hxxps://download1980[.]mediafire[.]com/m5pi4rbyp6pggwWoEBfHfrWnrgEi2rzVaVXHYg2myD1bRIczwIhm5Q_4yerZzpLUEpjrQDQH-bLIeESMqbNeETPiAUU5jjyIkw7qPUKZ0vP-ShtCMghw0no5p5Rf8USjREy_SwBX5AW2yLHj7ENVXk17LKd6A8BFDBdT8Jr7c0AcQw/lh8ril8aj9gpmtx/FNaFW+Modded[.]exe

Resubmissions

07/07/2026, 03:49

260707-edmr1aet7n

07/07/2026, 03:45

260707-ea935ahs4s8

Analysis

user interaction
yes
max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://download1980.mediafire.com/m5pi4rbyp6pggwWoEBfHfrWnrgEi2rzVaVXHYg2myD1bRIczwIhm5Q_4yerZzpLUEpjrQDQH-bLIeESMqbNeETPiAUU5jjyIkw7qPUKZ0vP-ShtCMghw0no5p5Rf8USjREy_SwBX5AW2yLHj7ENVXk17LKd6A8BFDBdT8Jr7c0AcQw/lh8ril8aj9gpmtx/FNaFW+Modded.exe
Sample260707-ea935ahs4s

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	3372	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
2808	FNaFW Modded.exe

Loads dropped DLL 13 IoCs

pid	Process
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FNaFW Modded.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3372	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278695463430511"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{9F5308A1-1ABC-4793-BEF0-EF24063B9D1C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
2656	msedge.exe
2656	msedge.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	taskmgr.exe
Token: SeSystemProfilePrivilege	3956	taskmgr.exe
Token: SeCreateGlobalPrivilege	3956	taskmgr.exe
Token: SeSecurityPrivilege	3956	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3956	taskmgr.exe
Token: SeBackupPrivilege	1700	svchost.exe
Token: SeRestorePrivilege	1700	svchost.exe
Token: SeSecurityPrivilege	1700	svchost.exe
Token: SeTakeOwnershipPrivilege	1700	svchost.exe
Token: 35	1700	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe
3956	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	FNaFW Modded.exe
2808	FNaFW Modded.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 1200	624	msedge.exe	86
PID 624 wrote to memory of 3372	624	msedge.exe	87
PID 624 wrote to memory of 1200	624	msedge.exe	86
PID 624 wrote to memory of 1200	624	msedge.exe	86
PID 624 wrote to memory of 3056	624	msedge.exe	88
PID 624 wrote to memory of 3056	624	msedge.exe	88
PID 624 wrote to memory of 1328	624	msedge.exe	89
PID 624 wrote to memory of 1328	624	msedge.exe	89
PID 624 wrote to memory of 1328	624	msedge.exe	89
PID 624 wrote to memory of 3244	624	msedge.exe	90
PID 624 wrote to memory of 3244	624	msedge.exe	90
PID 624 wrote to memory of 3244	624	msedge.exe	90
PID 624 wrote to memory of 3292	624	msedge.exe	91
PID 624 wrote to memory of 3292	624	msedge.exe	91
PID 624 wrote to memory of 3292	624	msedge.exe	91
PID 624 wrote to memory of 1752	624	msedge.exe	92
PID 624 wrote to memory of 1752	624	msedge.exe	92
PID 624 wrote to memory of 1752	624	msedge.exe	92
PID 624 wrote to memory of 3136	624	msedge.exe	97
PID 624 wrote to memory of 2136	624	msedge.exe	98
PID 624 wrote to memory of 3136	624	msedge.exe	97
PID 624 wrote to memory of 2136	624	msedge.exe	98
PID 624 wrote to memory of 4032	624	msedge.exe	99
PID 624 wrote to memory of 4032	624	msedge.exe	99
PID 624 wrote to memory of 2500	624	msedge.exe	100
PID 624 wrote to memory of 2500	624	msedge.exe	100
PID 624 wrote to memory of 2500	624	msedge.exe	100
PID 624 wrote to memory of 2808	624	msedge.exe	102
PID 624 wrote to memory of 3552	624	msedge.exe	104
PID 624 wrote to memory of 1068	624	msedge.exe	105
PID 624 wrote to memory of 3940	624	msedge.exe	106
PID 624 wrote to memory of 1100	624	msedge.exe	109
PID 624 wrote to memory of 760	624	msedge.exe	111
PID 624 wrote to memory of 760	624	msedge.exe	111
PID 624 wrote to memory of 760	624	msedge.exe	111
PID 624 wrote to memory of 2808	624	msedge.exe	112
PID 624 wrote to memory of 1204	624	msedge.exe	121
PID 624 wrote to memory of 1204	624	msedge.exe	121
PID 624 wrote to memory of 2656	624	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download1980.mediafire.com/m5pi4rbyp6pggwWoEBfHfrWnrgEi2rzVaVXHYg2myD1bRIczwIhm5Q_4yerZzpLUEpjrQDQH-bLIeESMqbNeETPiAUU5jjyIkw7qPUKZ0vP-ShtCMghw0no5p5Rf8USjREy_SwBX5AW2yLHj7ENVXk17LKd6A8BFDBdT8Jr7c0AcQw/lh8ril8aj9gpmtx/FNaFW+Modded.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff805eac188,0x7ff805eac194,0x7ff805eac1a0
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,17678590608610614354,16987120543812741603,262144 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,946324072642071922,13374131660194157749,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,18284675504828217807,1698139361343163286,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,9956058795163090330,8927338900854836555,2097152 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,4547717037732009392,14181402898115176287,2097152 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,17979129414251105261,13415540034564892729,2097152 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,10474207181302818995,2740501926231584899,2097152 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,10034418677972236200,2966603122129879537,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,2729721188617603535,3186089586415698550,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,14889633156384858385,2367339710362477958,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5628,i,10934634292230067178,7322455107933762854,2097152 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8414572860610543596,13842127308094210669,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8414572860610543596,13842127308094210669,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,15229554400153194854,17365725986114635697,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,6102728595244367328,14171611005811277533,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,9936808547801615953,4364944388827966346,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,730700267128613265,13411844363928297421,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5620,i,3680864031253151223,2357457199601211601,2097152 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:760
- C:\Users\Admin\Downloads\FNaFW Modded.exe
  "C:\Users\Admin\Downloads\FNaFW Modded.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,11252273070236160763,1856824645543593560,524288 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4388,i,3550156139254795479,13528955466167093428,262144 --field-trial-handle=2288,i,5103299691888170194,5004438393963517882,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2804

