Cache\js\3e6810944fce1d3a_0
Size 255B
SHA256 847876fd5501b1e612de09c65decc58072f06c9e11f84cb4bf16b9a3aa628414
MD5 baf31cd9a084bf54b007ae740018c611
SHA1 d4a4298016ad16023b2e716551dfa703c17a2e90
SHA512 9560e726669a76cbf82ef5ffd5e74d43f847ac305d0fa1fe70e6b135a963a58c1037824f6dfda403fcdb8330c764770a22d6b600f62aefc96119bdfa84650985
TLSH
T16BD0954DD9301C40C195CDF0CDE70807470A52E0016CEC11A054D56D7140B643544734
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 ddcf76c7bff5204190185269a6f3c41af4da31ae8d14dba25c4b13b40682e439
MD5 fd4d32f22de9eb921bf817d7b99d13ee
SHA1 0777ae452b6a0374c762b1209d5b7767d4e009b1
SHA512 9401b11bcadc000b1ca7e1e3540d71cffab3bf1954fca35e21ac206f41524bf83c0abbd508ce9ac6d24b67f9c44eaa86619a2920fcc8c4f2f981f3ba2a99f8a6
TLSH
T105D0122CFA001451D356D230AAF520637D38081105F77DD2E0435574E0EF3C42710454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 8d893f2827913df29f3c4fff821fb3efdd4bd02e8bb9bb0bc5de41990bcee480
MD5 101cdd622ece1934cb4bd45211fe78f0
SHA1 7242d4748b4f4a9e2a36c72cbf38cc0ebe740588
SHA512 027c07f0ff2fb48842d30fe70d89c25f5963c4f295e3c45d73587736893301f06616596bc928bf6dfdb536727e136e3ebd52881c40ff9be85a1dd35d5fcb8b10
TLSH
T106E046EDFA804466EB8692F0A6F1D0427A7B092465F7BCD1D0838975E3EE780AB15750
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586f30.TMP

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe586f30.TMP
Size 48B
SHA256 ee1192792822a25b778c9a51015a677751a0de9c6c825887f5f4a3681440b285
MD5 3b78a9da7245766a09e4891f09b8cc5a
SHA1 cb453400560cf4698fb8643826cc08c95da34499
SHA512 a4660ce2ffa56aa9ae4eef59c8defb74702fc3fbb6ec2dd12f5f16d63eb8135be6c4c0ef699b16e1e6e751005285677e991fcda8f6351927d631bc2bd92aef4f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\History
Size 184KB
SHA256 e14d84894e3213d89feaafb430aeadcc6b3a7c8430288f0e742cddf5cf7f1af2
MD5 28d33845d89ad7e17d5efd21c2608b55
SHA1 9edf6d3d11cb81c3122e9d72fd95c6bc52ade47a
SHA512 298375fde4b840c47f814d61e8d7248222910d83c50e79e9ffef33d7bcf4c352a824adcf2833bb3d395e91f39774a105bba658353f68bc8c2e8b0684bb6e5cef
SSDEEP 96:HBF3c2gejzH+bF+UIYysX0fxQp978ZjEHt/DfLjLqL/cibgI4VgNr2jWRk/E0kV:HB/PH+bF+UI3iWGViWN3qL/eVgZQW3/V
TLSH
T1AE04FD5E5F243212CDBD913769E645B3597DF03F8B236AC66C6104B1CEE2652B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe588930.TMP

