Overview
overview
7Static
static
3another-fn....5.exe
windows10-2004-x64
7another-fn....5.exe
windows11-21h2-x64
7$PLUGINSDI...al.ini
windows10-2004-x64
1$PLUGINSDI...al.ini
windows11-21h2-x64
4$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-21h2-x64
$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-21h2-x64
SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3SP_ANIMTRO....yytex
windows10-2004-x64
3SP_ANIMTRO....yytex
windows11-21h2-x64
3Analysis
- user interaction
yes - max time kernel
836s - max time network
680s - platform
windows11-21h2_x64 - resource
win11-20260513-es - resource tags
arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
19/05/2026, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
another-fnaf-plus-fan-game-by-ehanix-3.5.exe
Resource
win10v2004-20260513-es
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral2
Sample
another-fnaf-plus-fan-game-by-ehanix-3.5.exe
Resource
win11-20260513-es
windows11-21h2-x64
10 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win11-20260513-es
windows11-21h2-x64
14 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20260513-es
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-es
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11-20260513-es
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
SP_ANIMTRONICS_0.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
SP_ANIMTRONICS_0.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
SP_ANIMTRONICS_1.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral12
Sample
SP_ANIMTRONICS_1.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
SP_ANIMTRONICS_10.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral14
Sample
SP_ANIMTRONICS_10.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
SP_ANIMTRONICS_11.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral16
Sample
SP_ANIMTRONICS_11.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral17
Sample
SP_ANIMTRONICS_12.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
SP_ANIMTRONICS_12.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral19
Sample
SP_ANIMTRONICS_13.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral20
Sample
SP_ANIMTRONICS_13.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral21
Sample
SP_ANIMTRONICS_14.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral22
Sample
SP_ANIMTRONICS_14.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral23
Sample
SP_ANIMTRONICS_15.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral24
Sample
SP_ANIMTRONICS_15.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral25
Sample
SP_ANIMTRONICS_16.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral26
Sample
SP_ANIMTRONICS_16.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral27
Sample
SP_ANIMTRONICS_17.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral28
Sample
SP_ANIMTRONICS_17.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral29
Sample
SP_ANIMTRONICS_18.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral30
Sample
SP_ANIMTRONICS_18.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral31
Sample
SP_ANIMTRONICS_19.yytex
Resource
win10v2004-20260513-es
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral32
Sample
SP_ANIMTRONICS_19.yytex
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
General
- Target another-fnaf-plus-fan-game-by-ehanix-3.5.exe
- Size 738.8MB
- Sample260519-dcf3dsft5s
- SHA256 023a6b63a9adb9518dd666c39a385c9313b327a3e8082c375d973bc8e74a2b4d
- MD5 73f1e1d4d30cc79237aae620e0882fdf
- SHA1 79f7ce0eb1857f7c49ad1e2df546ac5d6d57fa9c
- SHA512 79158d833fb16476e580ca1ca3efc3c0b3e5756952a5f4a11ddb0465e986e563be21a95cf0ab3a27837aa7001e45971c0c177e5f3cae488096265491581dc32e
- SSDEEP 12582912:GiGCbNN1z9BBqWEb6uPXvd4zcwuIBDBzvQqUnIM/OdTOJ1TQsimy84H76:GiGCthQjdScwfBhX5O7xW8y76
- TLSH T1FF8933ADE1EA2F1CD4736D3886719B5453F4852AC817DC38B76A07428DDB7C7B26C288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 6028 vcredist_x86_2015.exe 5888 vcredist_x86_2015.exe 416 FNAF PLUS.exe - Loads dropped DLL 48 IoCs
pid Process 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5888 vcredist_x86_2015.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 43 IoCs
