e01fe52c0f5ac304b0a8e5b27d2c09bb276c975b562c99722dbaa78fc67cd294

Analysis

user interaction
yes
max time kernel
56s
max time network
60s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FallenWare-Setup.exe
Size 28.0MB
Sample261030-m989waysbx
SHA256 e01fe52c0f5ac304b0a8e5b27d2c09bb276c975b562c99722dbaa78fc67cd294
MD5 f111c2f36c9e2a5385f9667d32f2366d
SHA1 f74ebc368cba9b17946c1db7a6905a04f9280c24
SHA512 3c79bd32499a530ba4365831c30479d0fa02fb322c5f74f8e1be77ddcb6368337bbaf9bc67b43c7222b35822f4d2937224328896367a8b75f6362fff9b337e76
SSDEEP 393216:VTvAXV8AjemBdVV/33ktGl/opPtMca4yFySVb/+Sz41W8nRxPnlPtZRyjzo2oi40:BhAjnb0wKMc9SJ/pM17Z/RyQ2oh318kG
TLSH
T1A157333BB29F613EE46D557A3BB1A721543B6610A8174C46EBF4C49CCF280B10D7EB86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer pyinstaller trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3104	FallenWare-Setup.tmp
560	FallenWare.exe

Loads dropped DLL 37 IoCs

pid	Process
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FallenWare.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-MN6RJXV0PN.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-EOH1QCK6UR.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-AG2811JSNX.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\is-2UF6ZHJJ5F.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\fonts\is-68MKFMILL0.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\fonts\is-NDL6JGQ1OQ.tmp	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.IO.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.IO.MemoryMappedFiles.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.IO.UnmanagedMemoryStream.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Net.WebSockets.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Threading.Thread.dll	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\cryptography-50.0.0.dist-info\sboms\is-7IW9TVNBG6.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\numpy\random\is-LBKCRW4RY6.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-F7OXI0O96C.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\cryptography-50.0.0.dist-info\is-QREE2ZPCAR.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-95QNC5FVAD.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-3RJODOVU47.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\is-XQY8KPI7DY.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\fonts\is-AR36BHLB4B.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\fonts\is-JMGQJ7QLLH.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\webview\js\is-3KHTIJSS2F.tmp	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\clr_loader\ffi\dlls\x86\ClrLoader.dll	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\cryptography-50.0.0.dist-info\is-P6E9T17QSB.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\numpy\random\is-5HEEN407CO.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-PVWQK5ZW3M.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-M4K81ZV123.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\webview\lib\runtimes\win-arm64\native\is-POXAPZVI30.tmp	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\libcrypto-3.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Collections.Concurrent.dll	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\is-WXWB9XATDB.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\is-FTPENZWOWD.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\cryptography-50.0.0.dist-info\is-G18US4I3YO.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-PSJBV3139A.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-E1E6TKBCEZ.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-H1RTHMLIYK.tmp	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\Python.Runtime.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Diagnostics.Tracing.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Runtime.Serialization.Formatters.dll	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\is-OR8HDJ9GWJ.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\is-KIGRTLDCSI.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-C9IU0J3OL2.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-CIXMMBF4UE.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-PK2HO9GF9T.tmp	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Net.Ping.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\api-ms-win-crt-locale-l1-1-0.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Net.NameResolution.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Security.Claims.dll	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\is-77FU9RVXRU.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\numpy\random\is-OC3SAMHRK3.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-1YML4CWL18.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\fonts\is-UCNGYDYM3V.tmp	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\api-ms-win-crt-heap-l1-1-0.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\pythonnet\runtime\System.Net.Requests.dll	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\clr_loader\ffi\dlls\amd64\is-BVE7ID1O7W.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-5BBBJ9NJ9K.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\fonts\is-162IS68JAL.tmp	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\api-ms-win-core-processthreads-l1-1-0.dll	FallenWare-Setup.tmp
File opened for modification	C:\Program Files\FallenWare\_internal\api-ms-win-core-rtlsupport-l1-1-0.dll	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\is-PNI5JL6EHU.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\is-9JY75N5WM4.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\numpy\random\is-OKYXXX6CEG.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-KC66N8X4BU.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\pythonnet\runtime\is-VM3RQIEJGU.tmp	FallenWare-Setup.tmp
File created	C:\Program Files\FallenWare\_internal\src\gui\ui\fonts\is-SGRN64JBOA.tmp	FallenWare-Setup.tmp

