ratonrat | 16f236ea5d43e61b21d1032fe9e76d8c7ce5c8642cecdf5466d7c8f8047fee90

Analysis

user interaction
yes
max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fastclients.exe
Size 38.1MB
Sample261029-2r8mysty3n
SHA256 16f236ea5d43e61b21d1032fe9e76d8c7ce5c8642cecdf5466d7c8f8047fee90
MD5 54b1a9ca476c12a6b0c698defe83569f
SHA1 85675756ed065c9181ed360302e84767281c51a7
SHA512 12caab3eaa07db1b0c5bb00599a3d45e4238cc3e4e4b5c1c2246fd719aba2bbc3432ac0602bef10d32b8cff866d15f0eeb9f2a3db942559a155786f86627661c
SSDEEP 786432:DIJOEaXyqPZPQTcm59n/cZNmab9ntTncgelw73LzJ6S8LCvOi2Yq:DYbaiqiJ/yYa55clw7XJnECvOi2Yq
TLSH
T1EA97332832E5CA1CE17F0FB0E5B2616A5A31FD0BDC61FF1971A2756D04B6F84A721A13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence spyware stealer trojan

Malware Config

Extracted

Family

ratonrat

Version

Professional

Louisdu30-36065.portmap.host:36065

Mutex

ulNB9l5BESCZ0leIG9aTG5a

Attributes

assist
true
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
0
hide_file
true
open_website
false
password
t.me/junk_code
process_critical
false
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
true
vm
true
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/2832-3-0x00000000008C0000-0x0000000002ED6000-memory.dmp	family_ratonrat
behavioral2/files/0x000d00000001c4a3-8.dat	family_ratonrat
behavioral2/memory/4880-11-0x0000021267060000-0x00000212672D6000-memory.dmp	family_ratonrat

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	fastclient.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1404	powershell.exe
1404	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	fastclient.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fastclient.exe

Executes dropped EXE 8 IoCs

pid	Process
4880	fastclient.exe
6104	FastClient-Setup.exe
1776	fastclient.exe
5860	fastclient.exe
2896	FastClient.exe
2404	FastClient.exe
6060	java.exe
4840	java.exe