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\Network Persistent State~RFe588930.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
MD5 fa739570350b78ef09e5d8ca61d0d71f
SHA1 d4e932ca96e76aeb84d3a151d847658df6a5555e
SHA512 8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:+IEumQv8m1ccnvS6
TLSH
T1BDF2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF866A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 1005633bd5aab09572b8203c09e7537e38b7a7f57d6c575af6ec0f17c2e1916f
MD5 992311e43f65a03469551fb316b58f99
SHA1 61693dfd7090fa029f9dd0ff82fd54cb9df8dee2
SHA512 e8b43a1bf3c3d4d7d0148f92fdb2ceac2928671f09c186d6643a7374246ec1df77a7ec05945baad037347493652aad88ec04574f3cd04a65b54012bc23fb1f83
TLSH
T1BAC012A25069F47720A8076519847D459E3AE1341582A4E8969A666DA050576D613412
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 95852253216080334e98b3c37f27b9f88ccd41d5774a0f426eeac4109d1926f1
MD5 8d57578dfef30def8dc84028f0299d43
SHA1 069a440a02b6a80329d831f272eeb7b1d587cb78
SHA512 439443501df7239244a0bf8509c5234410cbd4b04e95968f335b9e72bbd6027ab82154139f00ca499ae902bc8e8080ab6ba63e505921dd601a7f7328a124f1c6
TLSH
T14BC022A2403AA0F6102C0A214880BD009E37F538018294E8839A812DE080C7A4203402
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 be5a43e4a7b26ced3387299e2ca6f73956c8f47bf150703c7ba3f4c4b6b98c5a
MD5 8fb9d5d620cbee519a80ed9e2e5ec818
SHA1 398b9d55e1815b2906f4b4807509388a1d0ddca7
SHA512 836a04da19d9f93c7b422f6a08f2f9bd4bc5136a21520567603d1093037cfc7ee6858d51f5fa32ebef078203dfc6729954ce705328baf3ba25325a55f6f086ba
SSDEEP 96:stx05c0Nyb9/ffqQ9Z8i0vhETktjm/7qx+WVHMSm+uecJy61idQjP+gzCYrKEB:stx0Kvf99Z8paOS/S+WiTy6wducYrK8
TLSH
T144E1B8065E2C697B4CC7E2197A35BB53E2FA106266D40E44FBFC8A1C48E67CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 d5246866c1de2f07c06d3a49867cb97ee7298353937a9c5c0d05db49b540e5e9
MD5 78893a3ece4aa1cdc162f09cbd881586
SHA1 db99107d91f9f1015a41bd8163fd5bee19e0f124
SHA512 4da3ae0eb5d68740d674828b72ca158ecbbcb0b4bac99268b30ecf07a202dde4aa9ca96fe7ed70f807b42327e82090d14b3825fa05386271c89f5af4f7861785
SSDEEP 96:stx05c0NKbD/ffqQ9Z8i0vhEAktcm/7qx+WVHMSm+uecJmSMk8dQjP+gfCYdtMEB:stx0KVf99Z8paLF/S+WiTmSQduEYdtM8
TLSH
T1C0E1A9075E2C697B4CC7E219BA35BB53E2FA102262D50E49EBFC861C44E67CD630750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5888c3.TMP

