hxxps://cdn[.]discordapp[.]com/attachments/1388580879957364816/1535903831240736879/nfa[.]exe?ex=6aa059a9&is=6a9f0829&hm=a17f46d194d6cfd4dbc3f4ffa271a964ce10d5a010149386d2815f7791f746d9&

Analysis

user interaction
yes
max time kernel
30s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1388580879957364816/1535903831240736879/nfa.exe?ex=6aa059a9&is=6a9f0829&hm=a17f46d194d6cfd4dbc3f4ffa271a964ce10d5a010149386d2815f7791f746d9&
Sample260907-x81apafl21

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	3000	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
3716	nfa.exe
4604	nfa.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332831483756499"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{6B35AB33-9298-44D0-8398-6A4E7581F374}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
3716	nfa.exe
4604	nfa.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 1400	2808	msedge.exe	85
PID 2808 wrote to memory of 1468	2808	msedge.exe	88
PID 2808 wrote to memory of 3000	2808	msedge.exe	87
PID 2808 wrote to memory of 1468	2808	msedge.exe	88
PID 2808 wrote to memory of 1468	2808	msedge.exe	88
PID 2808 wrote to memory of 1380	2808	msedge.exe	89
PID 2808 wrote to memory of 1380	2808	msedge.exe	89
PID 2808 wrote to memory of 2904	2808	msedge.exe	90
PID 2808 wrote to memory of 2904	2808	msedge.exe	90
PID 2808 wrote to memory of 2904	2808	msedge.exe	90
PID 2808 wrote to memory of 932	2808	msedge.exe	91
PID 2808 wrote to memory of 932	2808	msedge.exe	91
PID 2808 wrote to memory of 932	2808	msedge.exe	91
PID 2808 wrote to memory of 3384	2808	msedge.exe	92
PID 2808 wrote to memory of 3700	2808	msedge.exe	93
PID 2808 wrote to memory of 3384	2808	msedge.exe	92
PID 2808 wrote to memory of 3384	2808	msedge.exe	92
PID 2808 wrote to memory of 3700	2808	msedge.exe	93
PID 2808 wrote to memory of 3700	2808	msedge.exe	93
PID 2808 wrote to memory of 4960	2808	msedge.exe	97
PID 2808 wrote to memory of 4960	2808	msedge.exe	97
PID 2808 wrote to memory of 2912	2808	msedge.exe	98
PID 2808 wrote to memory of 2912	2808	msedge.exe	98
PID 2808 wrote to memory of 4192	2808	msedge.exe	99
PID 2808 wrote to memory of 4884	2808	msedge.exe	100
PID 2808 wrote to memory of 4192	2808	msedge.exe	99
PID 2808 wrote to memory of 4884	2808	msedge.exe	100
PID 2808 wrote to memory of 4884	2808	msedge.exe	100
PID 2808 wrote to memory of 4916	2808	msedge.exe	102
PID 2808 wrote to memory of 2800	2808	msedge.exe	103
PID 2808 wrote to memory of 3716	2808	msedge.exe	118
PID 2808 wrote to memory of 4604	2808	msedge.exe	115
PID 2808 wrote to memory of 3716	2808	msedge.exe	118
PID 2808 wrote to memory of 5116	2808	msedge.exe	119
PID 2808 wrote to memory of 2460	2808	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1388580879957364816/1535903831240736879/nfa.exe?ex=6aa059a9&is=6a9f0829&hm=a17f46d194d6cfd4dbc3f4ffa271a964ce10d5a010149386d2815f7791f746d9&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbf4cec188,0x7ffbf4cec194,0x7ffbf4cec1a0