Loads dropped DLL 22 IoCs

pid	Process
6104	FastClient-Setup.exe
6104	FastClient-Setup.exe
6104	FastClient-Setup.exe
6104	FastClient-Setup.exe
6104	FastClient-Setup.exe
6104	FastClient-Setup.exe
6060	java.exe
6060	java.exe
6060	java.exe
6060	java.exe
6060	java.exe
6060	java.exe
6060	java.exe
4840	java.exe
4840	java.exe
4840	java.exe
4840	java.exe
4840	java.exe
4840	java.exe
4840	java.exe
4840	java.exe
4840	java.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FastClient = "C:\\Users\\Admin\\AppData\\Local\\FastClient\\FastClient.exe "	FastClient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FastClient.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	fastclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	fastclient.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1737819790\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2039498854\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2039498854\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2039498854\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_646354850\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_646354850\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_646354850\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_646354850\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1737819790\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1737819790\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1737819790\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_646354850\manifest.json	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5360	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4164	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	FastClient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	FastClient.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fastclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fastclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FastClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FastClient.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FastClient-Setup.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5900	timeout.exe
5020	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	FastClient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	FastClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	FastClient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	FastClient.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1776	fastclient.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
6104	FastClient-Setup.exe
6104	FastClient-Setup.exe
2896	FastClient.exe
2896	FastClient.exe
5360	powershell.exe
5360	powershell.exe
5360	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5652	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	fastclient.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeIncreaseQuotaPrivilege	1404	powershell.exe
Token: SeSecurityPrivilege	1404	powershell.exe
Token: SeTakeOwnershipPrivilege	1404	powershell.exe
Token: SeLoadDriverPrivilege	1404	powershell.exe
Token: SeSystemProfilePrivilege	1404	powershell.exe
Token: SeSystemtimePrivilege	1404	powershell.exe
Token: SeProfSingleProcessPrivilege	1404	powershell.exe
Token: SeIncBasePriorityPrivilege	1404	powershell.exe
Token: SeCreatePagefilePrivilege	1404	powershell.exe
Token: SeBackupPrivilege	1404	powershell.exe
Token: SeRestorePrivilege	1404	powershell.exe
Token: SeShutdownPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeSystemEnvironmentPrivilege	1404	powershell.exe
Token: SeRemoteShutdownPrivilege	1404	powershell.exe
Token: SeUndockPrivilege	1404	powershell.exe
Token: SeManageVolumePrivilege	1404	powershell.exe
Token: 33	1404	powershell.exe
Token: 34	1404	powershell.exe
Token: 35	1404	powershell.exe
Token: 36	1404	powershell.exe
Token: SeImpersonatePrivilege	6104	FastClient-Setup.exe
Token: SeImpersonatePrivilege	6104	FastClient-Setup.exe
Token: SeDebugPrivilege	5360	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	FastClient.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2896	FastClient.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4880	2832	fastclients.exe	89
PID 2832 wrote to memory of 6104	2832	fastclients.exe	90
PID 4880 wrote to memory of 4164	4880	fastclient.exe	91
PID 4164 wrote to memory of 3828	4164	cmd.exe	93
PID 4164 wrote to memory of 5900	4164	cmd.exe	94
PID 4164 wrote to memory of 1776	4164	cmd.exe	95
PID 4164 wrote to memory of 5020	4164	cmd.exe	96
PID 1776 wrote to memory of 1404	1776	fastclient.exe	98
PID 1776 wrote to memory of 4960	1776	fastclient.exe	101
PID 2896 wrote to memory of 5652	2896	FastClient.exe	108
PID 5652 wrote to memory of 4596	5652	msedgewebview2.exe	109
PID 5652 wrote to memory of 4700	5652	msedgewebview2.exe	111
PID 5652 wrote to memory of 4700	5652	msedgewebview2.exe	111
PID 5652 wrote to memory of 4700	5652	msedgewebview2.exe	111
PID 5652 wrote to memory of 4700	5652	msedgewebview2.exe	111
PID 5652 wrote to memory of 4776	5652	msedgewebview2.exe	112
PID 5652 wrote to memory of 4192	5652	msedgewebview2.exe	113
PID 5652 wrote to memory of 4192	5652	msedgewebview2.exe	113
PID 5652 wrote to memory of 4192	5652	msedgewebview2.exe	113
PID 5652 wrote to memory of 1572	5652	msedgewebview2.exe	114
PID 5652 wrote to memory of 1572	5652	msedgewebview2.exe	114
PID 5652 wrote to memory of 1572	5652	msedgewebview2.exe	114
PID 5652 wrote to memory of 1572	5652	msedgewebview2.exe	114
PID 5652 wrote to memory of 1572	5652	msedgewebview2.exe	114
PID 2896 wrote to memory of 5040	2896	FastClient.exe	117
PID 2896 wrote to memory of 2104	2896	FastClient.exe	119
PID 2896 wrote to memory of 1548	2896	FastClient.exe	121
PID 2896 wrote to memory of 5360	2896	FastClient.exe	123
PID 2896 wrote to memory of 6060	2896	FastClient.exe	125
PID 2896 wrote to memory of 4840	2896	FastClient.exe	127
PID 5652 wrote to memory of 4336	5652	msedgewebview2.exe	131
PID 5652 wrote to memory of 4336	5652	msedgewebview2.exe	131
PID 5652 wrote to memory of 4336	5652	msedgewebview2.exe	131
PID 5652 wrote to memory of 4936	5652	msedgewebview2.exe	132
PID 5652 wrote to memory of 4936	5652	msedgewebview2.exe	132
PID 5652 wrote to memory of 4936	5652	msedgewebview2.exe	132
PID 5652 wrote to memory of 1336	5652	msedgewebview2.exe	133
PID 5652 wrote to memory of 1336	5652	msedgewebview2.exe	133
PID 5652 wrote to memory of 1336	5652	msedgewebview2.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fastclients.exe
"C:\Users\Admin\AppData\Local\Temp\fastclients.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Roaming\RuntimeCache\e27b1135\fastclient.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\e27b1135\fastclient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_HLyglqk1CAAk2zeCtEJuc0B2nOiokm.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3828
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5900
  - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\fastclient.exe
      "C:\Users\Admin\AppData\Roaming\PlatformRuntime\fastclient.exe"
      4⤵
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Checks BIOS information in registry
      Executes dropped EXE
      Maps connected drives based on registry
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\fastclient.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fastclient" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\fastclient.exe\"" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4960
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5020
- C:\Users\Admin\AppData\Roaming\RuntimeCache\e27b1135\FastClient-Setup.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\e27b1135\FastClient-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6104
- - C:\Users\Admin\AppData\Local\FastClient\FastClient.exe
    "C:\Users\Admin\AppData\Local\FastClient\FastClient.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies trusted root certificate store through registry
    - Reads the TCP/IP host and domain name from the registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FastClient.exe --webview-exe-version=4.0.17 --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2896.3464.14927697218297729946 /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5652
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView /prefetch:4 /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x1c4,0x7ffbeedf5fd8,0x7ffbeedf5fe4,0x7ffbeedf5ff0
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=4.0.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,5335431257046706914,4959883239374037441,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557
        5⤵
        