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e73dfc43ea3e17f9065a64fd4efefb0a24daeff54e1675761db774f810d57c39
MD5 d2723d09c3dfe9078b810797d9d9487d
SHA1 f8af140cd70c2a433de294c592f937796fbb3011
SHA512 03eb9101eda573bdd9927e5161db2596ecdcfd84bd1e60f35e6141eee2330735060738ce7117847954673b151026b966a7f11ac5dcc5e6e848a8bcc10f376040
TLSH
T1F471E436149301B4EF40CA3398EA824D323781FBF90B9E531490087F290676CE75688F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589dd1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589dd1.TMP
Size 3KB
SHA256 825db5324422894576d55b7fc98795e730f350c8bd554868b46a0b2f78e9601b
MD5 bbda5679df793cedd543d62c3c948928
SHA1 fe898993f8869a12e2eaf1d76f3f81713e26c487
SHA512 5224f90c8709dbcf331f74788717a8ae8dd3ce415c127cfd7e043e59e8cd30486122cf7dbbb2bf7b2265a748c001f40353baf6039660f5a5afcadd70b9a20502
TLSH
T15371D536159305F4EF40CA33A8E9824D723785FBF90B9E535490087F290636CE75689F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 899B
SHA256 f81cf0b9dfe56bc354d170b704b9eb77146687bb9795af5da754d68c7bd284d9
MD5 7902b2ead16864807809b27bcdf9dbc9
SHA1 6375816daa81fe11add6f19a07204e7b8927f2fb
SHA512 de70bb4fc6dfcc8325b7649fb1ee380fc75ff3327e963af1f7c50e121e0f5b7ddac02f7a8524eba185867e02090723e86ebca2cb2c1b642c668a04601571cfb0
TLSH
T17911C4F383E1856DCA1181F0AA186F1BCE2D0501431C7C5686E0AF1793F3474E001D4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 52cc3a153aaa98b38ed817f2581d7b651e1345c3ce189f8aef81f5518341bb39
MD5 8dbf88095785abaa1e7110e5cf75600d
SHA1 c26ff88157d9e98cd6735d14843cc7e356d1a553
SHA512 855204d23016f06d079aeb300f97d8f8fb1404bdf2013420913d58046717555bc60b0d7848b93746e696ac1f75b24bc7deb71e32823e714a4c4aafd70b2d53fc
SSDEEP 192:sxZxSwRcyM/jK1Ml8UQj9N/f4s0PNlgVfIdpLHW6+WNGYvguvJzIg5DJ:sxZIwiqRN/f4s0PD/LHbGI5f
TLSH
T10452D8126A345977CCDBD20DB945BF93D6F91472A2900E84A9FCCA1C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a88def44ac1817d4bf2bcb54c24cb9436db8242fd2923ad59d4656fe493d5391
MD5 5712e4c19f21eee7bf6f09ec64c2845b
SHA1 47cab18433cee42acab6e6b67f09591ed124bdf7
SHA512 02f3ec34c41462ce115903b0efa16845e433bc879f1eb2200358a477db31ca2f8386bb4670d324e6fe90383bbfe8bfd0382fc5188c81790e1ab1b192876b7bcd
SSDEEP 192:sxZxSwRcyM/jK1Ml8M9N/f4soPN3gVfIdpJHW6+WNGYvxoHJzIgrJ:sxZIwi1N/f4soPR/JHbGd59
TLSH
T12A42E6126A345977CCDBD209FA45BF93D6F91573A2900E84A9FCCA1C05E7AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a13156b5cee98fdb532753dbe54c2ad2bc34990ca792651044ef4bef4f1b2c44