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c495-855.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FallenWare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FallenWare.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FallenWare-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FallenWare-Setup.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4136-1-0x00000000003D0000-0x00000000004CE000-memory.dmp	innosetup
behavioral2/memory/4136-8-0x00000000003D0000-0x00000000004CE000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3104	FallenWare-Setup.tmp
3104	FallenWare-Setup.tmp
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe
560	FallenWare.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4316	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	FallenWare.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3104	FallenWare-Setup.tmp
560	FallenWare.exe
560	FallenWare.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
560	FallenWare.exe
560	FallenWare.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3104	4136	FallenWare-Setup.exe	89
PID 3104 wrote to memory of 560	3104	FallenWare-Setup.tmp	90
PID 560 wrote to memory of 4316	560	FallenWare.exe	92
PID 4316 wrote to memory of 2296	4316	msedgewebview2.exe	93
PID 4316 wrote to memory of 4164	4316	msedgewebview2.exe	94
PID 4316 wrote to memory of 4164	4316	msedgewebview2.exe	94
PID 4316 wrote to memory of 4164	4316	msedgewebview2.exe	94
PID 4316 wrote to memory of 4164	4316	msedgewebview2.exe	94
PID 4316 wrote to memory of 3044	4316	msedgewebview2.exe	95
PID 4316 wrote to memory of 2980	4316	msedgewebview2.exe	96
PID 4316 wrote to memory of 2980	4316	msedgewebview2.exe	96
PID 4316 wrote to memory of 2980	4316	msedgewebview2.exe	96
PID 4316 wrote to memory of 5880	4316	msedgewebview2.exe	97
PID 4316 wrote to memory of 5880	4316	msedgewebview2.exe	97
PID 4316 wrote to memory of 5880	4316	msedgewebview2.exe	97
PID 4316 wrote to memory of 5880	4316	msedgewebview2.exe	97
PID 4316 wrote to memory of 5880	4316	msedgewebview2.exe	97
PID 4316 wrote to memory of 1124	4316	msedgewebview2.exe	99
PID 4316 wrote to memory of 1124	4316	msedgewebview2.exe	99
PID 4316 wrote to memory of 1124	4316	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\FallenWare-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\FallenWare-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\is-9PJFJ0BSMB.tmp\FallenWare-Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9PJFJ0BSMB.tmp\FallenWare-Setup.tmp" /SL5="$6014E,28033614,979968,C:\Users\Admin\AppData\Local\Temp\FallenWare-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Program Files\FallenWare\FallenWare.exe
    "C:\Program Files\FallenWare\FallenWare.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FallenWare.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=560.476.1242214301559411036 /pfhostedapp:d90dde532533913cfc145b0307221555af2e8853
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView /prefetch:4 /pfhostedapp:d90dde532533913cfc145b0307221555af2e8853 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ffec5a45fd8,0x7ffec5a45fe4,0x7ffec5a45ff0
        5⤵
        
        PID:2296
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView" --webview-exe-name=FallenWare.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1884 --field-trial-handle=1888,i,14817791386132000622,17425885676730304899,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:d90dde532533913cfc145b0307221555af2e8853
        5⤵
        
        PID:4164
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView" --webview-exe-name=FallenWare.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1888,i,14817791386132000622,17425885676730304899,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:d90dde532533913cfc145b0307221555af2e8853
        5⤵
        
        PID:3044
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView" --webview-exe-name=FallenWare.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1888,i,14817791386132000622,17425885676730304899,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:d90dde532533913cfc145b0307221555af2e8853
        5⤵
        
        PID:2980
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView" --webview-exe-name=FallenWare.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1888,i,14817791386132000622,17425885676730304899,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:d90dde532533913cfc145b0307221555af2e8853 /prefetch:1
        5⤵
        
        PID:5880
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView" --webview-exe-name=FallenWare.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=1888,i,14817791386132000622,17425885676730304899,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:d90dde532533913cfc145b0307221555af2e8853
        5⤵
        
        PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FallenWare.exe

Path C:\Program Files\FallenWare\FallenWare.exe
Size 8.1MB
SHA256 afc7b8465a8551daf6643ae0b8dbcc1c988dc0bafd539274c06c13d4c6791cd9
MD5 db2d996ddfbbdb30391a6829bb3f7d56
SHA1 cb3d4802becf4ed259656b5fbb7d04e48fe93dd5
SHA512 fd7357f3a5271cb39bc35f0f4b48d0eb1d305ef80f61b4689fbb6c327c4d6760eac2c6cd5f848bb9937be3dd5d74b555332ecf6e28f5f425fb12aaa55eb178f0
SSDEEP 196608:DhY1mi4U3RSzX1M6X82F4cceHV0b1/pFDuONGznWtCaz:21mi4U3ue6F4jeg1Dyuft3
TLSH
T18A863368A76202FBFAD3013D9553C416AE79B8DB0F70CADF0764006B6E235D156BDA32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp313-win_amd64.pyd