description ioc Process File created C:\Program Files (x86)\FNAF PLUS\data.win another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\options.ini another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_1.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_10.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_17.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_19.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_2.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_21.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_5.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_6.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\license.txt another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\FNAF PLUS.exe another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_13.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_20.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_30.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_8.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\Uninstall.exe another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_15.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_22.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_11.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_14.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_16.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_18.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_25.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_26.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_32.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_33.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_3.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_36.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_37.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_7.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_0.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_24.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_31.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_12.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_23.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_28.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_9.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_27.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_29.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_34.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_35.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe File created C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_4.yytex another-fnaf-plus-fan-game-by-ehanix-3.5.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\msmouse.PNF FNAF PLUS.exe File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language another-fnaf-plus-fan-game-by-ehanix-3.5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86_2015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86_2015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 416 FNAF PLUS.exe 416 FNAF PLUS.exe 4264 MiniSearchHost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5484 wrote to memory of 6028 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 78 PID 6028 wrote to memory of 5888 6028 vcredist_x86_2015.exe 79 PID 5484 wrote to memory of 416 5484 another-fnaf-plus-fan-game-by-ehanix-3.5.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\another-fnaf-plus-fan-game-by-ehanix-3.5.exe"C:\Users\Admin\AppData\Local\Temp\another-fnaf-plus-fan-game-by-ehanix-3.5.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\vcredist_x86_2015.exe"C:\Users\Admin\AppData\Local\Temp\vcredist_x86_2015.exe" /quiet /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\vcredist_x86_2015.exe"C:\Users\Admin\AppData\Local\Temp\vcredist_x86_2015.exe" /quiet /norestart -burn.unelevated BurnPipe.{E25C66EA-3929-431C-AAD6-0E2B5B4F549E} {57B0080C-2A6E-4061-82FB-3C1E70DF1E86} 60283⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5888
-
-
-
C:\Program Files (x86)\FNAF PLUS\FNAF PLUS.exe"C:\Program Files (x86)\FNAF PLUS\FNAF PLUS.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:416
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1876
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4264
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:692
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:5404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\FNAF PLUS\FNAF PLUS.exe
- Size 6.8MB