MD5 47749d9820e79ee63fd2977306b6c59b
SHA1 fa97841a842592eb7fdb501a03582ec42e87c474
SHA512 17f8c2d5e0c7aa83da4a6ee82953dc708b77e7fa9283136cf08d017a27a816cdf15d3a3a1188a18a387361815d77b1b331754593539acff89ed7442c5f538386
SSDEEP 192:sxZxSwRcyM/jK1Ml8MjN/f4s0PNlgVfIdpJHW6+WNGYvB0HJzIg5DJ:sxZIwibN/f4s0PD/JHbGz5f
TLSH
T11252E8126A345977CCDBD209FA457F93D6F91573A2900E84AAFCCA1C05E7AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 89a6e7ab277fc94277fdd60ecb1896fc3d459191d9e222b37141b5278139125b
MD5 a81ce6a12e7a0c9a8b88205f0045ae6b
SHA1 4eb9ddb403a85fa36c7c79a1214c3484491885f6
SHA512 c4aac9821b6d6bcfd2050910110f3c7d8e201854b7c90d4674c16afb95974ad8bd54a730a26f90cf82c2cf5e8b8ebdaeb145190ddfcfc87f3aa247f12f550c1a
SSDEEP 768:4+seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppjroQz:4+seJ3xWvhfynu1jaVcL88pQc
TLSH
T149D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 cf9a90c4ea90c561b69d6bd9ddeddcd7665ae547a53fc199bb3a940141d05196
MD5 5935edc3e271d8a9b57e52f353bb7eff
SHA1 52bd0ede144fdefae03bdd7ef97098d120331dd2
SHA512 8d7cf24692487cf4ea3bd30fa47532a81fea3653be870719f911bc23f9e292e2e9ee12c2efc317a75af46d8534fd91620d8f33991a0843dcdec83a35f231e251
SSDEEP 192:49/zhIv4dZvtNs529BLIgvO3f+BtiHVCbvlfj2LQ/3dGgJ8NVIbk:4t9cXB
TLSH
T104D16103753A02023C7E654CA59295378E8274F33458F4AFBFB905A64E2AE165EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592b3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592b3c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 521fe411a8da30a92007f95a98c295d58d5685e10c1a7dcfd5d8dd70a07c7602
MD5 8634768481b84bff989303ef14041737
SHA1 7c6118db01444516647748da7e871c6a1799e2c4
SHA512 e420ca31d7e63315c69d334db1f143b71cb8a110f109b9755dd37b1712213a911738fc85495a42d2bdb65e2ec0bd2f1250aef26d233ab388905d80de523f18ea
SSDEEP 384:diF5tNn/s3n9S/6sNT8TUNTUlIlCkYRn7lBOOu55+YdUA9AEl:UF5j+91ewg2tOlYqUAOEl
TLSH
T15A8229735C94C93BAEE69A94F58E33139EF441AB95C1AE90E6DC6F1C01CB29C030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 826ab6b60127facbe7d3c9a7fcd5c450952f919a6689e8a1e7e06aa862f50862
MD5 af1dd766b66428bb7309c4f783abfb2c
SHA1 0f3e64a2e18ad5198fae128b12b7796cd1cc10d1
SHA512 fe5d60561ae2176395e225033cd060cc39f4a936b030621051ef60110553d3c791e54824f713fabc825c8d1dd39cc590d39e87c7a107a736b47c5330733d5596
SSDEEP 192:lONz6vMtPQmiUyKoThToqC5Ta7847sldU/u:lONz6UtRiT+5+7KU/u
TLSH
T15102F876AC686C7BDAB7AE45F48E27271FF4216FA5905B40EAE82F1D00D725C1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 fe233b1c71a928331a20cfb5139d64c50bfc4c975dc80280f6a9f24a1441430a