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,5484525095111335940,12808483625825649365,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,15536739304517831506,508027847509324111,262144 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,11428668538649672859,106794686301491510,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,3723642275207085998,10385456167319031365,2097152 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,4719542841226034051,2456334990841892767,2097152 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,14627201601973723315,2546842733029478880,2097152 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11282784111125366445,3356612865498245231,2097152 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,1601689162828825579,13760710680408543244,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,15547066490383622676,12926478758722292163,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,1571526946736891459,18282710631187606504,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,9540359368160466415,8092448029731983602,2097152 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,14281438328945717883,17387527420011107766,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,14281438328945717883,17387527420011107766,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,16814984465980326380,9280319070856428355,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:2800
- C:\Users\Admin\Downloads\nfa.exe
  "C:\Users\Admin\Downloads\nfa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:3716
- C:\Users\Admin\Downloads\nfa.exe
  "C:\Users\Admin\Downloads\nfa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,8035037872597990024,6781736307557524331,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,14639296651935334700,556622717657529556,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,6355017687503460356,4837988674027306302,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:2460
- C:\Users\Admin\Downloads\nfa.exe
  "C:\Users\Admin\Downloads\nfa.exe"
  2⤵
  PID:5436
- C:\Users\Admin\Downloads\nfa.exe
  "C:\Users\Admin\Downloads\nfa.exe"
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,7908575949826305590,12682551504866886490,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:5512
- C:\Users\Admin\Downloads\nfa.exe
  "C:\Users\Admin\Downloads\nfa.exe"
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,14510793385077079828,15845150935317620230,524288 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6916,i,6238923437823020645,17834254647750531277,262144 --field-trial-handle=2132,i,527926298967833515,14711495919874555508,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:5164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2356

C:\Users\Admin\Downloads\nfa.exe
"C:\Users\Admin\Downloads\nfa.exe"
1⤵
PID:372

C:\Users\Admin\Downloads\nfa.exe
"C:\Users\Admin\Downloads\nfa.exe"
1⤵
PID:3772

C:\Users\Admin\Downloads\nfa.exe
"C:\Users\Admin\Downloads\nfa.exe"
1⤵
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6d001078-10d1-4e90-b624-e2ca9b6e72b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d001078-10d1-4e90-b624-e2ca9b6e72b0.tmp
Size 12KB
SHA256 9c1662d16c4b54702afd184ca8e02d485d84f38b4dfa7a684737ceff9cf2b51a
MD5 c35bd598d0a4c89f59c903f379b3d3d4