Path C:\Program Files\FallenWare\_internal\PIL\_imaging.cp313-win_amd64.pyd
Size 2.5MB
SHA256 88756e8e0e3f6180e518da25d379597c861e2d20d716ef001894789b515c1777
MD5 2a2cc91e89b4c2ffd8a3b7c9ff1ba501
SHA1 1b8f537b9c43be807913326947d363d3666ef081
SHA512 a84257af721b6c402fea294ac9e5250423917535dcc17d6e18a860e7e489a463911467d67dc473f8d79881a09679e180a845931285d23d6cbb8287dcf4c2b3bb
SSDEEP 49152:XgfxvpYq3LG6bjJ9HQUfBA9f21kExA+RERbF3:apY+G6bgU5AuAD
TLSH
T128C57C02F591589ADA724034CDAAD626E371780D1BF186F7B684A7F93A33BD03937385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imagingft.cp313-win_amd64.pyd

Path C:\Program Files\FallenWare\_internal\PIL\_imagingft.cp313-win_amd64.pyd
Size 2.1MB
SHA256 e94673a471a0b6fd5e92e8b6cdbdfe16e2e91bcf5689e9e4c9b391ab43788d85
MD5 019bff827c8292f7a6f2509098986ba5
SHA1 70a50a78fd9b382031e6b26b2d8fb06ca3a1e2bd
SHA512 d7944ee60300409887cf8db96762bdcd9a9003416b191f68c7d2f826d41281530342797d980cfd49b6f1f5e885648fc64f7a78d6581e9f0112045517791c8189
SSDEEP 24576:Ppec15WKw+6gZkrSCXDru7JVz7nbH9VXzLUj/RZTGoZ8ZQYLZ1AG9l4UrEad:Rzv6Qf4y9Vzbe/RwQYZ4UAad
TLSH
T1BEA5B042E29641E8D93BC178C657961BE772B40413089BEB59D04B99BF23FF12BBE350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\FallenWare\_internal\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\FallenWare\_internal\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.cp313-win_amd64.pyd