MD5 8b48b0d1dbda6b1faf39385fd73ee311
SHA1 9f524824d517d7ff45b4fc6314b8ba262f0b9f9a
SHA512 1b695b8775bb4a3378e8a6819262068563dd5276015d5bdaf1b561bac121d1df9e6ba3355d91c5ec8767b4b9b1431c6eecc0efd3693813f5cec432a22f170eae
SSDEEP 384:RtNn/s3n9SqsNBnkYRn7l7OOu55+YdUX9AEl:Rj+9tctMlYqUXOEl
TLSH
T1A5625B72AC649C3B9DE7E555F48A37135EF4916B92C42E80E5DC7F1C01CB26C0307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7a1d0f4a1d5ea4788664a608c85cd18b39f6d628db14dadb604bce2a28eb94fd
MD5 5070ab95d4e5972efb3aa2def3e16149
SHA1 f1b24e2f965b07d1a7489acd2819f4d9d51ef9fb
SHA512 7eb7cf8ab4bc701bdb1b5b879870a17f8306bffda2132182f8b9f22c23f62288efad74005f247a0fe7d4a0caaca2d77e19fa788801ef3bcee247338ff1cb9288
SSDEEP 192:aONs6vMjPQmiUyMoBhToqC5TagHFd3EV80IMqHgrU/u:aONs6UjReB+5+YdU69AU/u
TLSH
T16412F972ACA49C3BAEA3E555F4CE22135EB4926FA684AB40F6DC2F1C01DB65C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e5658a22ca410ecd91f9c8d723ea82920931b62806e67fc44cd6d20f90db8a36
MD5 40e147865d5c563fd228df37982a82e1
SHA1 074b60c999f6d7db746deb027b2d1120892b036b
SHA512 a06de72b44b13933ee90cd6bd5fa774bb537b418659fa6a0f9d0c645a9441065ca1279abc551cd0cfd393db09943542686c2864644df5c067a269906978054cf
SSDEEP 384:ktNn/s3n9SGsNBCkYRn7lBOOu55+YdUY9AEl:kj+9JZtOlYqUYOEl
TLSH
T17B625B726C649C3BA9E7E555F58A37135FF4516BA2C42E80E5EC7F1C01CB26C0307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 02732837e903c5bc145751453b4c14351a2a4873e4ff806fa84d21bfcb7182c4
MD5 ac7cc96d9c5979324a7468b6adad1fbd
SHA1 c27929e41d35e1b97b23ac40060a5c8c7903c65b
SHA512 da6663405aebb86dc62384efca157eb3d10489c86ef5e60471f5d88ca4cd5154a4109044d0a9cd2e9e96f8adc657c4acf92b00ea6abdec4a2c416727f4bf2b60
SSDEEP 384:PtNn/s3n9SvsNBCkYRn7lHOOu55+YdUX9AEl:Pj+9IZtUlYqUXOEl
TLSH
T179625B726C649C3B99E7D555F58A37135FF4516B92C42E80E5DC6F1C01CB26C0307A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbe8a9f9-c388-402f-bc7c-f7db32f44dc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dbe8a9f9-c388-402f-bc7c-f7db32f44dc6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b430971ada3798e2fd1e57bf6b932f791241020621fad0201bf7fb023982e2f7
MD5 ce606368c26c4ba3c374a720862926a4
SHA1 244138521d4b8a59e33326f7214fb391f1c14c2b
SHA512 7dee7bb5fa2e575a4ff2a386e27331dde1de11836c7febee7aae58854393847dcfde549bb42a3abc84f5c2b41a8f8438429d1ac490c94870755e1e62c3d9ac31
TLSH
T19841F45DB7FD2148B3B3AF5AABF2A86E587B78372E06945D00110E4E0A32B44D961737
MD5 SHA1 SHA512 TLSH