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Preferences~RFe5888c3.TMP
Size 6KB
SHA256 9d3d5097435a329847d449cb971d70a18c745baec8689748122aba9b8e5b7b96
MD5 1b42bf6b5ca96f9a17d76c64966b6efa
SHA1 825508618e9fde8a8c63ff10f66b22eeed81615f
SHA512 5b21e3d6de6c64f1ac560047577924995bfc5bdd5362a8aeaa63f05aabbb8afd20c19a4343484f7a40937ee76ee719d3617d6fdc7b190992e3e61d16d5b533a8
SSDEEP 96:stx05c0Nyb9/ffDZ8i0vhETktjm/7qx+WVHMSm+uecJy61idQjP+gAY+MEB:stx0KvfLZ8paOS/S+WiTy6wduOY+M8
TLSH
T1A4D197065E2C69774CC7E2197A35BB56D2FA106266D40E58BAFC8A1C08E66CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 e29ef0638c87ddba28d852fd209c4db438988b670c5e49857b8bf722c9ca6674
MD5 e30a3f6d9890d62d12c38078830878fb
SHA1 53841b80abda33be68f1bc69fe1b7a45b8af719a
SHA512 1d7874f9401d8851e5c5c2974daa1cb36d3c87c66bd8adb9282b05288dcda261636f1adb7ce09edf234048ec2901572f5c4b105b252a6b4c4b3c76716259a668
SSDEEP 96:HlPiRPlf/ROoKOpkF5d1Pik7sMaTEv9V5h5pg5+eewDxqmmEVl36YdQ:HUZWGzI9lTQ6Y+
TLSH
T111D1E6A7066DC478AF445BEBD82D3ECB99B6419F98D64C0A96E1C54C07C2EFC20DE4C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 59961ff3a4b661f90df0f8c508d07d9782375f9f4654f42b038f0cdfe9011d65
MD5 38b0ba135e0487387f91e97799f90409
SHA1 ff17d053b963000f1ff482d1183c72360fbd697b
SHA512 e806955a3c47ec95170a246efd680e7f364a4a054d7341384d2cfc83254c1fd6d47109e6e53285d0867f9b96a6cab30952523b65ac0976c5a411549ac6b9f3b3
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 b79844abd9f2e3b8af3b5ef8110115bc764942b94dcf4e0fd9ec45fb6c52b6fe
MD5 d6b93a62ec27233cbb246f13a7da1fb4
SHA1 6eb70f938fef5e0e4068d569869c42deadb62f10
SHA512 f8e5d1f4e508f0a4418df989b672e93ee9bb6e85bafb5a21eed791b596c6b267984170ef5d5ced436982555cb174191582db6a3dad0f1ab80c6b1f3cb9109c53
TLSH
T130B092806B80912BC6D80E3906D4CBE46360E2026510150288888F220EA63A52E24894
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Site Characteristics Database\LOG
Size 327B
SHA256 c935c4683cd2197d6ff581241682d20d8bc60b10abc5b4bd516ddef0c6069928
MD5 f0ff2b293ca768be257b0c385e5a3553
SHA1 aa0f2de0cde2dcfbfa7794dc8a35dd52729e90c5
SHA512 cc9b8cd66d20c55f59769513fdfa528497133b291e65516f91dde5dc119729e5687de6728c636f93e9daaa1189a0d19f8c4fa201fd98ca7c6baec0bef5385205
TLSH
T147E0262025CA86B7418744EB6A35D368C232B008FECE33311F2CFB482A0F54C7A82B02
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Sync Data\LevelDB\LOG
Size 301B
SHA256 16b196227b0f1be62976e3dbf43992470c5128003e4c5f30331822f0aacd599f
MD5 1f133e42d57e3895d1d06bacb66f6348
SHA1 89b8a9fe08b67f4d111682ac10d15a79b1c20be8
SHA512 c613f6aae91028220798d1113a320997bc993f19ee2918565842aba716d178e9a04be50571f0977d98535d26c78504e291b2f0c88a3a7dfb613b05b06a3c3f5f
TLSH
T1DAE0CD7455C586B7448185D74AB5977AC270A40C7FCE37455F0DF7082E8B11CB6B0742
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Visited Links
Size 128KB
SHA256 e88c9494743fc7b78872a461535de98b71ad2852cb6935914ffff52c498178ed
MD5 414dca3c54745cc524da25b00ff54b5c
SHA1 0d4dbddc0acbc843d90dc38f7cb2e5df7106adfd
SHA512 faf59c837b6f99a7708fa1cb32453e275a2b5b9cb9c78f2411ed6b2c30f65337318f0dfcd5609d1bdb6b6a098836e1c5795b3e708b980d11e1cd29810058284f
SSDEEP 3:ImtVuxqRV:IiVucR
TLSH
T199D304051D453574D01C1571CC0C070571D1C0F115310C71433D540344D5D014307D01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c29015ca-674a-4c91-a053-99c946798d4e.tmp