        PID:4700
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=4.0.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2176 --field-trial-handle=1760,i,5335431257046706914,4959883239374037441,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557
        5⤵
        
        PID:4776
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=4.0.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=1760,i,5335431257046706914,4959883239374037441,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557
        5⤵
        
        PID:4192
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=4.0.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3524 --field-trial-handle=1760,i,5335431257046706914,4959883239374037441,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557 /prefetch:1
        5⤵
        
        PID:1572
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=4.0.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1760,i,5335431257046706914,4959883239374037441,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557
        5⤵
        
        PID:4336
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=4.0.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1760,i,5335431257046706914,4959883239374037441,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557
        5⤵
        
        PID:4936
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView" --webview-exe-name=FastClient.exe --webview-exe-version=4.0.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4588 --field-trial-handle=1760,i,5335431257046706914,4959883239374037441,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7cacd2fcd29480ce031c4c3b6cfc05724b9c0557
        5⤵
        
        PID:1336
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      "java" -version
      4⤵
      PID:5040
  - - C:\Program Files\Java\jdk-1.8\bin\java.exe
      "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
      4⤵
      PID:2104
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
      4⤵
      PID:1548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -Command "Get-ChildItem -LiteralPath 'C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI' -Recurse -File | Unblock-File -ErrorAction SilentlyContinue"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5360
  - - C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\java.exe
      "C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\java.exe" -version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:6060
  - - C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\java.exe
      "C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\java.exe" --list-modules
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:4840

C:\Users\Admin\AppData\Roaming\PlatformRuntime\fastclient.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\fastclient.exe"
1⤵
- Executes dropped EXE
PID:5860

C:\Users\Admin\AppData\Local\FastClient\FastClient.exe
C:\Users\Admin\AppData\Local\FastClient\FastClient.exe
1⤵
- Executes dropped EXE
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FastClient.exe

Path C:\Users\Admin\AppData\Local\FastClient\FastClient.exe
Size 46.7MB
SHA256 0b63dc9e01ec482f8c20dbdb2db445254f10afc5cd1b468d88429d36671b4b3d
MD5 13d8c1511f3d1ca0e338a6dffda3e93a
SHA1 cb95f09bd2fa9018bdfac90fc2bbe1719f1454b6
SHA512 b4d03960f6c34c8236ec1d2c3a06b490fced9a7ff951eb095ebaf791f32c8f16f53a04480daba7e8197c7153d5465a3dc8187d91453aa61adba756d1a0d43924
SSDEEP 786432:bJGAMbAecUUhcdGgbp3vjsaF9uCZwxIod/gVTpCaQtw:1GHblChcdHF3vQQ9uFxRdYVTpCa4w
TLSH
T103B7DF53F65250D9C0AAC174935A9233FB71788A4B343AFF67D08B212E65BE06B3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wgw2thnf.ln0.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wgw2thnf.ln0.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk8322.tmp\System.dll
Size 29KB
SHA256 2a7b5d1cab96a5280b0694d0ed54510129626a1ba36a51bd34d546972b7d18b8
MD5 26c8a92678f1b970ac2a700bb844c309
SHA1 c821a5980c31b0b35f1505cde836d6769f45e3a3
SHA512 fba6e371853fd6c27097eb7cce7ffc59d71e4f0a9b5e55de06472d094b70c44a409bd82f39d9a27a814e826ab8468c59e947401a3c3ead1f057cbac236588860
SSDEEP 384:icchls/EvE2XYBVtQQA+S4n+7g6ZxlU7RfYkvIZMIwwH3Y9pyWediASIo:dmHckOVih+S/Fxq7v4H3YCoASIo
TLSH
T10ED22829FB07C8B2D1B655B049DFFB77482A790547225EABEF168D08BC33B139A19107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsk8322.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk8322.tmp\nsDialogs.dll
Size 14KB
SHA256 78f9594721361fd3415b8c5194f9c9b87c580d6a70ddb95f2c4743c61ce68ebe
MD5 8f45e78d9d02ca8a9f9c274a8bfe2a57
SHA1 9b3838e1d2d4fbc1c84e1252747e96aa1b223d83
SHA512 125f1bcf833e0c233ebee552c164d9726769f06e5163467888abea08048fdae60a94b903ef97ba82ca9cf684f3c027d9605d54e9efe794df3e452f9b20e4ca96
SSDEEP 384:jqWL5JCYXh2OPxv9OIR6oYkvLl5gS+BX9jN:jqXG2cLR9vPgFNjN
TLSH
T13C52C50DFB0B54F6D572D934958BFB3F8A9DA415C62B4E06EF160B0CB9922B1680E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk8322.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20c482c8-f0e9-4d56-8772-b629acc642c0.tmp