Submit Download

INI++15.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\INI++15.mfx
Size 439KB
SHA256 4f7e3cc575de56d815589db22a1d96760e2f309e58b9bde1a57e108bda069393
MD5 760454c677adda4b319272641680e331
SHA1 348f18fb00889c3058451c2f034b51d6965522af
SHA512 62f4d9c151adf2ce2430028185241f890849b3b0c2a11b5cc8c0e74bb3c02f3246e3abdc4031b75d2aaba9f24c26e60b165c410c2bf7c4e0569b34882b8477a7
SSDEEP 12288:COUHF5C1qTcnhwMuTwRTqGqKCspFOclh:yF5uIT0qbKCspFOc
TLSH
T141A438603690C177D57E43F23A297B1A403E7961077E98DBABC1696A38B01C25B70FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KcCursor.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\KcCursor.mfx
Size 36KB
SHA256 957395a47050cebdf4476b8e908a03e90cc8d77f3e50c518a491e4e0d3443a43
MD5 d4f7402bbe6770a3c262f91495d01847
SHA1 375953d6b23b2eaa8b075e5b2f672ba0ac263b42
SHA512 731ffb510f61daa507ff5fa6ae643cd22c3ef0da464e11ead9aa3a315f56bc77760ee27093f8cfff2fac0caee643b80a40b910034bab6a7db564dd6e23d069a8
SSDEEP 192:Bl0tMHeTeN4dUDRhMn38xmrgO5w9LLApekguc/3RabLpNAZi+90lO0gP6ZWlLbxo:70O+2ZDPaNAZi+9NjP6ZSe
TLSH
T1BFF27322E3B59059F4B2AB754CBA42319736FDA3A838DF0706A0F60D6C71B91AD15733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Perspective.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\Perspective.mfx
Size 15KB
SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
MD5 9f064bdcb066daa428db0ed9e33e785d
SHA1 3c0df73cf247ce49d1010fe0e2f722424fe43f4f
SHA512 4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
SSDEEP 192:ky3C1MfE8YG8vRLkodYlfqbVq1jVF2sLlMUL+Ah1AoEb+py+pIgucW:RGHDkodYOsLlMUL+Ah1ALbI/uc
TLSH
T15762E652EBF00468F0B7AA778CB6072B5671FD526EBADB4E8740040C9EB2B51DD25732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cctrans.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\cctrans.dll
Size 347KB
SHA256 9b834b5d26983451ef3a11c8c2a715724daa188fbd28597081ecb1e9ed672f87
MD5 21e093d52a3afe8ed5532fcaa189c067
SHA1 8aa7bcb26e3064cd4d1172090ff00d083ee19cc4
SHA512 b4c2205c234e8ed4973fca9c64c0ec11753eb200c1d2eb3c66b9f4509426c8774f14ae1271583e0eaff268eae9c8375c5993af107e4db8d7c87b817bd1ccd9e8
SSDEEP 6144:diAs8FRxWGjVbzWKCc/IEqibsBVthDU6Uthoy28TZKmpEGB:diAsmRgGJzWKCUIhUsjBhP9GB
TLSH
T11F748E10B9808031C2B7383416BDE6B21DBCA8301F749ADF9B581A7A5F745D1AB37A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcclock.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\kcclock.mfx
Size 108KB
SHA256 58588b5e12d0c5629ee481ad7ed9e8b4d6798cfa83004aecaa600a6924bc97e6
MD5 3aa5cbe7b31e550511ce011457c44790
SHA1 93c22c4f9ddb40d72865ec5dc169cef3feb3e337
SHA512 c29a54368badaae841eb27dfb3a9ca74571828618888021c45949d1d999242e07bf240b08f602dfacded4c82e12fb6a13f501a09efe68fd5a310541099fa4a42
SSDEEP 1536:jw3Qb5+iBxoDymPqUKlZwdkkpciB2TjsWjcdeVR1d:t+jnZd/7B2TMeVR1d
TLSH
T176B36C0076908374E8BF06B54ABA9BD20EBEBE21477489DB1790449E4DB47D0BB31B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcini.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\kcini.mfx
Size 330KB
SHA256 5af175ffb932fb653873dad095dd40f2ab8d3fb56f287213c21bb68652ddad2d
MD5 a6ad14845999c5aa7adf2911671a7c5b
SHA1 98dfd5a9584d1c1b330c2c104c1779bd55ded211
