Overview

overview

7

Static

static

3

FFM_Instal....8.exe

windows10-2004-x64

7

FFM_Instal....8.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    46s
  • max time network
    46s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/08/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FFM_Installerv3.8.8.exe
  • Size 17.7MB
  • Sample260806-e16hmashqd
  • SHA256 0989bfaf101e5396d4290cb783bf86686b24c9beab71c08406481bba1d185ad0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutioninstallerpyinstallertrojan

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 57 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FFM_Installerv3.8.8.exe
    "C:\Users\Admin\AppData\Local\Temp\FFM_Installerv3.8.8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Users\Admin\AppData\Local\Temp\is-IJ44MAC5VV.tmp\FFM_Installerv3.8.8.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IJ44MAC5VV.tmp\FFM_Installerv3.8.8.tmp" /SL5="$80048,17392384,844288,C:\Users\Admin\AppData\Local\Temp\FFM_Installerv3.8.8.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Program Files (x86)\Roblox FFlag Manager\FFM.exe
        "C:\Program Files (x86)\Roblox FFlag Manager\FFM.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:712
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          4⤵
          • Executes a command shell one-liner
          PID:2576
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FFM.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --disable-features=ElasticOverscroll --mojo-named-platform-channel-pipe=712.3360.8405182422851177124
          4⤵
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:2464
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x158,0x15c,0x160,0x134,0x168,0x7ffe4ff1b078,0x7ffe4ff1b084,0x7ffe4ff1b090
            5⤵
              PID:4116
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView" --webview-exe-name=FFM.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,632576631398082912,3315486806906594104,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
              5⤵
                PID:3152
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView" --webview-exe-name=FFM.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2040,i,632576631398082912,3315486806906594104,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:3
                5⤵
                  PID:3464
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView" --webview-exe-name=FFM.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2380,i,632576631398082912,3315486806906594104,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
                  5⤵
                    PID:2124
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView" --webview-exe-name=FFM.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,632576631398082912,3315486806906594104,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
                    5⤵
                      PID:4316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/4anti/Roblox-Fastflag-Manager
                    4⤵
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:2084
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2d4,0x7ffe556cc188,0x7ffe556cc194,0x7ffe556cc1a0
                      5⤵
                        PID:1864
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,4222495662197075552,6455497690617632208,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
                        5⤵
                        • System Time Discovery
                        PID:5052
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,17335927336470534096,15816202997955506747,262144 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
                        5⤵
                          PID:4260
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,12708767588375654070,983432307915043712,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
                          5⤵
                            PID:4700
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,11177363554063878981,1246875031853356334,2097152 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
                            5⤵
                              PID:1432
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,11377001793100414972,12622228626610937831,2097152 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
                              5⤵
                                PID:764
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,1887973377446649025,538432903525788823,2097152 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
                                5⤵
                                  PID:3516
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,5044226057289742753,5003940884011096508,2097152 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:2
                                  5⤵
                                    PID:1992
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4412210548366878494,15856992034710676115,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
                                    5⤵
                                      PID:5380
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,9823722681967751031,2474280942520054479,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                                      5⤵
                                        PID:5712
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,7258626331055575734,8646064710859679790,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
                                        5⤵
                                          PID:6128
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,17008421772067721166,14443513842578668722,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
                                          5⤵
                                            PID:6136
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14965012751823532837,6043905068495930385,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
                                            5⤵
                                              PID:5392
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14965012751823532837,6043905068495930385,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
                                              5⤵
                                                PID:5336
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,6437972565157432146,10223179577780704571,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
                                                5⤵
                                                  PID:5700
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,18028290152533452161,16165997619035300571,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
                                                  5⤵
                                                    PID:5712
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,12863970177998650047,7748762011220404205,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
                                                    5⤵
                                                      PID:4408
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,5977795355271226924,13086020116781759219,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
                                                      5⤵
                                                        PID:5808
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,5354352070647582301,5182592162988886527,524288 --field-trial-handle=2328,i,6688438318608263556,6583877792532699166,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
                                                        5⤵
                                                          PID:4232
                                                • C:\Program Files (x86)\Roblox FFlag Manager\FFM.exe
                                                  "C:\Program Files (x86)\Roblox FFlag Manager\FFM.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:632
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                    2⤵
                                                    • Executes a command shell one-liner
                                                    PID:5052
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                    PID:368