- SHA256 90ac06a6c106ebaf2d385722172bd861b5fd842b888e9370af3172888fce590b
- MD5 94403a597c2fe3e6f7da7f15992ad1ee
- SHA1 8a25ecd75c585756921342d79e83baffd881f633
- SHA512 54f3de2ebaf4144354941dd880f2ff26965cb243c30205d0872b70bf4a6d9514d93bd73859e5d6687356ad429e1ce04b5e0a42424083772cd711eabcf1975afa
- SSDEEP 196608:h11sYP7pFubcekPZlyoFutmDGjNARKM1AmgDp37IT:VXDGd3H1K
- TLSH T191665A8636A5C19DD167903CC5869AFAE2713C45CF5097CB22A47F6E3F33AD40ABB211
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_0.yytex
- Size 10.5MB
- SHA256 8662e4dc38f2f33ba3da0cd5a377db0a87f59ad8be9682318e20685686fcdb3c
- MD5 983de089f5633d1adc2d4629271ca962
- SHA1 3f746b1535bbae22801539f31eee35dc4e23a6d3
- SHA512 915e13b45adcdbd639db673a99a6287a3ac92a070643b07dcbcf8fdb2e0b59264270b0cab6f84eae0d0bbc2a43496e44803f0bb9a9fc42369932be346645673c
- SSDEEP 196608:a1VXHoHWGyRY/cP/MweEtS5Yg/pndVtyqQIf7tV9IfoqRUYrhAOAAQmMbMBE1Dex:8VXHSiecPEweEtaYopdbybUoUYrGOAFQ
- TLSH T1DBB633950302B4A1F76F9078067787D18AE48E9D64E0EE09C617B827C9F56BE4E1C7E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_12.yytex
- Size 13.3MB
- SHA256 7c8de97c1e439586d50fc0aab85da9ac35962fdeef0f47f7d44dbe8ea1ace938
- MD5 f7278495387427915b088b6d832b78e3
- SHA1 efacd58ed3b8c59e18523bdb8bb17a82734a5a63
- SHA512 3bb38ad8535ad5afd7f2aa47f7951422a1e60336f54ccecbb0436727e4b68afecab33bd36eff99feb66c8df918930cfaa621789f731ab9b0209f1da2c068b855
- SSDEEP 196608:v20vpK9HLQgEfKt+oq/2i3iVJXmHwyFsa7iqkhY16zOKC51YV0RpSbVwrhNdtcUu:v2DVsgEKJpJX4xf19551YV87XwIglj
- TLSH T126E6339D1D0A496EFE978EB083F38848D5E7EED45B6AA34CDE946D80B87030531685F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_18.yytex
- Size 6.2MB
- SHA256 f5eea4768c8ebca07107aa328c3bcbf33de402589792c28275f2da153953dac3
- MD5 3b008b496b72d024489e66a4735e93c3
- SHA1 a616f328feb8877d6fe9d9818ad3fea17fb2a059
- SHA512 87855245b677569e7bc2ed717488bf0f993419d18077f77f987ff1b506649b0674574b8863d1da1de1d66b31f375e9ace56c0398ddb9f9a4f4f7977576f822ec
- SSDEEP 196608:NEzUppNB6iuoZnKAqxNeKCvUXBixJNXK3kLe4:2Y3NXnFhKLBMNXs4
- TLSH T1406633453B8A5BCAFB8E58B65B6251AECDD848474B9C0614FDE0F2C3B16D1F10A14AFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_2.yytex
- Size 11.1MB
- SHA256 d77d67007f5f4b2af520bf577bb1f42878d70ba83c50b70186d3db262c6afd7f
- MD5 ed5b2e966f02b50498a999c950dd691c
- SHA1 47a0ea86874264e43cb76ece72bae8a2f4f7664f
- SHA512 b002dc379897493326d1d8a6f84bd03af069e740037c034b66c0289beb50a871cb3e0b26b3080e1f60ab2be0466a0cdf6b9ed6a02cf14eb837970b862f6db116
- SSDEEP 196608:xdnwtRKri+7cbwBNGfi2mSKFvNzLlr0u6zL22ArB6kdjYfuWju6yfPEn+CRPi:vwYoSGadSKN1prwL22Ar3d29ju6yf8n+
- TLSH T1C5C633EC20D490B2CF9D0A3692D251550A398D4AE469747FCBC63BA713BBF2D7843786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_24.yytex
- Size 7.5MB
- SHA256 b8212d965c3aa3742a3f41b9dd79a90dc67dd73bc402228b8bfe40728ecff4f1
- MD5 01b5ec2272a424e4d169f4edf3c33ece
- SHA1 1f91ad1ed2a8bfcff30cdbd008a6d03e88a63f24
- SHA512 7df217d719dcf3033dea6041f72e5b36d548f42d0d5b03e9374d0b68a05a11f0d0920a56bb4357a1ad8cb9d9068ffbc591278f6fbb1bb7b916a82dacc8b79f96
- SSDEEP 196608:exfrE/O/Qq56FFLLm4VHOdh6NzBh5wn7/SAtSrruIlqCx/:elb/Qq56TLq4Adh6h5wnjh+Ya
- TLSH T1248633E51D326F52F2E750B3716FE2125BF4DDE2B800945A88023988B53FEAB2E45753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_30.yytex
- Size 7.8MB
- SHA256 e065fd9526d5cf21d32c831630e2a471019734d81caf04b4136ecb063e558cfa
- MD5 e456ce04f534d46304b939fc31682906
- SHA1 94c426696a7aa1bdbc2a6ddfcf1f7217b2e67096
- SHA512 88f5dcd5a23329ba12637822f7fd9b5b01b98094682724a39c9e47f700c3fef658846a3f061ab0f675950b057de1c03e88915a26c05aca17b5f5c4ecab44dd6a
- SSDEEP 196608:I1DNFQhtalKZogIeJSO9WXEFBa0APv81y/LjeH4ksgXNZsR:W4htKg/SkWXEFBaUyT6Pc
- TLSH T1438633AB2630E195C1252EB0600A6E1652B5CCB4FD8CA506A7447E3D5C33C46FF6EB2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_36.yytex
- Size 6.6MB
- SHA256 903689a71f5b4e793052ee45d41e9c258b5982005c2cb87e3a82f20a63923aa3
- MD5 24ed1ac80794996b578a4e5aac7fa5e8
- SHA1 3bb3d207cf772e2140f36b72c6d3bfba525d3443
- SHA512 47d9a222891c79a0ddebe3b457ed1df1b37fcb8e208e6434664da91380de5834aa5a8e24e1d9528ba2bd443ea59339bf10774205b7cd441a01b9056609d64475
- SSDEEP 196608:yDS3bL5NPfF8ULJ2+snY1y7zmQ11k6YDvGqUpSx:yOXGc/RcBXk60qpQ
- TLSH T188663355AD554F81E6BE07B59303EADABB8715BCECED1C1F09C1330D0AB50C8EA526AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_6.yytex
- Size 5.2MB