Path C:\Program Files\FallenWare\_internal\_brotli.cp313-win_amd64.pyd
Size 836KB
SHA256 a7f83086a999a01db0ca8cba6d476b4aa74ec2f96292cf4e17446dd30c085c61
MD5 a12922ca715f57039a202053dd08542e
SHA1 674df912137d839b38c35859705a85ddb7d8d961
SHA512 0c2181b95241e7174bc288da2f738e225a0f5a8f312bb6fe57b0e3fbfbc7acc6857fc2da49d246884af6eddb69fc1dcf0574bd59695b15a0ae65e17d3290f1d5
SSDEEP 12288:JD17+oU95/FTDTfi6AHhlyq8hnnb3xKWulsON5:JD1ytbPAilgWulsON
TLSH
T1E7058D0BD8B35779CC2BC4798DAB1336EB357568530085A7B258E5313B43A141BBB3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Program Files\FallenWare\_internal\_bz2.pyd
Size 84KB
SHA256 b4aa26c44a529de7129733a31b73fd74e474b9069edf02d3151d067ac5d52a5c
MD5 997bd232fe207bfa35b18ceaa33b0141
SHA1 d20d6ed779d53dfdfe63a1907030abec45744e22
SHA512 426e784972bd9133216e8fbb115fa972da836650207a8b11acaafddcd1e596ba7ec56679a326d9328687322bb34305d6e3de264ca1d60007c97f567e09908fdc
SSDEEP 1536:qdsvXm8z7+Cnqncm4WlTtdKSzBd9M8eOBs8iMpI+LVzycA89SfIbHUvw:OsvXm8zaYqRptX79veOC8hpI+LVTT7
TLSH
T1F8837D86F36552F6F99FD1B886800793FB30BB950B50A36FF14882993F13B906E5C259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Program Files\FallenWare\_internal\_ctypes.pyd
Size 131KB
SHA256 69ccbfa336004742c18fba4a2d0d24aba5f5e1578983278137788166ea322a22
MD5 a882f7e6611934257cbd711b0e147883
SHA1 6248558adb46a93bfc654155995984f6c7f7c8d8
SHA512 1837968141a2d7217e29182bee77eebcdbf375c6bef7f9842df78997039bff1c9274b93ce8f663d90f882168d2e553d6000f1f30bccedbe0674eccc7337d50a5
SSDEEP 3072:2pDQ+mSmUaodD5Hxf/FSdr0Jrs1jd8lI+yPvJx:LNSmedHf/FSdr2rs1y2
TLSH
T123D37D0B776800AADAA78178C573AF47EBF1B453161047CF02A4C69A2F637966E3F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Program Files\FallenWare\_internal\_elementtree.pyd
Size 133KB
SHA256 efa8e1818f8c5139bd8f1a8916dead7455af16886e46bfe09cc2d03cdc2854f6
MD5 3e7311084ae1937a35db70e4064b88fe
SHA1 2141a43cfa66e82541dced1171fb2afad3c8ae2a
SHA512 b71115e3eefaf0c18f38bd8b010fb078e8544ebec7eefa0a01a44fd70e90854f4342bfe84d760fe06dfad93d6f7ec01dc2f8fa55febceaeeeb3c4d753a5551e6
SSDEEP 3072:Bwz9DNMLHY3kEqmpyUCZBpaogcZOxYhN4Ph6UhD4HcnfiggwX5I+zflTo:BwX3kE1VCZBpRFSKUfiUNo
TLSH
T158D34A9B7265D06BE0A24038D2678B46EBF7F9A20D0087DF1284F69C9F733917E69714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Program Files\FallenWare\_internal\_hashlib.pyd
Size 67KB
SHA256 1ca43d7db5e5b3d8066038ff452b09c1dd525022ad5c4447be94345705caadc8
MD5 4958544013378f0527289f1e33b67843
SHA1 c93646d4df815b268fa30e4029653b5a88e55a8e
SHA512 461b04aadfc580afd4c559aa39ccd9d7baf40ac790122852e86d1ca8cc17ad0bcfe0d9f3d7a5321d957f34a4280f2e9216b57b41e2b50411b774a428f0042ab8
SSDEEP 1536:TqXn1xAu1lEAXfXOfcV5TaPutFCAhI+vImycA89PfIkrEV/:01l1uAmfcyPutFCAhI+vIv7/
TLSH
T1BF637C95AA885092D96782B5C4A30F83F974F35217119BDFA2A8C08E2F233C39777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Program Files\FallenWare\_internal\_lzma.pyd
Size 155KB
SHA256 71387e8484088f8291664312d985f42454017e1f556bd4107e2d065f19a799ec
MD5 2ffd2deb31f6fc775c38fa5c418447d7
SHA1 6d2803366d4b636b0842b7aa72e2de266a3795f8
SHA512 cf9feb887381595b0a763ef4d4b7936bd7f9fd04b5399acc41652bf12e5b21e13c78260c73796c6cbd694e38afec0f09ef72bef11b8088f0ab6390b9266cc86f
SSDEEP 3072:LqZ/boPLmhrKifqGDRJUsAznfB9mNoYvm28fgS+pI+01zi5p:LeTgLhyvUsW5YOYCfd+UAp
TLSH
T1A1F35C86B794F0E5F7728C38D2624F57E6F5791A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Program Files\FallenWare\_internal\_queue.pyd
Size 34KB
SHA256 f1be4ad7af2810ca957ce1bb6122ac821bb284633bdabc872e12e699f5067269
MD5 eae41f95f169385b3052c15fba878b91
SHA1 83be7f66c3ef40d267653af4631746b820f2027b
SHA512 0b14dcd469b700e1d5894dd7ddf43cc32a94e4b7f633e416f30be551d085d882505dd841e7b2005ab34d16596c512552e4b6eb62a7ca777db1850fe5c612f60f
SSDEEP 768:C+Mdm6rL7gVh6lI+9U9kxycTOJh2Ip48Txf1mlIJCl+V5+:8TL7gVIlI+9UiycA89wfIkCEV5+
TLSH
T1EEF27ECA6E684487D963D670C1A2EE91F435F7D3961187DF206992CE1E233C1E339359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Program Files\FallenWare\_internal\_socket.pyd
Size 84KB
SHA256 6050e57e93872e3cd86daeca9594362ad256a9bbe00e0549fa5988a9b43c90e3
MD5 dd6662e9ba30e92aed000afea211bb4b
SHA1 3375c998e12d9cb604206628651611d41baa5597
SHA512 980034687ce3119e0e282ad81076076385842b32bfaa5a79c38b8780e46bd06ac0bd7cf58ff0050c43dacc90b0e481da069c2b449d2917cf878365b21c6d516f
SSDEEP 1536:+Fl/fFBFuJaBvTl5CgDyJw9QlyJ+9+nzX34KxtS4XSylI+ywaycA89jZfIk8EV8:+FR1uJmB9yJw9QlyJs+nzXIKxB5lI+y4
TLSH
T14B836B00A66041FAEB73D075C2639E62FB74F5C113A1A75F1066C65A1F33382BE7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Program Files\FallenWare\_internal\_ssl.pyd
Size 177KB
SHA256 5f113a6b4cc933646ef69aa233da278bd311f7f04135a8ea6e1514944af3f851
MD5 38c014c3eaa0f00c6e0e7c1c6ae389ef
SHA1 26a73ba3460ce5aa3a9d40c481db7dad3a4a5c88
SHA512 1c72f8efe2652aa1ad4db8a46346cdbef57bfc97f092c4133429cb6ad0fabf61d22bd79385ac0ed04b16410b4df058fc349a0ab2c5aac4f1c6343e11097ac383
SSDEEP 3072:6ofR8NKUKIUlfV6CsLzsvyII7IM/cbPuC/JgpI+L7K2:6oZuKUNyV6Cs8vySy9
TLSH
T1FD048C47B5945AF7E813E4F9C2234903EBB4F145331247DE48D6D64A0F0374AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Program Files\FallenWare\_internal\_uuid.pyd
Size 27KB
SHA256 5a69ec3bc4b082b03f84fdad1d9a67d00575c5b23fdd3776607e4653376611cb
MD5 69a4dc04e5b4f19711c31829f2d0671f
SHA1 5e9bd8674747796607595a06b17b83bd03e56b45
SHA512 17b5355545505fbf11a78d2efe580e2fde17e22a1f6d322b9e0a6f5230f02094a905425625d8ef5fc573fda9aa67a15ac1cebe0cb12c3e6d9607d5750a64f5ff
SSDEEP 768:nnVj5npI+0wbxycTOJh2Ip4HXtTxf1mlIJQl+Vm:nnVj5npI+0w9ycA89HXHfIkQEVm
TLSH
T187C26D8A9A648043FE579B70C1E1DF82F939F7D35A21875B317A91990D133C1B32A3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Program Files\FallenWare\_internal\_wmi.pyd
Size 38KB
SHA256 440ccba82699e5cca4975ad68fa4338d66295dbf9abf391b924ed1d22fe90857
MD5 c74d640c9ad293130ef714bbbd67567b
SHA1 6f7b6167f016e8c7f91ca9977ba1342e5229ed97
SHA512 87d4d362300c622dd5441c50c82cfb950094dab9aaa04e8f88e899900cdfb932561aeec74e668b5e6495ddf9182daad08139594440e31ed94c82723b77015f0c
SSDEEP 768:y2/EEqrVmjs0urkc9+upI+LiixycTOJh2Ip4TeTxf1ml9dHYjLHLU:XE9BEkrkc9+upI+LiKycA89ifIbHYvo
TLSH
T186037D89E6640092EA67CA74C5A5CE93F534F7935B12878F326682590F333D0E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd