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\c29015ca-674a-4c91-a053-99c946798d4e.tmp
Size 7KB
SHA256 66dd71263b255ff090d0810838172d1138dbf818442ac7784cf96b273421e5f7
MD5 599693b8e99abca19923f16c35b7c980
SHA1 40648f972c0328c736f3a2a3a9783c0ca2bfc365
SHA512 45ed27cfa4ca2a4d2f20afcdba47109bc0259b6cda43903b8f9bf3f27352b087009a386f8831cd44e14513510d8647b20d1631114152b144cbfb772d0ccdb141
SSDEEP 96:stx05c0NKbDWffqQ9Z8i0vhEAktcm/7qx+WVHMSm+uecJmSMk8dQjP+gIOYdtMOB:stx0KEf99Z8paLF/S+WiTmSQduXYdtMC
TLSH
T1F7E197075E2C69774CC7E619BA35BB52E2FA106262C50E49EBFCCA1C05E76CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Local State
Size 1KB
SHA256 4e8f795e0942ef695bfed4502f445c6bb0abf3310bc705968ed9a67f3be20373
MD5 94a2380807a3b69b0b1fb72daf08b4ac
SHA1 d15a3a3e17cd0fd1fbab76cb7fafabcf81ab45c0
SHA512 e89b82609d8f81a61f5ad6ff6530c1c4a5f33933f12025e3e5041d7a28396f8b52914a5b4e350aefef83d7943922ba2a04f2b5506a5fa0ecfa51a8f99de0116e
TLSH
T1F2316572E49467769D515505B645BE932F23106BD2604E4862EECB1C42E7B8C612FC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Local State
Size 2KB
SHA256 8297df12e25d4cdbdd42c740b95395d23cfb7457877f7a4f52dccd371dab4b2f
MD5 a49c4c5478f74974247479fe459f4bf8
SHA1 73d2f7f5699c535e8a53d10d703bf04d63266d75
SHA512 3ef489618523237bcbb5c2e3dca3e1d79018bf1ae7fa76d42fc0cb46fd015036e947abd35f01f59761cf065eb22a439d542ecb0db8bc39a7eaaf151c58003760
TLSH
T17D51C733B858A67789E38604B9497F236B375166DA612F90A6FD4B0C41DBB5C2307C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Local State
Size 3KB
SHA256 1862139f28579e3359575ce6881fc9768fe1bee87f5685b0ebc23deb1ae5fd0e
MD5 4e086bbe2422649d0a27887d3988ee40
SHA1 c23e4c2e82287fa857f4537f696be7b068e35b25
SHA512 c275443811fae5d1068b97827895af00ea420732600341019e1bcf2ce45e971377453070c72ec252093228825ccbb55cb44b417c864ce4e3df7844b4e149bf12
TLSH
T1AA71A532A9A8E53B4DE29904B9853F1277664137E5903F99DAFC0F0C01D77982302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Local State
Size 16KB
SHA256 adf10010eff7a91e4d2ce6278d4a9d3adb8272c68131b3b2ef51d633b88e1f5e
MD5 d3324132f6e70ae2ebd18ad14e72ad05
SHA1 9f9ba197c00b040afdaaca4515ed25ef606e6759
SHA512 50f8c90bf56c7f039a81ab73a6b4b28a389f4966719927455852cd01b658b6d94e8c63dc88761e0bc6c0872257b7a3c8c1be5988719ef0eda753675d6ca6fd86
SSDEEP 384:z6+aQikB+z/xvxjg/qhEwNbizK0fyt9zG:R/UxvxjgC+7/fytFG
TLSH
T18F729D2B546C6E3395F2A5047A5D0B8BEBB688B290C16EB84EFD5F0D06DB3D81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Local State
Size 17KB
SHA256 30ba8b6770d6e41bcabfed6eaa8b9dda7b799a94c527b778f6aea2c6248f4463
MD5 61c74236730477909d1360d0dcd28b33
SHA1 eb9863ea4c1139563bf20e3394a6cbd9a4200e8d
SHA512 df3bc55ada375ed513f9b48f1608fe1362825e247310cfe58ecd7f59be5d9b0f71bb4b70523ce0fc2cd6e8ccadb31a79032566cf3a87d7ce48b33a8ba4db4ec3
SSDEEP 384:zX+aQikB+z/xvxjg/qhEj3NbCmKV1yeukDzH9zN:6/UxvxjgC+jle1yqFN
TLSH
T1AC828D2B646DAD6354F3A5047B2D0B8BBBF5887294C16EB84AFD5F0906873D81347C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Local State
Size 16KB
SHA256 b469ed63e9da708c208afe197a6ebd31d93608b530911b5b820b82d7cf7514b7
MD5 777a3e7dc6266932185b93c979e50599
SHA1 70497d16620913e0412dfc4d6a9cb132d0c84e21
SHA512 2a90984bec5aaf27e2bc9771c763c9b76c49a3b49b111c132c3b2db5f20a2fc3b03ca2db129d5ed278c8644241974507fa4dd9f53c38bce04900c6ed48678b8c
SSDEEP 384:zX+aQikB+z/xvxjg/qhEj3Nbi3K0+yt9zG:a/UxvxjgC+ju/+ytFG
TLSH
T183729D2B546CAE3394F3A5047A591B9FEBB6847291C16EB84EFD5F0D06873D81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5818d2.TMP