SHA512 32bb59826b82d47ec420ac2532e1387a85422d2f0ce5370ad2c95b914a7615d3b122dbf4dd045105eb8ffea49324dac57659f0e5f2500b4d0eb75047cb36dfd8
SSDEEP 6144:K3gRipIs36PvsSufsm7Sna98p8r2jaeAfSfIaC4MeTkC3O:KlIs3s0SuR7SnaepwjKgH4M6k+O
TLSH
T160748E20B9C18032C67B35704979EAF11DBDA8201B345ADBA3AC097A5F744D2FE3596F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d11.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\mmf2d3d11.dll
Size 541KB
SHA256 5f6563d6bf2f3ceab8b2ca2c15ba4f7fe882a82c1f72b10041b5692c6515a53a
MD5 839633898178f35f6de0b385b7de0ec7
SHA1 5396e52c45954f0953cc8cf2095b122f7353180e
SHA512 b0ed4fce2815dcb783e0b9a786178b337d215e6a4d16df1ddb3c28ccdba13081fee1976669d9f99505cf31b8f1e8d5584fd1aa9732e1add38217222726c76eb8
SSDEEP 12288:PTj1ZnJmYM1TjXv7aB4hMz0NZZu3VgGVuwY8dXtdIkJrXIW8M:PXMxjTaBcMzYZZuVgGJdXnJbIW8M
TLSH
T1E0C47C02B6C1C837D42E1330489BABBAA27DB6110B65D7D772986B3C6D713D05F33A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\mmf2d3d9.dll
Size 1.5MB
SHA256 bddda991185a9e83b9855a109f2fcfa78cd2d5402e9db344c6ec77f6ce69a0c5
MD5 c85bcc9f3049b57aa8ccbb290342ff14
SHA1 38f5b81a540f1c995ff8d949702440b70921acc5
SHA512 5097f9d78ddc651aabf41f217f622ee656a1c6de6a9b339354525293102cf631cca2b7babaf991e99e49efe4d1bb6792c8a7a11f82e4ae2081c3961eb9b5afe7
SSDEEP 24576:rYhBOKa6c8DVYrsz0LbMgPqgVmpiLfmVydmN/9KcAfcLacioayK:v6FjILIgigQrye8cqua5
TLSH
T1CC75BF11B681C036C4B73231065EA37562BDAF211A7495CF17883E7A7F745E2AB3829F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\mmfs2.dll
Size 768KB
SHA256 763ef4484ba9b9e10e19268c045732515f0ac143cf075e6d1ea1f5adcc77633b
MD5 200520e6e8b4d675b77971dfa9fb91b3
SHA1 0c583bf4c3eda9c955fd0d0d3ba7fdc62a43bf07
SHA512 8b7bb334b6bd83ae43e5a4fe32a92b38b1edd2c292c4a540a54c2ee16092eb30108524c1c363508f7c62617bb224d9b447f07cda97ab7de01688acbfbacec51b
SSDEEP 24576:OAN3eETMNlmLBNc/82oLOsy6rvPXPT1YI:hN3eETMNELBNczoM6rHXPT6
TLSH
T1E4F4AE20BDC5C131D6AA247286BDFFBE19AC66300BB455CB4B881E7A1F201D36F36657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp3flt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\mp3flt.sft
Size 24KB
SHA256 81c9a9459a8e124793addf142cd513945d6fe600e1d67f74897898d7570e56b2
MD5 5bebc3ae0122702b89f9262888d3a393
SHA1 064731c0f1d493b5b82921fa78f06e3d1db95284
SHA512 c10cb520c2c4a9fe7c371f17ce7f86f138db247468ab1e465dafd7abd294c2beb13cf3a2595b4c8c820d911d8b70842c8f4e45398693c4f0454f973bd58a10a1
SSDEEP 96:24znrBZKgkk1jqIU9my5F3TM+EXt0D0CZpMC07X7Xbw9pbcPw5KqQ+5lyV:24bXSIXy3IrXtafMCOIpwPRzElq
TLSH
T159B22B12B3A10CF1E55A5E322CE7027B6E75FB9917B4625B9F91C23D1C33901A81B573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waveflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrtFF0C.tmp\waveflt.sft
Size 8KB
SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
MD5 57ea61dd14314ef155e80c6a0be8a664
SHA1 963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
SHA512 cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9
SSDEEP 96:vLor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6N/8cKH+ewp:v26Dj9t2ubTVdGJgOcGvw
TLSH
T16FF11B12A7A500F5F8DD0B7134B7627BE875FA285B11C24FC580DE6C0C301E2D928BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fnafw5