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        FFM.exe
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\FFM.exe
                                                        • Size 6.8MB
                                                        • SHA256 5b833eb2e5e56b2a190a6394c94b094f6aa54c85d20f53429bfc4626596412ca
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                                        • Size 211KB
                                                        • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        VCRUNTIME140.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\VCRUNTIME140.dll
                                                        • Size 116KB
                                                        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        _bz2.pyd
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\_bz2.pyd
                                                        • Size 82KB
                                                        • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        _ctypes.pyd
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\_ctypes.pyd
                                                        • Size 121KB
                                                        • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        _lzma.pyd
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\_lzma.pyd
                                                        • Size 155KB
                                                        • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-console-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-console-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-datetime-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-datetime-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-debug-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-debug-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-errorhandling-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-fibers-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-fibers-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-fibers-l1-1-1.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-fibers-l1-1-1.dll
                                                        • Size 21KB
                                                        • SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-file-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-file-l1-1-0.dll
                                                        • Size 25KB
                                                        • SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-file-l1-2-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-file-l1-2-0.dll
                                                        • Size 21KB
                                                        • SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-file-l2-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-file-l2-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-handle-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-handle-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-heap-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-heap-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-interlocked-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-interlocked-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-kernel32-legacy-l1-1-1.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-kernel32-legacy-l1-1-1.dll
                                                        • Size 21KB
                                                        • SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-libraryloader-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-libraryloader-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-localization-l1-2-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-localization-l1-2-0.dll
                                                        • Size 21KB
                                                        • SHA256 6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-memory-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-memory-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-namedpipe-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-namedpipe-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-processenvironment-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-processenvironment-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-processthreads-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-processthreads-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-processthreads-l1-1-1.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-processthreads-l1-1-1.dll
                                                        • Size 21KB
                                                        • SHA256 4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-profile-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-profile-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-rtlsupport-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-string-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-string-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-synch-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-synch-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-synch-l1-2-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-synch-l1-2-0.dll
                                                        • Size 21KB
                                                        • SHA256 efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-sysinfo-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-sysinfo-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-sysinfo-l1-2-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-sysinfo-l1-2-0.dll
                                                        • Size 21KB
                                                        • SHA256 2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-timezone-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-timezone-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-core-util-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-core-util-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-conio-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-conio-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-convert-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-convert-l1-1-0.dll
                                                        • Size 25KB
                                                        • SHA256 ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-environment-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-environment-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-filesystem-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-filesystem-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-heap-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-heap-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-locale-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-locale-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-math-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-math-l1-1-0.dll
                                                        • Size 29KB
                                                        • SHA256 606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-process-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-process-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-runtime-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-runtime-l1-1-0.dll
                                                        • Size 25KB
                                                        • SHA256 c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-stdio-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-stdio-l1-1-0.dll
                                                        • Size 25KB
                                                        • SHA256 a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-string-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-string-l1-1-0.dll
                                                        • Size 25KB
                                                        • SHA256 25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-time-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-time-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        api-ms-win-crt-utility-l1-1-0.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\api-ms-win-crt-utility-l1-1-0.dll
                                                        • Size 21KB
                                                        • SHA256 d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        base_library.zip
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\base_library.zip
                                                        • Size 1.4MB