SHA1 7cfe915323f5f0db9d6dd2a3e0eb5f103febba35
SHA512 335f42cdd16fa9f2b7e1991aa95f46fe81044831f0d76cd8ba89d45e3d3648e27c00c676acd0479a470d85aaf9eb49f4cfd6128ae25f4fa3fc7cd4a43bbe2fc0
SSDEEP 192:uULsNnDQYZjttZEhmQmiU1we94H/+jVIjzorR+XKFuSJrEV5cFT7qdsA+w:dsNnDhZjtcgJSf+68R+XGxJrEQFqsw
TLSH
T181424E3668B8AC375DE2A645F44B32139FF4506B9AC92F90D6FC6F1C00DB5AD131AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 6d7509d246a6b364cc25886b6128d558393d8b3ad2d948991248ab4b2c67e351
MD5 06e5c7c7c16b8e232e774be5dc8efeda
SHA1 cd8fe9d51ac005defdaf6de59917b2fd05954180
SHA512 808c0205434cb841e91c6f6c5d07d3f43767d39f0da917dbb738ffab5d306fcdf956d4da8195bcf98821b878751cafd3116452b0c097f773166cb2a40b5f262f
TLSH
T15BE0206523C7D3E69D01DB478B5C7B1C41F4FACDB69CEA9B330960C4D5901065AF40BA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e20258bfacc524b89c80912de2a14bd2fd32c0ed649876721f057bb5ca4bcf57
MD5 129e4c71c70b5c69635e95de5b24a096
SHA1 597b1b8519a5e31949e67b422962d9e96d961882
SHA512 fb4098a9d74cdeeb9cab627db921a2d090255b4e6ead6464699073ba8b9966f83d824a706ed41e6d1a8f78bb99796021a96a58e428455411b3bbcdfa420d64f9
TLSH
T10771A16F8D0201D3EF210131D1DA1A03373E8DA94913BED1225498BDB82EB67F0D9C78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a851.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a851.TMP
Size 3KB
SHA256 39be9e7987c793bd4d47f4aea77086a1eba986108aa804072c96a550cd5b6a7e
MD5 57c42ae15c5d79cc72992783a9452a54
SHA1 802778235045fe2c409ec078884d3ca2b06bc5b1
SHA512 344e4b05727d851a0d3d8cbf8097ace43a41161ad8577b32077e5344991265d02a0b50949f96da21710ce3c701d4cda0428646848750458e234368d9afa18690
TLSH
T14571816F8D4201D3EF211131D5DA1A03373E8DA94913BED2115498BDB81EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7dcf2731a89d10533bbbcf5716fecb9e035d9eaa4ed6c21c40f0921e9839dbb9
MD5 b225e26c2f6d48a14772433f2df9bcf4
SHA1 df7bd6598658de15b60816cdfbc12fb827193088
SHA512 26da825c58c37287273385e9fbb4a00c3548f9d3a85eac805590bccce04edd990f24e9e9e4aa4abe5291860a3a4c3c69a972ecbad48b89ff495bc2ddce9edf38
TLSH
T1C521CCF3C7E5866EC90116F06A246E1FCE2D050542287C1A89E4EF6BD7E3072E14295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 850a58b8cbe7cf2f022de9a9d88ac2f2eef14e2da5847a7dbce8274be1dc4a9d
MD5 4eaa8b5b4ec73295fc3b23beb7b3a289
SHA1 603f887304d9903d836c91e4f2ad6cf6909ae600
SHA512 defdb733620224902386da315739082148cd0a8dfdb936ee72bfb833e18c9605ec40e2bb84c5ed635c47b67fac513923a6c66806333028403a353e030eb779f2
SSDEEP 192:sxZKROyM/jK1Ml8UQo96/f8sHBn1VIdpLHW6+WNGYwz8bSIg5GJ:sxZK4qe6/f8sHjmLHbGXc
TLSH
T1B1520815AA349977CCDBD209FA51BF53D6F84472A2900E44AAFCCA1C05E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e1ccb769865da79507f743b4a61ff5c2b676feb0df768ea5ee6042aed009dbed
MD5 337e31e944580c7a5d541a71c18ac118
SHA1 8adcb25b4f7f89cc16868ab5dfdd930dab5ae1dc
SHA512 2b8b3ec2bd7a7b596aa4ec3584b25d89be1bb685ba88c1c9b20d9d761a3f2913d2e213dd84d7051e25c605e65ddd5f35222382ea659ca41ba8faa9aa2e1f2bfb
SSDEEP 192:sxZKROyM/jK1Ml8M96/f8sZBAVIdpJHW6+WNGYw8A8SIgrJ:sxZK416/f8sZ6mJHbGX9
TLSH
T1334209156B34A97BCCCBD209FA51BF53D6F94472A2900E44A9FCCA1C04E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7bbadfe43879c4c44a1629ca68a9ab4a6ba1487d1dd3776c1a54ec64f1233434