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\20c482c8-f0e9-4d56-8772-b629acc642c0.tmp
Size 2KB
SHA256 85ec6bc929f36d455e838b788719ebb0ed07bbe1c479424e0e5e956ad6e8e614
MD5 c4c4d15e14f070daeb2a9a6f5440d6c4
SHA1 2089a5862fd07e8e97983986e24babaa23d82138
SHA512 c64cf669ef59b6e9561ff8a66e7e312800f99fbc3df517c7146249e2a295e1043f4d3be48375e59153af0922920f8b753d53a9485a6dae290a9516f77f451a7a
TLSH
T197517433BC20BA7B99E29694B80B2F23DB39A162EA522F11DADC0B1C01D355D1342C77
MD5 SHA1 SHA512 TLSH

Submit Download

2233efcb-584a-4c64-b224-9738501b863d.tmp

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\2233efcb-584a-4c64-b224-9738501b863d.tmp
Size 15KB
SHA256 25f33a1c1ad01261f3fac2b25699c87e447edab74c1ebd8026beb2c379ba63d3
MD5 fe8d0653c8dcbc945464b0ad17de93ea
SHA1 9970da874187405572fdafe47570afb5ed41bff1
SHA512 0fc15b6eed826bd9dd659e6c5e09c936cc6fdb1caf4676e20a182a12f400c81d3338d9754ce256bdaf96b0bd300214fa619cada8a1c612ed0dbbd56ef9e3b1cd
SSDEEP 384:Q+OBqImmJvGBLx3NaFMJFFNBSmloU8Ug6ro:JcvGtlNzH8qc
TLSH
T13C72AE6B29766E3728FBC549BA4B2B47CB756253C0D17AD6CCEC8F0F01AB0901352852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d20e722-a725-4633-bc7b-bd5a29891b4d.tmp