                                                        • SHA256 a886b8378b2dec827f83e9d9f60edae81b503065511f7d9b0a494b925ddae7c6
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        libcrypto-3.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\libcrypto-3.dll
                                                        • Size 5.0MB
                                                        • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        libffi-8.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\libffi-8.dll
                                                        • Size 38KB
                                                        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        libssl-3.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\libssl-3.dll
                                                        • Size 768KB
                                                        • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        python311.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\python311.dll
                                                        • Size 5.5MB
                                                        • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ucrtbase.dll
                                                        • Path C:\Program Files (x86)\Roblox FFlag Manager\_internal\ucrtbase.dll
                                                        • Size 1.3MB
                                                        • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        blocklist
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                        • Size 105KB
                                                        • SHA256 12e7cbb941c3023db4f822d1f2c98fb0cae07852284cb119a6496a1e413ee6a7
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        BookmarkMergedSurfaceOrdering
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                        • Size 6B
                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        SiteList-Enterprise.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                        • Size 2B
                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Edge Profile.ico
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                        • Size 70KB
                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Network Persistent State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                        • Size 111B
                                                        • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 13KB
                                                        • SHA256 907dade87eadf66f8b744143bbcad174ef114af42b8f9d39551993464acaf234
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Secure Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                        • Size 35KB
                                                        • SHA256 92604066c13235600a8bf83fafe9f16b96ad5cd83359cbafd2b07d547ae26f28
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        sync_diagnostic.log
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                        • Size 6KB
                                                        • SHA256 34c2f7e6b7b39d3e6cf77a3bb361d97c3de3d1084a8e565d8ee83e8ad355610f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 20KB
                                                        • SHA256 11ab44f602035334ccdfc65604f916d33cc2a457074e4d685ef8725c5b7c049d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 8KB
                                                        • SHA256 3bff67dd68ab69826796cae6b3a5bd739bf7a418baa2af52b57c5f9fcd496787
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        metadata.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                        • Size 13B
                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        f4cd41b2-e5ce-4be7-9675-e0c20a5e0337.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4cd41b2-e5ce-4be7-9675-e0c20a5e0337.tmp
                                                        • Size 8KB
                                                        • SHA256 6b4f06c72d3901426d40f9c94dc1778645841567176bfd5beaa8517ef9824fb8
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3824109e-32f5-4fd5-8c6b-235a986fb0ce.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\3824109e-32f5-4fd5-8c6b-235a986fb0ce.tmp
                                                        • Size 10KB
                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        c0242be3-de1f-4930-b019-72f29aa275af.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\c0242be3-de1f-4930-b019-72f29aa275af.tmp
                                                        • Size 1B
                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        FFM_Installerv3.8.8.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\is-IJ44MAC5VV.tmp\FFM_Installerv3.8.8.tmp
                                                        • Size 4.1MB
                                                        • SHA256 1acb6ea8ca244254eff1221711c6d7188639125131a0ec3889f71cb7bf29f20c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        4da2ab59-5f3a-44c2-bc1c-9f767cab6d11.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2084_1135631989\4da2ab59-5f3a-44c2-bc1c-9f767cab6d11.tmp
                                                        • Size 153KB
                                                        • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        content_new.js
                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2084_1191215815\CRX_INSTALL\content_new.js
                                                        • Size 10KB
                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 37a1feed17477faa9e5565e2df6a2a6a679c924e377197cdbfed3e1dbec3fd91
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        MANIFEST-000001
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                        • Size 41B
                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        SCT Auditing Pending Reports
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                        • Size 2B
                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Default\Preferences
                                                        • Size 5KB
                                                        • SHA256 fdae81233820291bf5c61ec8e71f62144dbc07345b50a127219ae20b6505d548
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences~RFe58b977.TMP
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Default\Preferences~RFe58b977.TMP
                                                        • Size 5KB
                                                        • SHA256 ca95a69d0cd5fb016ae19597f38fc1370365950e9300d4a78edec445cbf89dc0
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        CURRENT
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Default\Site Characteristics Database\CURRENT
                                                        • Size 16B
                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Local State
                                                        • Size 1KB
                                                        • SHA256 e4de01bb2bc6f3b10fd6e0b73ca6d40f5d0cf496fd9baa4f7e31060f6caf3888
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Local State
                                                        • Size 2KB
                                                        • SHA256 5812dbaaa20eaffedbcba4ee2818166a341b60001d6c97a5a6ae231df41f2750
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Local State
                                                        • Size 3KB
                                                        • SHA256 8963e93cbb7409bd9ad20f251fb153bd59a3eb1ff71f6b8069c2b2a26e7387e5
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Local State
                                                        • Size 16KB
                                                        • SHA256 e5597aaada38fd9a0032ded1252e06485df66bd6753977528d5435fef4749aec
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Local State
                                                        • Size 4KB
                                                        • SHA256 05d8928cb481373386ba9d20ad401f1e04d71db69ae37c8c952ab79d7825e823
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State~RFe5863d6.TMP
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpvup98jvb\EBWebView\Local State~RFe5863d6.TMP
                                                        • Size 1KB
                                                        • SHA256 76c73384d2e1cbc646316d8f15be24ef06ad7d42d6dd922a75a3bf0695f40dc4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        memory/712-508-0x00000179D9390000-0x00000179D9398000-memory.dmp
                                                        Download