MD5 cf51f454cdb03c0848e10968b8e3532f
SHA1 3565b7d9b4f5e3831b8f5b256331cc9ddd09d502
SHA512 e5207837837658b363100c9b066dbe458581cb8fafc2f8ebba71c40ae8b2105f067280b8b396c9dcc51f708632d3433eea6b96f850ae097746da68a547aa6bd6
SSDEEP 768:r04jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dirohQcuaJ:r04jeXmWvmKLEu1jacPLZQd5p3
TLSH
T151D20A3B284CCB7E4F844E5CEC26AE976ED801CB6A584D5047FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6e679881426978dbbd6d7b8bec19058edca809516f3f93c3b0df8e43cc164840
MD5 67a29a829e2c31ad4b89c55f271ef642
SHA1 1122ffe1f9c07d3bb24e22bfbd7c07e76883a2cd
SHA512 b588bebc22167657b3a83fb8593af85df9d5bd9ff6642b6e085bd3797bdaec50f6543ff7feb1f8d45832d88103a5f84e819d4cc691095277260c0b3fbdf3fc94
SSDEEP 24:KdZRfZcZHZuaZLdZzZfZn4Z3Zb+Z+IjZ7ZnKiZwhaZFZn1EZRZ3SmZJMZ88ZPZsH:KMUIjKJSUjyxEIHK1+cZvIRKUYMDyj
TLSH
T136919631357E43416E7D250886A8A71B5A52BAA3361CF52F37AC40754E27E166CFDCCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594934.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594934.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e8698d232ef6a50423c5eb83eb637c709953b75c4414015d43074bfdda3e7732
MD5 20e18110cf9b33dded367dd6313591e4
SHA1 f98bb32cf863a8f77ff2ec863df6ec2c39e078e8
SHA512 51b437dd578efc17e2ab60ad1c9531f5939b254943dc23b9011ab22836ecb193851947a2edaef7fe9e8d86e147059ebe87d5c408d6b570db8c0b0d04f2e823be
SSDEEP 384:EiFVZcIRsN58TUNTUlIl7hZjtcEJSf+68R+XGxJrEEFqstoZ:fFtR0wgTbR6ZEhbqUC
TLSH
T151924C3758A8D87BADF69B85F45A32138FF8406BD9D5AF90D2ECAF1D00971AD130AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 3e45d88be041fbf62cf5e0dfb0489ee2c6dd228cc6053e7bce426c18585f391f
MD5 3d91cb769ec4aabadce59aae3ca12c9a
SHA1 76a90958f2c5f9a73e11afa0c0412bb24251208a
SHA512 f4d76aadef4dae79476ab5916a6d3343f5202314782f91d3a830001ff950db45367a42565b73df2ec3244493969da50f59135aaf8152510b02122e4d01feefb8
SSDEEP 384:2ZcIusNn/hZjtcXJSf+68R+XGxJrEQFqstoZ:kuAbQ6ZEhNqUC
TLSH
T1BB727D3658B8AC7758E2A241F44B32139FF8506BAAC96F80D1FCAF1D00D66BD131AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93c4b5facf7e2df4510e0b28d953f27c287f8c76ee2533859f53631508c7f1eb
MD5 dba3a7c5a21be2d77280231e1cfa87dc
SHA1 24dac2656ef84fe55679d2e04257322fc49ddf92
SHA512 08d2f4fccef29bca7b83ce2f383c455091d4bf614fc107d6959e849192831780ba72d0af6fc2764e286d159f79983399a8743e8d01d847ad2bf67f2332bfb3e4
SSDEEP 192:EON86hZ0QmiUyvDpc/+jVIjzorRV5wOZn3U6:EON86okpu+68R023U6
TLSH
T16502E935ACBC6C778EE2AE45F48727235FE4212BA9956F84D6E81B1D00D779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 fad6ba7e40bdb4cf07cd59a0b9bb635a2761194f7048428bc8bbd30ac18c3242
MD5 fce813aad87fd4c829220137ed12d19b
SHA1 e4b9ffd84e12800c79e35d27464ac3d1f1b54fd4
SHA512 f001cf04833bb6cd5c33bb04e6f4d9b3d845201f9849ef29327ebf63e915f61f904a22624192f120acdeea92853978ff5ee0186af12fa4a8c0736967558a2566
SSDEEP 384:2ZcI7sNn/hZjtcEJSf+68R+XGxJrEQFqstoZ:k7AbR6ZEhNqUC
TLSH
T1CB727D3658B8AC775CE2A641F44B32139FF8506BAAC96F80D1FCAF1D00D66B9131AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a331a09cd774b2fcc1c428ef711e20f565fd730fdc3c82b845a0adbb2cab0a2a