Path C:\Program Files\FallenWare\_internal\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
Size 221KB
SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
MD5 ebe91ea40d152dd778e975805369e4c3
SHA1 793150512a5cf9a5da394ea0882683e3d4fa5122
SHA512 8c1369dd31e13687dc9c2e059c98dcab175944e4f1a9eec3ac384599f4a79274a9899cc17015de08d74addd8460949fa7fd141f57eb05deab6d3b0cb3706e4e5
SSDEEP 6144:UYuBpEZSXmSFhx8cQxkP8VXaVlaz8fnt4HtFmiGJyMItUxCRv:fuBGZShx8crIl
TLSH
T140243A3662880062ED7752758C63E123DAF2B161473262CF05E0CBA55F27BDAB6FDB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.cp313-win_amd64.pyd

Path C:\Program Files\FallenWare\_internal\backports\zstd\_zstd.cp313-win_amd64.pyd
Size 596KB
SHA256 667a2340c5456c83b7abe23a02a239d1a2fd861173af237a5263c3e4ea760779
MD5 60f4d264dfe8918e89c5bd766dd58438
SHA1 abdc8060fed4c1d5fbd850198d9ddf1ec978d9bb
SHA512 692ee2f2f7359a082558ef810678dad6ffbf95a1ecd45fa6ff0fe512105b267c6380fdf9dfe7399d92166d74d5c631a21de75f24f1dd8f07f05076006889bb97
SSDEEP 12288:qyOcrvobYe8FDaKEVP/a5OMZVBSl9Aut:qyzQb38FDaKEVXa5OM
TLSH
T163D45D83F2DA61BDD116D0B5EA6F8227EB71788893007993D3A4DB247F1B9618F34352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Program Files\FallenWare\_internal\base_library.zip
Size 1.3MB
SHA256 48039007ec6d404bab477afca7504968cb52d9a4d77061a26e4397f6d755b3a9
MD5 e56da557790ac5c18e7119a5ae5fc8d1
SHA1 a12754f6a88d2f5355bfdbbb37b8672516c0d8c1
SHA512 89861d973fd3b7d93116ccd50af5ac13e08aef848b9300ea328b7cdb133ad2a1775bc01e542e39d3740e95de323a326f03ad5c41af84f6c5e11893b000c8935e
SSDEEP 12288:hzwtr+i2cPPdxhYe6XdjdThDW7WpguIva80201jwCVRDVoioSYBSFUDqf/VHv7t5:lT5cPPdxhYpdZo7WpglQ+SuTxrqim
TLSH
T1FC551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp313-win_amd64.pyd

Path C:\Program Files\FallenWare\_internal\charset_normalizer\cd.cp313-win_amd64.pyd
Size 10KB
SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
MD5 83c5bb15d82a7ec2b207b9c38d6e1018
SHA1 3f065b16e1e2405861a72f6c9e287f317b3034ab
SHA512 062a5f098e8b134869e9daa2219de73ff9ce86945a975e7d472a929d4fa14804b3120b818e7e4498fa9e22e06265236910e3e74c58d35f88b2621043aaf9b8b3
SSDEEP 192:RD0eIaQYVYZuLnN6KxvecRo930aeG1TbhGuE9H7EuO5:jkYVVLN6Kxxo93wmAuEZ4l
TLSH
T1E522E54CFA568CF6DB25023989A70F5E31B5BA25179237CF53B0C12E1EE3BE65278580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Program Files\FallenWare\_internal\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files\FallenWare\_internal\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Program Files\FallenWare\_internal\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.pyw