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\5d20e722-a725-4633-bc7b-bd5a29891b4d.tmp
Size 3KB
SHA256 57e9a42cf52e9c3860919c4bd4596c464620eaf8fad1a63f087b1b4d04ef969e
MD5 a0bbef184f8960bbbd350922e33bfd14
SHA1 15cc5ceade33d74cf94c0b573c10904af541963f
SHA512 094b64d2b216061ab05151c7fd27d0a6913ae815996da2b2a9dd85ac6f967ad53149bdf0f4b8d4b07c4a8264d6f58c0feda59c3f779b2d81e88a620c27eb0a0f
TLSH
T12D616337A974A93B8EE2DA44B84B2F16E7659123E5813FA5DAEC0F1D01D72981342C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2f1aecc7ac2ba4e18b6abcad347fe40d59084d5924a26734516df57cfdb3010e
MD5 36fd6758e56393c9e40529b98d1088bf
SHA1 9ac2964a5d3874f3169ff89638c06495eb367799
SHA512 998e352530f75291660f6a12360a0a93ac0cb6454a38d3a9e14595e3338fb0bf06d914cc8febe752b5ea53de6709ec4a7044ceea8d5115836a3fb8653310b233
TLSH
T16CD00430F7404000C05411371414C1371544443041430551C11401D7CF715441411100
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c3d5a5b87f682df0a969d4f25ab010047cf05745bad730331c162012c8082701
MD5 d5831a872c125b17663869aab0e18f36
SHA1 1b624149cb5d4382d06ed57804fda4ba4e13fdbe
SHA512 1c143e0db87d842e8ace7fa8c8de92c1b97636f180b45aebc3abbb518dc3d5fa637598cb8923eb273fd632290577c7c6036ee5e3e38a48cdd4267f1fffa8b30f
TLSH
T1CFD0123277414134C02021331402A11E1840C12B81464041D42C86AF9F244941D12441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 432B
SHA256 29c2591881f19adf657cd92ff193690f9162a813a37de23a8108f9160f5a5bf2
MD5 df0b7a4f6bd040b5b464b98aada9db08
SHA1 8e2f97fba7eb85a89e4139264401936fa6a45d4d
SHA512 ecb118f9b6e278cae0d1b87c55d9eff0f71ff0fab78e97766f2a740c4f556cd979153aeab142c91db22c7f8a7eb4c905aba133b528293fc41cfa33733592a8b3
TLSH
T1DAE02B5804CE34C5D3C11931E1C24044FBB40B03D1F7CED2103F4175494F390BC40115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6d6d13e0c743eac6e996e5a036d75d106b4428996b52ee76b1f18686e71ae213
MD5 39c2073c72c5beaf11a44d9ac8d9e0f0
SHA1 b2ddd5d5516458120082d36396673f1637df2ebd
SHA512 42b7b7f7dae935162182e396a21692267ed7f7b1e4473aaafdf1d8bf920f634cb2e69b5a330ee0e5cd0eb073f6d03a3de7f1ba8eb478c027c943a396f55de639
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0320a881-fc56-449c-8a84-e47180f22ff2.tmp

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\0320a881-fc56-449c-8a84-e47180f22ff2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fa14b96f-5014-48f1-9df8-8d317921c125.tmp

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Default\fa14b96f-5014-48f1-9df8-8d317921c125.tmp
Size 6KB
SHA256 7f8020f6870f414c7e04ba8f484d36670c6bfd8efa8d78101845b97b63ef9563
MD5 0ea79d9438385aaaba4f80afb8c4de0a
SHA1 73500553b6db0d1f66c6ccfe0ed307295a7d6f2e
SHA512 6c85ad225d67497cc5df6590bfd98e735f0eacda07f8509e7115dc1c0e5c1f06e308c1e8801e8303d595b77e2baa8aa1c8d8c76913caff36d861a9b8e07e355d
SSDEEP 96:stk/dF7O9b9zkCo5h16Z0Zs7/x+6MhmuecJ/Cr9j0jeyK+gIYXWF28XM1C7K:stoHudonZsV+Fd/Cr94jWOFG6K
TLSH
T17DD1A5025E24797B4CC6E548FA3ABE47E2F9607261D11E59EBFC852C04EB6DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fastclient.launcher\EBWebView\Local State
Size 1KB
SHA256 96566ed5c049fc9f602d4242bd18619e6f3d7b8f0262934b3d0206e307bcc118
MD5 f67d4ce1f6f362b0836ba4256b3fe8a4
SHA1 d69b56d7a5f04f2bc9ab7330681e02ebd5d5e916
SHA512 03801a85a41bf1c846a0746c050ca4dc37cab67358910454143c1bf4146d47eaf5bb3821711d8103d1db4db8e50f5cdb0fa65cc14f116db290be55e3a4154483
TLSH
T13B2142B3E8606E36EDC5B29660176F17AF246177C2018E00A6DD4B2D02E309D5667C33
MD5 SHA1 SHA512 TLSH

Submit Download

accounts.json

Path C:\Users\Admin\AppData\Roaming\FastClient\accounts.json
Size 20B
SHA256 123ab93cdcd5a3bf6571ba42ee9f379e99236e5c9ad51a3f4f48d09b81092df1
MD5 eeb73d4a527fff8663c3838cadf8cdb4
SHA1 0e8025806130cbf3612824959d42b20231e7f067
SHA512 1301a17cb3ef4e54e38aee752eea47eb1141944d321c1fc037408af6f4d7c3178acebbac15891aa89223f16397bc9e95a8e48d30ffb4eb2069099070017a2a08
MD5 SHA1 SHA512