MD5 15c84c8cfca05325449fa658793161b7
SHA1 9861ec71272cef43f9d36b9a928b751247d4fc3f
SHA512 523a59bed07a300b4a34e8048061040709e82c9432b84ba1cef4995c87ad334fe4b2f7423c0c7187d4574154c4fb480f1478863b657ed878c8a713417289f5fc
SSDEEP 192:pONi6hZQQmiUy/DOc/+jVIjzorR+XKFuSJrEg5cOq7qdU6:pONi6UiOu+68R+XGxJrEb9qU6
TLSH
T1A3120B36A8A8AC675DD2A555F48732139FE5112BFE8A7F84D2FC1F1C00DB66C131AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1ee14f507c291e2c3aef21b18ecddf464cdf02ad8c6f87ba1e2bd86d82bc16d6
MD5 1b286a4a42cc941e37b552c63553ffc9
SHA1 a05c29af085b8ed0c854b7c1f8998d50397fe559
SHA512 19736f8f231cf6f3d6c0200f571143308950a32e396b3948ea24b1f2d522c4a3b09039cb26149e79335f4d4fd9a33227e0f56c5baeb0fc272ca331a370958d2c
TLSH
T10741E858A6E9114CB3B76E5AABF6A86D487FB8371E0AD45D10110E4F0B62B05C861733
MD5 SHA1 SHA512 TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 6.9MB
SHA256 77548bc2ca7f3352e5a3dbf5971086e01d4075378a8c712daae59bd6c61fbf41
MD5 21f9e041b9b9d9239d6ded3de7879c61
SHA1 1607541ae2531af73cbc9ae4fa72092005ce2cd4
SHA512 4cc899089f8d021ed3fc216cde740960b718334c68e9fa4abc87c8e249a4ef5fd6cc0ed90c4e19d0007de97aa5c73a9504981895519515e29f79ea7912cee7ed
SSDEEP 49152:5jt0/5ijJlYCP4yJOUYQqjlWymRILVe4vdUx4uf0kE0/IqOCPLgMqBLQTpZFh96i:5jt0wdlBoNuffH7SbFm/RLT0BvnUFjR
TLSH
T1D2760721BA5A656CC16AC0B4934B8973AA3534CF0738B8FF45D486713F69EF02B38759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 6.4MB
SHA256 dec2ff2183b7d9293c0d4d68dd1f9dbe9d4fd5160b7ba1968d34e86597297e34
MD5 25a36a2a08d5ad502ec502c86929dc99
SHA1 bef5f147574b418d56f2b25e15fdcdf3cdc2fe7c
SHA512 f83503ac19990bd3057d87b85686948995b62bada4b0f029b147098dad188a3bc7bf267551c4fbbbb5ece5632d06c77d1427fc115ba815bcf9b589d71ddf6aa7
SSDEEP 49152:5jt0/5ijJlYCP4yJOUYQqjlWymRILVe4vdUx4uf0kE0/IqOCPLgMqBLQTpZFh96t:5jt0wdlBoNuffH7SbFm/RLT0Bv3
TLSH
T14166F761BA5A656CC16AC0B4934B8973AA3434CF073878FF45D486713FA9EF02B38759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 7.2MB
SHA256 ba003d41d5cea7fbde95f1009db0a4f9cb9bdbed31af2ed67d522d66f9ec7eff
MD5 782d027a409344f3587ac2238d04ee52
SHA1 742568cca64e37becda11557dbfa496c66324d65
SHA512 bfcd9be9831dde5c23b3ff99e8303a4f5506e1f4ac23af980338d6ff974af65ecb43d0d04bb712c88b7b6d04775a89edc4b6247aed9096cd6a05b1728191f504
SSDEEP 49152:5jt0/5ijJlYCP4yJOUYQqjlWymRILVe4vdUx4uf0kE0/IqOCPLgMqBLQTpZFh968:5jt0wdlBoNuffH7SbFm/RLT0BvnUFjaW
TLSH
T1C8760821BA5A656CC16AC0B4934B8973AA3534CF0738B8FF45D486713F69EF02B38759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 6.8MB
SHA256 d5f63d8d260cf5df9714af7fda81be26b4f40678bc2c323f75cce62955086b1d
MD5 0aac2770e5bee1179d8aa07dbc2ac19a
SHA1 128aeb62f81a307fbaa252432f673b354db2f84a
SHA512 253b39bc1d163faeabbd0b145c6a8406c164d7510a8e90186ced7fb287dd82f3bafcab67b7444a6e7dfdb539c11a1bde0b7d39cf79e50ff64922fb25fa7c7dee
SSDEEP 49152:5jt0/5ijJlYCP4yJOUYQqjlWymRILVe4vdUx4uf0kE0/IqOCPLgMqBLQTpZFh96m:5jt0wdlBoNuffH7SbFm/RLT0BvnUF5
TLSH
T102660721BA5A656CC16AC0B4934B8973AA3534CF0738B8FF45D486713FA9EF01B38759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 6.0MB
SHA256 f04b3185aeca807044f7723e3f38ccac25a78de56548c9cf370d0ab9c1ba99cc