- SHA256 3cb6f1f66d2244a5378de1a59742aacfa8c9df517f61a27b191dec81223e661a
- MD5 f9a679d48bacf9880ebf8b872a161dcf
- SHA1 5f3a854ce3bd68a5c163d02e07d5992753ff1627
- SHA512 12b3669c3ca159edb918290d704e714b85345168da504a1ece61004cf111f98cd79da4340f97685eda1576fe03a8da294eb28ca36c9ec1867f0d1e80b9dc4f64
- SSDEEP 98304:t5M5BdJUBSXuA2fdb3bptRjZpIPFKi83Pmsb1fORTmnMZ/CHtYb0JKUqkRP:t5M5Bd2j1brprkPoi8pZftyCHiHUqkx
- TLSH T1534633BF4336592BC887C0F305234A997DF23D93BE65562E7784B41A1167CA0B231DEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\SP_ANIMTRONICS_8.yytex
- Size 5.0MB
- SHA256 b9b2dce8e76a4c131c6530104ba741300d1693cdc413b87accaa35946f95c70a
- MD5 3bbda711d835d35bd8b04af72305bfb3
- SHA1 32d4d0a573ff8f36ac2f2e5f90c88820ac056c96
- SHA512 a57e924f6e1de32d57558da478a7428eb739552af6b1accd081fb6eeb579514b3925f5c90cb788e3d1a6fc1772129dd2b42ed311f7a744119e9f65bb1a168052
- SSDEEP 98304:/Sq+zGPrv/FdqTLeWaAEu/7oZoTMG5YHLdimpqgFV6hvMsdpiAIRSUyk4z:1PrvnqTLefHujoZoVYXNF0ys3ilKj
- TLSH T1DC3633D50BC042C7C06EB579FF9BE291968B7904C875A628C36EBC98F0BE9781591F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FNAF PLUS\options.ini
- Size 40B
- SHA256 d2b6d2ed327bcec3e24ba0d814db911b9497ad63c69325d2b25c98b60d03a54a
- MD5 f561f2b3e4e0438915c77790648c66ea
- SHA1 f684b62a1408960673d1aa590c796932ec3ef19c
- SHA512 ca107ddb1b69107eb5387a96cb0a8ac577afec9bc1e2e085cc1287273fd938e6cec8701e041670a8a2f36788d87d7c73d1c624152d2e821f461c01f1a4996df6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nse29CB.tmp\InstallOptions.dll
- Size 15KB
- SHA256 f90a0893c0b0ce2ae3f8bb65f383bf656ce33381d6cbac2b25a7d82b34fde9bd
- MD5 6f3098fb5f3db26f3bb84f5481109e39
- SHA1 9270793e404cc42c6f5be1eb1eb4305f166c656d
- SHA512 0462beae0fbd882dc0b6a09547a7959c051928b828e28125b433794de0258f90f3dec8f1920290f114970d2540a113224b8ab372fcee4dfe87f139be4ac0c0d1
- SSDEEP 384:lgw9eYfMCU9oJNJJjL3bhLNdSDL6o5VrSRLmCvl:39AleJNbf3tNgDLn28wl
- TLSH T14E621A527AC120F2DDD6A53037E77F236FB2B52094D58C1B97633E4B5922212BE39362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse29CB.tmp\System.dll
- Size 12KB
- SHA256 60d4a86f65e141d4b6b778e5f448a0c818bd2fa28db7b9dabc1395d354b19cc5
- MD5 ea00e2678e4679ba28b0f560baec9776
- SHA1 f9b647b1ab50cc2de981757ac914a5787bccd95a
- SHA512 2ee7a4a0af955ba376c66d13e626ca135b2afd13277a006f523eb2fdc1133a12ea35b065a8c119843fbe82f89190cdb2b769329af14e4313a2419b739b27337a
- SSDEEP 192:UA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:MR7SrtTv53tdtTgwF4SQbGPX36g9Mw
- TLSH T110425C496B618EF2F62A463729B77F264B38EE1411E446DB8FD38445E8A01E721363C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse29CB.tmp\ioSpecial.ini
- Size 1KB
- SHA256 df67ae4e6f492eae9862a0a2820515f04aef900218ccd1ba33d9dc231759ed9e
- MD5 1dffbe28bc1ac938b37b505b255a4c02
- SHA1 1826be4df5b8c7e73ee0f214e924d1c835981ed0
- SHA512 6494da2d7dd1c6d0d746f5a64502fff3862e5feb715d53a8ad033a3fff47c62463b00a3e92ab90f750a7ad08cabd6bb4666968101f1ab6d6ee51e1017ae7c7ee
- TLSH T11E21B4163EFD1018E2BAFA04EBF98075973978525828D51EA0C10B0F08F6B418937B9F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse29CB.tmp\ioSpecial.ini
- Size 1KB
- SHA256 45a69e0a8c36c3a14d94272cdf6af9f2af274605d544165ed669ac9fa329c53f
- MD5 ee1dd38cc48af88283da87e8ca66dec9
- SHA1 6bf0b71601cc7677ea51ac8bbc61d30a9674909c
- SHA512 05453485ba301ec5040ae7dcf0c7a3355d1abc0dbe3aa32aadeea0aa64200c41eeed48af9ef60d58b3dacaa2e93d16660ce4488304f4b46b3c188ebfe0fdb73e
- TLSH T14721A2173EFD1018E2BAFA08EBF98075973978525828D51EA0C10B0F08F6B418927B9F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vcredist_x86_2015.exe
- Size 13.1MB
- SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
- MD5 1a15e6606bac9647e7ad3caa543377cf
- SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
- SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
- SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
- TLSH T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
- Size 118KB
- SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
- MD5 4d20a950a3571d11236482754b4a8e76
- SHA1 e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c
- SHA512 8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2
- SSDEEP 1536:nw7WzpopAuJhsVuThs5cXyeM6JUOfPGSpeBxm946ITADDwYkH/1d9chyP7iN6p:pmAuJhAyZFpem90iw//1d9chwG6
- TLSH T17AC35C113BF08072E2E6163D5925A3215A7FBA3199B0D9CF6B484E6E2E711C1DF76323
- MD5 SHA1 SHA512 SSDEEP TLSH