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Local State~RFe5818d2.TMP
Size 1KB
SHA256 903ada2a150e6b1e336c4d617836cc75a74d3e8083732755ed58a864e41848d8
MD5 0bd1bc2c2736d1f1b030c1f4868e5ae7
SHA1 cbb8f780ac5443566a648f1e4f7736e09f5c72e5
SHA512 7524e09c24b2876b3a34bc60a26dbeb0c347e8e6d072cdb27c0d2e72c550d8e06c1d2271ebe6e28473b9a4ba5b3306eeed46a07cb47e29b39697aa42ec2b6072
TLSH
T14C214073D4D8A676A9514514F642FE973E22517F92209F0CA2EE871842EBA9C522FC33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\ShaderCache\index
Size 256KB
SHA256 3f4f93cfdf96f5ce36ddf67e35929aa35e5088971422b5e09cb3105812c57bf3
MD5 e768b2e31aac5b54a6e1f9d7dbb053d0
SHA1 9595f4bc9c44a17ef7d320ad23ce4ddeacab550d
SHA512 36dd555f2854ed70a7bea14d444ea575039aea042d2d3a4154b770dd020a80280694349c63a0b973b84bc1e82f8a77a191e54087c90a4a79011aa0dce729278e
SSDEEP 3:LsOllllklkXlsj/:LsUlP8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

fastclient.log

Path C:\Users\Admin\AppData\Roaming\FastClient\logs\fastclient.log
Size 10KB
SHA256 8efc84a9226dcc09f4a9ab1e1e3b83292b8b72cb374ebf569f3980d9dd7647b4
MD5 8cc4feb3972237677c7298fe6215fddc
SHA1 4ba56bfc05976ac5e5895517d06ce467248ed80f
SHA512 e79b4fb21d0d95b6aee200377f5912f99e5fa68f4ba3cf08c076246ea51fc85ca9a5b7601080a0aa0c4bb680e940334eff24c3a73510669db12d9f596ba47db8
SSDEEP 192:0Oqz2Mp2KsZSIw1gCZg8zKoq2xu+TidEsIpmfNt:0Oqz2Mp2xZSP1zZFKotxu+OdEsam1t
TLSH
T172321D0E07B56936625ABA46F24EBCB0D272B364478D3E125764071C1B94A7F2DBCF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing\jdk-25.0.4+7\bin\java.exe
Size 49KB
SHA256 1dfe0b08636bc74b56db5e246f038cfe67c18f567053373fa601d310f29ed9da
MD5 f0be736a482b66d05f9a285c544645e5
SHA1 a49476ff972848b543972406349296786ff8ef0f
SHA512 2cc540f808b9b03db31de4f1fde327bde158b00cbd8eb2d845e438ab3a8d9e8cec66c6739c6f171972e4314186a2f03a50bc3c55c2007d46a8c1cfcf8888a317
SSDEEP 768:jTZJFZM5R2TyJ5R3s8D/bkt5Ruz3Vb3NU5TYiDLk5uIvnlb:R5M5RdJ5R3sozkt5RA3NU5T7lIvlb
TLSH
T134337C47AA182C81F42F84B158A7752751B4BD032BC173EBBDCAB21E0D71391A9176EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing\jdk-25.0.4+7\legal\java.logging\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing\jdk-25.0.4+7\legal\java.logging\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing\jdk-25.0.4+7\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\FastClient\settings.json
Size 452B
SHA256 327ef52661a43ef15c3573113bdc32ed8b866dc4e3acfe264236dba33df2004a
MD5 bccfee4fd09d60d26fdb7017c8613776
SHA1 ee0b31f68fde6466fa5b6b83d44606eb5c357f28
SHA512 8fedd9906d6fad5c6fbc0b0f83664bf6e638d4d031cb16d7900be77f4c09a5b06fa94a50f19c6f6a7eb781d174e4d142078a9e1aeeb4106b60c0eba5a4ccd4f1
TLSH
T19FF02725D5A092BC54E09139DD6DD6130AA14C66018C3D28C963454C690DB3330FADE6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-562-0x000002E19E530000-0x000002E19E531000-memory.dmp

Download

memory/1100-92-0x00007FFB3BF80000-0x00007FFB3BF81000-memory.dmp

Download

memory/1100-85-0x00007FFB3B700000-0x00007FFB3B701000-memory.dmp

Download

memory/2772-574-0x000001E2D93D0000-0x000001E2D93D1000-memory.dmp

Download

memory/3664-138-0x00007FFB3C0E0000-0x00007FFB3C0E1000-memory.dmp

Download

memory/3832-550-0x0000023AA6300000-0x0000023AA6301000-memory.dmp

Download

memory/5060-25-0x00007FFB3C0E0000-0x00007FFB3C0E1000-memory.dmp

Download

memory/5496-1078-0x000001AD72420000-0x000001AD72442000-memory.dmp

Download

memory/5496-1081-0x000001AD72450000-0x000001AD7259E000-memory.dmp

Download