Path C:\Program Files\FallenWare\_internal\main.pyw
Size 2KB
SHA256 9a1b44ea6a47dfc6b5522734081fa1639bcdbb6f9f9c779947f38abd8958824a
MD5 17b143ca86e1563dfa7067220d6bf98f
SHA1 58d4526075b0a09428ea6b8b0a498d13aca6ac17
SHA512 5683c94ed1d7467552d18de3ddf2876a6b08d4ac93525e133e94793a49fb6acf2e0e045f08e1b025770e32012ba4b0a06a667f89ea94d53ca82c857b9c760b6f
TLSH
T11B4174278C8525B26763C1AD626A50C187539C339B243839F8CCE3746FC456ACAB29FC
MD5 SHA1 SHA512 TLSH

Submit Download

is-GDM244VVQQ.tmp

Path C:\Program Files\FallenWare\_internal\numpy-2.5.2.dist-info\is-GDM244VVQQ.tmp
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

pyexpat.pyd

Path C:\Program Files\FallenWare\_internal\pyexpat.pyd
Size 213KB
SHA256 985e29b7adc365f606c594913675288879f3ce2f44d7a7db49595fbc098541df
MD5 c7c54122b1c7d44fb8e6e9dd6fc38b0b
SHA1 8ab214fb99d2154437567942ebbaded6efd03021
SHA512 35d46dc774e3ac4ad1be94b989a48c81a1a0a6072e5e4da06ef605cc4bc7e1d51e045c36e60ce8adefb74285d8fcc79e5b4e1efc98f473aa092ce7f3a658449b
SSDEEP 6144:mj3Ffy5HkQqJIYUdxgMCNOaR6eFhFJWpdg1:ifyUJODEhLWpo
TLSH
T174247D5BB261C0E6D853C03CE5968B13DAB2B86603909BCF52C4EB7C9F2B7517B29315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Program Files\FallenWare\_internal\python3.DLL
Size 70KB
SHA256 f950ce3bf381d5ffae90cf63ec9c9761f1666d9a570e2f203a7f22da6f8e14f3
MD5 49574e64cbaff0f9f1e9d26aabfe8f1e
SHA1 e5defed38027a49e30c330dc5328e26bc4e0e855
SHA512 34a08197a9cfa5c96c4d12e1fabe5d327d872251a6b63d09fe5eb83bfc2fb41feca8d1ddfeccb5ab21bbaed5b9035a03e79468872f9242b0331553fb027a9cf5
SSDEEP 768:/QEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:FotssyKcunV8PslI+y0tycA89ufIYNC
TLSH
T1F2633BC25B5BF8A2E6F665FC78DDD9CD242B02CC53258D9FA47993920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Program Files\FallenWare\_internal\python313.dll
Size 5.8MB
SHA256 e7119fc5892eab890d44f6df05f44d50cf8c390c35d152e589e0c35781ca8d05
MD5 cd97c71c844e73f7a16373986713c6e0
SHA1 d008edd8312a144a7931ea55ffee5a81a758433d
SHA512 02d694ad447003f154b431e2aafdd109a18708d4e9404f188783095c1d57a2fc550bc015019c90512ac107f157edf3895c1f64835355eef043c9ed2313d45aaf
SSDEEP 49152:uP8kZddDjowbHQXoPgpde7l0zCfrAsrFGeEsAtaonjutBPHy1RfqLg0bJsMI4Men:uTjNf1JUsrp75La9iWKvHHDMiExj8
TLSH
T1BA568C16729E51ACC9778078CA03864BFBB27C057FA0434B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Program Files\FallenWare\_internal\select.pyd
Size 32KB
SHA256 0dc63cb35f1776d732cb3fbbbdd9e5912b29a98465d3927a8162e8475c0f6809
MD5 607b447ff1316dbc660e49f9b7c3641b
SHA1 08213476a928259a4c65d122f482c4e9d561d8f4
SHA512 d9a76715dbb55104a62a29aa44a26a63322e0e888c7502534175c5ed2b3aa9a1d608128a7319f72dbefb1f2a689926ceac79a3cf9d647cad529e6881855070b5
SSDEEP 768:epX5AHf8mHzPlI+9GSxycTOJh2Ip492Txf1mlIJcl+Vk:6X5A/8mHzPlI+9GaycA890fIkcEVk
TLSH
T1D3E26DCA6F745047E563C631C5D2DE82F939B3E34661869F31B981990E277C1A33A268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Program Files\FallenWare\_internal\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