Submit Download

operation-results.json

Path C:\Users\Admin\AppData\Roaming\FastClient\logs\operation-results.json
Size 370B
SHA256 5c58e0107d17ff07f597eedfc56b9a56519f0535628ee559f473665108d0ee96
MD5 f194d262756c55a7ce403e87cff403cc
SHA1 372fba9b3bcf5ef2ce8409f8021b3b8673ea14be
SHA512 240a7002686956b144e2b146cb7bf681b5a5c55650eb4e9a458da0216a0d3ca0ce6b8394140ba73359f54e9a0e1d02091753a2a8a5209372eb892f13ca801885
TLSH
T18BE0C0813B16947A5B52034141FCA50C13B04252C1C35919FE9E170CBE5C989376632E
MD5 SHA1 SHA512 TLSH

Submit Download

profiles.json

Path C:\Users\Admin\AppData\Roaming\FastClient\profiles.json
Size 47B
SHA256 1d97619301f8469b9ad978f610e9125cda36048d6804866a1ceb3a29f9f79736
MD5 6c75bdf5532664594fcacf5256524219
SHA1 97087611e977ae28be3ece64b927c986353209cc
SHA512 70ac5371c12d89ff7c74ccc439778cc0fa5b28dce2255a0bf32f8b3626a068c75c995897f5c6eada748faa8711120b0fc97dce5dd43416c6c79fbd69f34bd964
MD5 SHA1 SHA512

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\java.dll
Size 114KB
SHA256 759146dec3f93dcfc34bc32532521f84773d93021ff02df60d862b390684cd2a
MD5 2cd8b5cc45a1f94b5e99f59631de90d9
SHA1 f3cac7ad4a329e581ecdad131756981cfd9dc7b5
SHA512 e1f5f2817810720beb8e1747d35c2eaa9b72f39734a66356e14d2b8a338cca38a7e5e74df3979b8c1ba25d16f0973581eeed1350808bc105427573a25de26172
SSDEEP 3072:nHzYzLxBTGHz1slnWQEpMSyNGHi1HrZQdSNE3uIVUWdmzHYMvD:HzYzLxBsvYxzDD
TLSH
T1E4B35C1B77168085F45EAABC8066990BD373B4B01341E34F13A9CA8E5F8F7B63D09791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\java.exe
Size 49KB
SHA256 f961fb8db73c7c546821bc6d30fdaa8ce2458da460a5e75e2c39189cd107e6ba
MD5 a273f20760bd53a65831ed14d1a659de
SHA1 d8ea7d3f320f02a4f123082e123b79db47daac53
SHA512 e9ff951f6e4a805fb835b6e1dbd18d4645377ab0ed04ce873085a969ab67c8b5a3338b6041b28326c6dcafdf29d2db78a784766dc06c5cfbca472950adcb7e12
SSDEEP 768:jTZAFZM5R2TyJ5R3s8D/bkt5Ruz3Vb3QAK58YiDL9rA+vIvP:RmM5RdJ5R3sozkt5RA3QAK587PIvP
TLSH
T1D3336D47AA182C81F51B84F148A7352B55B4BD032BD163EBBDC6B20E0D71391A9276DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\jimage.dll
Size 33KB
SHA256 82a1d576f2331ba92fb929fbea6dabb2d940caedf7e8921dffbf3c414ffe64cd
MD5 9ec45caad3e2d4dcc645be354b9b7768
SHA1 25cdf096ad7ee3c8314ba29d161082e89e8000e0
SHA512 4810ab7761944bae39f60bda1da7fc924c97b2e6cefccdd710a8126797a97976f94db926e14f68dee564327bd2cf8be6901aeb6b80c4b0ac08b10102bd61e076
SSDEEP 768:kFHCnFDCIp/Uvh7UtSHYiDL9rA+vIvFekF:DOWs5ItG7PIvF1F
TLSH
T191F28D5AE6840C58E92BE538C8AB9A1FE7F5F5525F50C3CB1721815E0F333813B69792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\jli.dll
Size 82KB
SHA256 f71990b3282f8634b223ae546dee8c4fcc4b75736f1639b99908a84aaf8750b5
MD5 120daf9b0fb6b67c6643c1fb18126ed5
SHA1 3a2a834fd2fad0ed69b0757a447c973e10f3299d
SHA512 8113766e5b0628a69052482691fdcfdc4e8129b457f8d0824b27349e75a69b779bc2e936be11f02a5c9b092bca62bc2c29e85f22900837f852fc6a55bb2bd296
SSDEEP 1536:9koxO38mh+pYZochEJgsQBIOFSNOUK4nW7PIvJ:uo038S+KZoKEMFScUK4WMvJ
TLSH
T1E8839E9A539011E4EEB79178D9B4560FC3F2B0563731838F13AC85A90FB36A13E19BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\server\classes.jsa
Size 15.2MB
SHA256 4976b1dabb14668b345ed7513f767de0c45ab8d1c38b8e9b460fd24da731da74
MD5 60a86e8621b0073f3a358447db790437
SHA1 680cd5b61377d1283616dfed2966e38b1b82ee39
SHA512 0cffc7b6cf493c578144cedbaa22278268902b5bdfe9a38dc2b83045291f886feb5dd977d7b9b5922ae6d962f74ff825661a34731253ab6fbfaaeaaef8db4250
SSDEEP 49152:SMR2ieKGGsALdAQ4FXN7OxIx5QywxGg1EB4tKxyqDzrUWtwjrKLvl/iYmKw5Wo9D:si5PD8p7PWmwnou7hi/hIO
TLSH
T15CF6E917FA8449A3DD3D863598E5C3942732E468AB8787033DC4A37EDDD31CA4E668C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\server\jvm.dll
Size 14.8MB
SHA256 3db3f5cf8ea1a5798783731fb9ad36d8b425b9d69d676ef07d0b40d709cbde1c
MD5 af330fdfc9e0f12d7721c8d5833b18d3
SHA1 b41c739ae2364acb1eeef6dc647ee96ae1f9da63
SHA512 40dabb58b73667dbcf652048870283e900648db580649e92400ac1a80a542d11335cfeb59039a94dbf98f24d50f3eaf3130c699bcdd3c9f560d01a278caf4ccd
SSDEEP 393216:yEvTHZQ/Ddihmqlv19yinoynPo8PKToyz+1TEmmTD1hj5s2whcJOPtPbwoLp39Lx:zzKuxr
TLSH
T1DEF66B07B77800A8E167C0B8C72B991BCBF2B8544770A7CF55B8566E1F13BE2653A325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\vcruntime140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\legal\java.instrument\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\legal\java.instrument\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\legal\java.instrument\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\FastClient\runtimes\java-25.installing-mvmzjI\jdk-25.0.5+8\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