Path C:\Users\Admin\AppData\Roaming\MMFApplications\fnafw5
Size 92B
SHA256 804f49b91e9eea881078c4ab23337be40294eefdf387827713ad56ecb539b6c5
MD5 1c4367eb41f9d232ae970c449539ea39
SHA1 c74169c6c99949f6673cf39a84286839b6ed598f
SHA512 825cae47c6caac9a8b21973cf5657064a0da10d1eb5077dab26001b670845dda39bed2d1d060ab3865d2776e5750610bc6366de7e37b2bcc1bc10456c5bb8cb4
TLSH
T180B002401501679CC195426310585E08B010CF355315540DC1137DCC5E40D1C7DBC114
MD5 SHA1 SHA512 TLSH

Submit Download

fnafw5

Path C:\Users\Admin\AppData\Roaming\MMFApplications\fnafw5
Size 108B
SHA256 70a0915470ecb0aacc9bf8e50cbe446bf443f37ff4b4ef08171017ff035f21a9
MD5 2562c34220ec7b6c56b7bd64f5db1dd9
SHA1 d027b82de18cb970e7985ec3b4c94965c0602b17
SHA512 79f52397efe5674b171c44e6a7ca6836a3ba78528d7dd17f7c86b8af2c8425ce8744b4a4764a4fee232b933c75031bc575c080db95dd37061bc8aa3eb48e7a50
TLSH
T1DBB0025055156A9DC199426351E85F0CB484CE755375641CC217B9DD7E90E2C7DFC214
MD5 SHA1 SHA512 TLSH

Submit Download

info

Path C:\Users\Admin\AppData\Roaming\MMFApplications\info
Size 17B
SHA256 f468ea90661f978a50882c08648cd7258e0c95435c3c3915c34e4dafa5b61bb1
MD5 74a092e441e1edf7931e91fdc2c7ee7d
SHA1 0dd9f62dfba2675f49c3ea797bc29538f8d13cbd
SHA512 bfc1cc83ac0f525ec9876cc7d4637589ac638a43efca778911f5f9c977ae0181e11618741cf23e40f0cac949dc21c7826bbed35b25fad358a60025a3adf666a6
MD5 SHA1 SHA512

Submit Download

memory/3956-376-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-377-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-378-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-375-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-373-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-372-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-391-0x00000283BC630000-0x00000283BC640000-memory.dmp

Download

memory/3956-397-0x00000283BC690000-0x00000283BC6A0000-memory.dmp

Download

memory/3956-403-0x00000283BBEC0000-0x00000283BBF0C000-memory.dmp

Download

memory/3956-374-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-368-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-367-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download

memory/3956-366-0x00000283BE070000-0x00000283BE071000-memory.dmp

Download