Sortable.min.js

Path C:\Program Files\FallenWare\_internal\src\gui\ui\Sortable.min.js
Size 44KB
SHA256 6d0a831fc19b4bae851797ad3393157e861afb7862459c11226359b27e2c4337
MD5 863954b5b2962eff9072617e1299b95b
SHA1 18a2566c3d8eb4e884f0d2fbcf395ce4216925e7
SHA512 72c227839cdc07e5e9ba54546be7afd732a8ef344d1a911a55f341f4e9f59e8f4a613118feb2c6004129be0770ea78a6d56753ba28596357aa677d4aeff7d98f
SSDEEP 768:iYkC5DfNzWNNMB3RQ9bYo9+7kPo1yU5x0NDKiLjh8FzNOUQvW49UPewRk:i+Df0N83RUE7f0NxLxmS
TLSH
T15C1319CDB3483A395ADB52B1827F460A72315594BC0A9028B43FCDD86D7C42A529BF7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Program Files\FallenWare\_internal\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Program Files\FallenWare\_internal\unicodedata.pyd
Size 695KB
SHA256 2b8c8d837e2968751a581e1c6e91447b0db672c2a1496362942df654afddc11d
MD5 3d6fef286bc7f64b6c64c9565be42107
SHA1 bf4d89da4c20aecb5fdd9143bfb8eb6814d3b255
SHA512 696f56911ba68e1b556fee6431fcc5e19ad7d676e50496157fa014f7bdf510a30b75fcf0a01b68c55cd335ff6c4ab95fde8c9ccd951f7152c0537c5324cb4780
SSDEEP 12288:lY1dLI/X77mvfldCKGihH32W3cnPSqrUgYmMGJ:lY1W7qNxr3cnPXY/GJ
TLSH
T11DE4F5D9BBCF9D26E68B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.json

Path C:\Program Files\FallenWare\_internal\version.json
Size 27B
SHA256 ee6a7a082711bccfd9f75bb61d127333d9a46748600d99d38d3efb577b4f8722
MD5 9f8e3a0573d666c3aaa9ae2ab2568ba4
SHA1 db569d1dcc605ac39b0c884458738be01c225f06
SHA512 8d50488f95299d326038244288f52dd6da38df442209f037095b0089d341957816baf04854f1bf364bb4110943480dacb7ff3216c3c0051c4ae5dc06c0a1be29
MD5 SHA1 SHA512

Submit Download

FallenWare-Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-9PJFJ0BSMB.tmp\FallenWare-Setup.tmp
Size 4.3MB
SHA256 7bf20ea68df42a40409186b4647ec4e8d6ecbdd368ac53e24b7e2453f6208aa6
MD5 f9ecb1454a817f805daf15257296058a
SHA1 e013fab2a6c3fe28937f7d9136c669f3385ed670
SHA512 83798e972e6ffd5bfed191dfeb49e168e5216bcbcd643506c6ed5efc5d5db48c4724c12785ac6c1fe117f907472eaf6056fed1839ce168fc22fb775b7b07258f
SSDEEP 98304:D9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JH333DL:YItJj90Z6RgKwcL
TLSH
T1FB268F03B388753EE4B71B3A883FA654583F7A213A26CD4B6BF4095C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99cb7f41-e419-4637-8fbe-c6344893c9ea.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\99cb7f41-e419-4637-8fbe-c6344893c9ea.tmp
Size 15KB
SHA256 f9998a88cda428a54062cbcefa167160e0459221c1060d4ef918934238d1708f
MD5 c3284432bd6e6745ab127e3d8ae94f49
SHA1 5afb571dd7c56a4c0a4190a237ec244ec2352aa0
SHA512 d8e377d974c2a7e53a6c756323404f636c41d1a400c0eeec8bc33e010acb9a31e6fc3704036f614445b0b72be4335507b2012c18b4b999447a915f76e58343ef
SSDEEP 384:B+OBqImmJvGBLx3NaFMJFNNBSHXhDalEe8g6r1:McvGtlNgX1mEeyp
TLSH
T1E872AE7B2C256A732CBBC50ABA8D2347CB696153C4D47FE4DDECAF0F116B0881342855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7e93223139bc9c75dd0de439d3a749992e227eb7134f648b5087936fed0a600e
MD5 8a13f0f47a6520a2e5c2a06e329be6cd
SHA1 a6a51b51097a46d6562fceac328c4c151d8e3751
SHA512 20ca4c9c62e78e4c07573d708f332ddbacf6875852d38c59dcc2ce6a732a9f9ab596455a29e83dd92a2aaadbe94c36c492f0db0bf2d28a93978efc1fe7a4b3ab
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 950bc0ffd588fa0f18e053876a75e11e3543bc7da48034b2229603276c607374
MD5 0ee3d85bca63af8d525688e9ff095b6b
SHA1 59a307477606a8c04db58489b5c8c426d85b9c7f
SHA512 9bf722df4afca46b2cac7cca93c25959be8b9b91f72b02f707f261f522dcbf21906b38073ebc1a197f0ba6f91ee25455168aff4da9f212d5e446e91e9201222c
TLSH
T134D024177305057CC01030730443754C0401D10F404D4000753CC51D5F54C51DF03453
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\Local State
Size 1KB
SHA256 73788e44cec92ab3f51dd02ce76de81819b7545e5295967ef4cd7ef3a0178efd
MD5 0f0e6db4aa7bb58139eff6b1d6af61ba
SHA1 615fbd6dbbaabfb2a57b2d71f33db9442b864465
SHA512 ebc00492a1413a548c0790049266c10fe05e55852c1c8bd4d31653b9a25c34f2b98ba65d95bb1227120f21c017abf3f12ab397fab6e1c92350f9af4eb4a00884
TLSH
T1B2216276E0649B32EC57A64B36163B5BAFA6502A91508F009ADE0A2803A718DA205C36
MD5 SHA1 SHA512 TLSH