FastClient-Setup.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\e27b1135\FastClient-Setup.exe
Size 35.6MB
SHA256 ef987ffd8cf7a07730ffbb04019592807c57d1fc6daeb6ca8e7ba18561b01868
MD5 e6a0a86f7ae4a3e1c224d4eefca4837b
SHA1 d13c3b4b0f47259e8534bc25be9ba81741e338ef
SHA512 8cdf3bcd04f286ba4f0153308e36aad8d6a91cad25cacf45b7300956e65c5c05b3f732597036ae245e35d9338ce94781d1c4f6ffd6df16babf5737394fb9a64c
SSDEEP 786432:nEaXyqPZPQTcm59n/cZNmab9ntTncgelw73LzJ6S8LCvOi2Yq:EaiqiJ/yYa55clw7XJnECvOi2Yq
TLSH
T1B68733247091BDF9C9126D70EA9B72BE5C29274EDC717F12B23355212CE79C892EF806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fastclient.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\e27b1135\fastclient.exe
Size 2.4MB
SHA256 f331345f57ef7c09f37be975c95ad216ea2aeb2a908fc2e65350ea212f3b89ab
MD5 8407e80f236dc8295fd3ba6aee53ac71
SHA1 970a07d122675c21451c34915ab11b240511cc52
SHA512 22ab99634a69c279dd5a91c9cbdf6177a0bfe41bb5d47d164c7966f15262fc02b4b5552c1ee4bacda6d82d65417c8514f3bb0a4327a46df5bef02ae5c90ba8e3
SSDEEP 49152:lugVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4CKX:0gVUuHjkDGjYQDGuRxzew
TLSH
T1B8C5016833F9860CF1BF0BF4A4B149664B71FC079C96D76D18A579EE04B6F44AA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_HLyglqk1CAAk2zeCtEJuc0B2nOiokm.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_HLyglqk1CAAk2zeCtEJuc0B2nOiokm.bat
Size 599B
SHA256 48cbd56351450d91b0704da03e38e8bee354d98b2607a0835b8df5071a482894
MD5 d9eda1367b9bf0664572138d6de58c58
SHA1 6458648863f8642785798dfb6d42dffa86b9a2d7
SHA512 e0467a3a910720a6c71a62e67651f4ed0664d163bcb68ead8216e3f96619b547a321c612d271c4df164a5703b7ccd3c39dbe0ef24e2ac112bd6b348e47f41e9f
TLSH
T19AF0461133CC8319605161B35FB670C8E2B9C4676F8934C67B00869E8FA181EA6C3296
MD5 SHA1 SHA512 TLSH