                                                        memory/712-504-0x00000179F37C0000-0x00000179F37E2000-memory.dmp
                                                        Download

                                                        memory/712-493-0x00000179D91B0000-0x00000179D91BA000-memory.dmp
                                                        Download

                                                        memory/712-494-0x00007FFE5A450000-0x00007FFE5A45A000-memory.dmp
                                                        Download

                                                        memory/712-495-0x00000179D87F0000-0x00000179D87F1000-memory.dmp
                                                        Download

                                                        memory/712-647-0x00000179D91F0000-0x00000179D925B000-memory.dmp
                                                        Download

                                                        memory/712-511-0x00000179F3830000-0x00000179F3838000-memory.dmp
                                                        Download

                                                        memory/712-510-0x00000179D9390000-0x00000179D939E000-memory.dmp
                                                        Download

                                                        memory/712-509-0x00000179F38A0000-0x00000179F3942000-memory.dmp
                                                        Download

                                                        memory/712-506-0x00000179D9390000-0x00000179D9398000-memory.dmp
                                                        Download

                                                        memory/712-500-0x00000179D9430000-0x00000179D944A000-memory.dmp
                                                        Download

                                                        memory/712-507-0x00000179D9390000-0x00000179D9398000-memory.dmp
                                                        Download

                                                        memory/712-502-0x00000179D9380000-0x00000179D9388000-memory.dmp
                                                        Download

                                                        memory/712-501-0x00000179D9370000-0x00000179D9378000-memory.dmp
                                                        Download

                                                        memory/712-505-0x00000179F3DA0000-0x00000179F4344000-memory.dmp
                                                        Download

                                                        memory/712-497-0x00000179D92B0000-0x00000179D9324000-memory.dmp
                                                        Download

                                                        memory/712-503-0x00000179D9450000-0x00000179D9458000-memory.dmp
                                                        Download

                                                        memory/2124-588-0x00007FFE778C0000-0x00007FFE778C1000-memory.dmp
                                                        Download

                                                        memory/2124-596-0x00007FFE76AA0000-0x00007FFE76AA1000-memory.dmp
                                                        Download

                                                        memory/2640-5-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
                                                        Download

                                                        memory/2640-491-0x00000000002B0000-0x00000000006E7000-memory.dmp
                                                        Download

                                                        memory/2640-324-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
                                                        Download

                                                        memory/2640-313-0x00000000002B0000-0x00000000006E7000-memory.dmp
                                                        Download

                                                        memory/3152-535-0x00007FFE76DE0000-0x00007FFE76DE1000-memory.dmp
                                                        Download

                                                        memory/3152-723-0x0000023C72800000-0x0000023C7292A000-memory.dmp
                                                        Download

                                                        memory/4316-621-0x00007FFE76DE0000-0x00007FFE76DE1000-memory.dmp
                                                        Download

                                                        memory/4316-779-0x000001531C400000-0x000001531C52A000-memory.dmp
                                                        Download

                                                        memory/4332-0-0x00000000007B0000-0x000000000088D000-memory.dmp
                                                        Download

                                                        memory/4332-492-0x00000000007B0000-0x000000000088D000-memory.dmp
                                                        Download

                                                        memory/4332-308-0x00000000007B0000-0x000000000088D000-memory.dmp
                                                        Download