Submit Download

c8479e38-5854-4dcd-8067-71624a809796.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\c8479e38-5854-4dcd-8067-71624a809796.tmp
Size 2KB
SHA256 c4abc41d199adb09f4c453bd964bb5e099dd2115288de6e25d8e3f0dcc0c86ee
MD5 ffd5a9cf9e33a0a95db98a3fc0402c40
SHA1 932031b59faa97655b0f7b32bc5b8a8c13aa6d7e
SHA512 efda4ba4dac7612739f270b34a78bb146d3ad5813956276d3b0dc09657726029e2c80ab3c6e711874da64828759aedfc0ed3e78b39718e1e1947017c02fa015b
TLSH
T1FB519533A824AA77D9A7D6497A4A3F23DF7A9061A9511F209ADD1B1802D718C2341C37
MD5 SHA1 SHA512 TLSH

Submit Download

e5d88fc9-2a95-4c00-b0b8-9e70a18e8059.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpl_ja00o0\EBWebView\e5d88fc9-2a95-4c00-b0b8-9e70a18e8059.tmp
Size 3KB
SHA256 01f09905a75980eb69a637a520dc1e8ca8356144710db195ed88835fc1267f36
MD5 5d14f31c7cf7b472fa838e7e08185694
SHA1 f66b827c9109178553a8c5c15902c99e1645c3d6
SHA512 587a17f01373f6f182c13ae0329045ff41e226af2a106c44e04d9873b8783a4c04aa65b1a1aded6920d85e10fac4ebfc0d8344405eb9225f99f516da7bcfbb77
TLSH
T1F061993A6874A9379DB3DA0979863B16FBA65022E8957F65CAEC1F0C02D72CC2341C17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-929-0x000001FF3A450000-0x000001FF3A4C4000-memory.dmp

Download

memory/560-941-0x000001FF3A450000-0x000001FF3A45E000-memory.dmp

Download

memory/560-936-0x000001FF3B7A0000-0x000001FF3B7C2000-memory.dmp

Download

memory/560-937-0x000001FF3BD90000-0x000001FF3C34A000-memory.dmp

Download

memory/560-938-0x000001FF3A450000-0x000001FF3A458000-memory.dmp

Download

memory/560-939-0x000001FF3A450000-0x000001FF3A458000-memory.dmp

Download

memory/560-940-0x000001FF3B880000-0x000001FF3B922000-memory.dmp

Download

memory/560-927-0x000001FF21DC0000-0x000001FF21DCA000-memory.dmp

Download

memory/560-942-0x000001FF3B7D0000-0x000001FF3B7D8000-memory.dmp

Download

memory/560-943-0x000001FF3B810000-0x000001FF3B818000-memory.dmp

Download

memory/560-934-0x000001FF3A440000-0x000001FF3A448000-memory.dmp

Download

memory/560-933-0x000001FF3A430000-0x000001FF3A438000-memory.dmp

Download

memory/560-932-0x000001FF3A4B0000-0x000001FF3A4CA000-memory.dmp

Download

memory/560-935-0x000001FF3B620000-0x000001FF3B628000-memory.dmp

Download

memory/560-928-0x00007FFEDDEE0000-0x00007FFEDDEEA000-memory.dmp

Download

memory/560-925-0x000001FF20890000-0x000001FF20891000-memory.dmp

Download

memory/3104-6-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/3104-1091-0x00000000000B0000-0x0000000000509000-memory.dmp

Download

memory/3104-10-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/3104-9-0x00000000000B0000-0x0000000000509000-memory.dmp

Download

memory/3104-859-0x00000000000B0000-0x0000000000509000-memory.dmp

Download

memory/4136-1-0x00000000003D0000-0x00000000004CE000-memory.dmp

Download

memory/4136-8-0x00000000003D0000-0x00000000004CE000-memory.dmp

Download

memory/4164-969-0x00007FFEECB80000-0x00007FFEECB81000-memory.dmp

Download

memory/4164-1118-0x000001FAB67E0000-0x000001FAB6888000-memory.dmp

Download

memory/5880-1043-0x00007FFEECB80000-0x00007FFEECB81000-memory.dmp

Download