Submit Download

FastClient.lnk

Path C:\Users\Admin\Desktop\FastClient.lnk
Size 1KB
SHA256 3094cd1f0775c69a0ca1d4755a260694494b2ad055196478ce554085681eb9a2
MD5 784e60dcd7dae09030672a3c95e8c89e
SHA1 fb6441193e3d8041ce05c4896bd9603e22dc0f9d
SHA512 9a95fc556e899841c99e04446fc589bebf25752b0bcc63671e3326e1d01854a22e598826d0dbcd1e08c3537eddcb0a6dd7e1ccb982e3c99b2e7f2f2a91053082
TLSH
T19E2142100ACA2AA5C6BFD23276B3A36AD674BCA1B759CEBC0070C21C5972F41DD5492E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1737819790\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_2039498854\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_646354850\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1404-112-0x0000020EAE190000-0x0000020EAE1B2000-memory.dmp

Download

memory/1404-117-0x0000020EAE630000-0x0000020EAE63A000-memory.dmp

Download

memory/1404-116-0x0000020EAE570000-0x0000020EAE622000-memory.dmp

Download

memory/1404-115-0x0000020EAE550000-0x0000020EAE56E000-memory.dmp

Download

memory/1548-405-0x000001EBB1C90000-0x000001EBB1C91000-memory.dmp

Download

memory/1572-275-0x00007FFC157D0000-0x00007FFC157D1000-memory.dmp

Download

memory/2104-390-0x00000224FA9E0000-0x00000224FA9E1000-memory.dmp

Download

memory/2832-5-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2832-10-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2832-3-0x00000000008C0000-0x0000000002ED6000-memory.dmp

Download

memory/2832-2-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2832-46-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/2832-0-0x00007FFBF41BF000-0x00007FFBF41C0000-memory.dmp

Download

memory/2832-1-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/4336-991-0x00007FFC14F20000-0x00007FFC14F21000-memory.dmp

Download

memory/4336-990-0x00007FFC157D0000-0x00007FFC157D1000-memory.dmp

Download

memory/4700-189-0x00007FFC157D0000-0x00007FFC157D1000-memory.dmp

Download

memory/4880-34-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/4880-75-0x0000021269A70000-0x0000021269A7A000-memory.dmp

Download

memory/4880-35-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/4880-12-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/4880-11-0x0000021267060000-0x00000212672D6000-memory.dmp

Download

memory/4880-84-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp

Download

memory/5040-389-0x00000208EE250000-0x00000208EE251000-memory.dmp

Download

memory/6104-119-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/6104-45-0x00000000749D9000-0x00000000749DA000-memory.dmp

Download

memory/6104-145-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/6104-107-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/6104-163-0x0000000000400000-0x0000000000476000-memory.dmp

Download

memory/6104-120-0x00000000749D0000-0x00000000749DF000-memory.dmp

Download

memory/6104-147-0x00000000747E0000-0x00000000747EC000-memory.dmp

Download

memory/6104-108-0x00000000749D0000-0x00000000749DF000-memory.dmp

Download

memory/6104-109-0x00000000747E0000-0x00000000747EC000-memory.dmp

Download

memory/6104-146-0x00000000749D0000-0x00000000749DF000-memory.dmp

Download

memory/6104-121-0x00000000747E0000-0x00000000747EC000-memory.dmp

Download