MD5 4cd186578338d406bf46196c735e8cb3
SHA1 aecaeb2aa0487e416cfb2effafdf1fee738bbfb6
SHA512 9117bc458341fa535ec13d944b22feee76922604723eb5d2ed36c7ec2e964615affaf394627e78f6ca4ebb1eda8ab56e2b1065daef58017b943deff8e6813e3e
SSDEEP 49152:5jt0/5ijJlYCP4yJOUYQqjlWymRILVe4vdUx4uf0kE0/IqOCPLgMqBLQTpZFh966:5jt0wdlBoNuffH7SbFm/RLT0BE
TLSH
T15156F661BA5A656CC16BC0B4934B8A739A3434CB073878FF45D486713FA9EF02B38759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 6.8MB
SHA256 89764535eff77f4bc4435e3e3a6f42ad2e75146be7c38c685b4846e5f799b398
MD5 4b5ac62b6b4f33cd9ccf0b20a668ee32
SHA1 3b5d153ea9cd93b8aa9c72f4dbfcbc97e2c7fa82
SHA512 6ef32f36ed4f38cfb0f2e659773e792d5528133b73d7b9a8cfdc89d58bef6f22d93d79f0185c40b2dfd2c05dcd6d4356c49b20acb02b2211bcfe98f4686579b0
SSDEEP 49152:5jt0/5ijJlYCP4yJOUYQqjlWymRILVe4vdUx4uf0kE0/IqOCPLgMqBLQTpZFh96X:5jt0wdlBoNuffH7SbFm/RLT0BvnUFk
TLSH
T173660721BA5A656CC16AC0B4934B8973AA3534CF0738B8FF45D486713FA9EF01B38759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 6.9MB
SHA256 ba931a8a986a002d7e5ab88c4e9dbedafe4899f37a83d1857c04d1628a14fcc9
MD5 51c9bea1718c40e8bd66509e911faf08
SHA1 e00eee1db440ad251b1f073d63553b4ffe527389
SHA512 4a2524e006f6c4ad70218eb2ec7b24af9ee43de43e40f558cff2b7bf3faaec55d4da82477bd4a2fb5984f075931e3573c2cf235cff6673b8e8cf2aeef93255f2
SSDEEP 49152:5jt0/5ijJlYCP4yJOUYQqjlWymRILVe4vdUx4uf0kE0/IqOCPLgMqBLQTpZFh96r:5jt0wdlBoNuffH7SbFm/RLT0BvnUFju
TLSH
T121760721BA5A656CC16AC0B4934B8973AA3534CF0738B8FF45D486713F69EF02B38759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 2.8MB
SHA256 abc58d20a179394285ecd22bb5faa92585fc3c93eeafd0318168e8f0151ecd07
MD5 056b70998c047975dda455a5d9edaa15
SHA1 ff864c08263c4e141acde690ca5bb6160f33a9c2
SHA512 1ed1d4377c66527845fd33fe3918a8c1637a46911ddfb9f4677ebeb8eb4f2ece946bee072bafee24661a4499602b12f54df71b662cbb19dc45ec0e1205c97ada
SSDEEP 49152:5jt0/5ijJlYCP4yJOUYQqjlWymRILVe4vdUx4uf0kEt:5jt0wdlBoNuffHs
TLSH
T165D5E6216A5A656CC16BC0B4938B8A729D7430CF0738B8FF499486B13F59EF52B3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 1.3MB
SHA256 2d520dc44f09aab5b8516a50ce5f288f67232eb9194cc733947fc6b146775df8
MD5 044c14dc002d0b3ed69bbb9c38d49bdb
SHA1 40013038f7daaa89d33fa97e7271974dacc57b9d
SHA512 b89651986255aa0527d3545ebb3bb88f7145a43d8564a4c5f6a61537f729ff04f29cdf2dac8204d5d07449dedc5796fdb03bcdfcaf1c72c5dac3fd7e497ce6cb
SSDEEP 24576:5jtfmu0/FHijfR+cY7ixrGPvpgyCVuyJOUipQFM+x2LP2ElWBtKpmRIut:5jt0/5ijJlYCP4yJOUYQqjlWymRIC
TLSH
T1F165C4642B69A56CC56BC0B493878A725D7430CF0738B8FF489486B13F69EF52B3C658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfa.exe

Path C:\Users\Admin\Downloads\nfa.exe
Size 318KB
SHA256 b84a5654dd29f1f437e1f9d21fd98d1b6ec5ed11f425d649db9c0a79afed890f
MD5 486b05d885f14b9fa51e5a7a81718541
SHA1 6ecae433692354a174df00eaf1145c860ec67f77
SHA512 74eab9cca46cdcb4cf6267a79f48b0fba7ea44549c68ff9f625ea1fdda65ea3224d2ec948a5d43767d888efb95a300a1314c5548072d189c1fdc372a293827a5
SSDEEP 6144:O0IG6Ff7ovbtDrPNsuu1966gZOHhWDUYNqO:OS6yjtfmu0966FHiNh
TLSH
T1F664B3207A9A647CC15BC0B4938B8A725E7474CF073978FF499886713F99EF42B38658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads