Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/05/2024, 12:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe
Resource
win7-20240508-en
windows7-x64
19 signatures
150 seconds
General
- Target 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe
- Size 3.3MB
- Sample240522-p2ereaca5s
- SHA256 22a2d3edcd3df6d935fdac14f782271f1d5194b8ecccfebb18093be105b0751c
- MD5 d8cff1fa43f25a07553492b7703a065c
- SHA1 def2bb08af72f5d9b2789a738b3ccb34948641a8
- SHA512 a1b03a1b30d15bcde602a1bd41913eb099a5d8d6fe3da269ee351a6723e16fa525d0cc78cfe01194ee8672b526b46bb2b3c4f27a285a0c842d65209183e319e9
- SSDEEP 49152:hGtaLZd5KAxBtFNPBN3N+rwItb94g2ZPV/yiwbRoNrT:hGoLZd5KAxrFNZN3NUwItb94NPV/yu3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/files/0x0009000000022912-1.dat UPX behavioral2/memory/2712-4-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/3312-29-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/3312-35-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2576-39-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2576-43-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/3940-41-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/3940-50-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/4260-52-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/4260-54-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2712-86-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2712-87-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2712-107-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2712-126-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2712-224-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/2712-249-0x0000000010000000-0x0000000010030000-memory.dmp UPX - Modifies AppInit DLL entries 2 TTPs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000022912-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Loads dropped DLL 5 IoCs
pid Process 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 3312 regsvr32.exe 2576 regsvr32.exe 3940 regsvr32.exe 4260 regsvr32.exe -
resource yara_rule behavioral2/files/0x0009000000022912-1.dat upx behavioral2/memory/2712-4-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3312-29-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3312-35-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2576-39-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2576-43-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3940-41-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3940-50-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4260-52-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4260-54-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2712-86-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2712-87-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2712-107-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2712-126-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2712-224-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2712-249-0x0000000010000000-0x0000000010030000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe /onboot" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\contexts = "243" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetAll.htm" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "142" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\https\ 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\ftp\ 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\http\ 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe" 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 548 msedge.exe 548 msedge.exe 2368 msedge.exe 2368 msedge.exe 4696 identity_helper.exe 4696 identity_helper.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 6076 msedge.exe 6076 msedge.exe 6076 msedge.exe 6076 msedge.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Token: SeRestorePrivilege 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe Token: SeDebugPrivilege 3312 regsvr32.exe Token: SeDebugPrivilege 2576 regsvr32.exe Token: SeDebugPrivilege 3940 regsvr32.exe Token: SeDebugPrivilege 4260 regsvr32.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe - Suspicious use of SendNotifyMessage 25 IoCs
pid Process 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2368 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 89 PID 2712 wrote to memory of 2368 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 89 PID 2368 wrote to memory of 2904 2368 msedge.exe 90 PID 2368 wrote to memory of 2904 2368 msedge.exe 90 PID 2712 wrote to memory of 3312 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 91 PID 2712 wrote to memory of 3312 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 91 PID 2712 wrote to memory of 3312 2712 2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe 91 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 3200 2368 msedge.exe 92 PID 2368 wrote to memory of 548 2368 msedge.exe 93 PID 2368 wrote to memory of 548 2368 msedge.exe 93 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94 PID 2368 wrote to memory of 4788 2368 msedge.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_d8cff1fa43f25a07553492b7703a065c_floxif_icedid.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/welcome.html?v=607b82⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccb2d46f8,0x7ffccb2d4708,0x7ffccb2d47183⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:23⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:83⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:13⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:13⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:13⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:83⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:13⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:13⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:13⤵PID:1772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:13⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15593407507026885848,8391381491881094857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:6076
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4800
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4520
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 175B
- SHA256 eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
- MD5 1130c911bf5db4b8f7cf9b6f4b457623
- SHA1 48e734c4bc1a8b5399bff4954e54b268bde9d54c
- SHA512 94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 4e39ea84479d4cb06ff9c6697cf7b9ec70f7ddf9f17309ef8e1bc311fd524142
- MD5 ef18a0b75a8a7b349f6c79b71aeb4931
- SHA1 170bd53e1b7781fcfd529b498f54e943edf9c714
- SHA512 69ba783c7d8ba284c541f30ab12dc3fb8e13c8da9368d2935f54c4e87e365168696fca010597211589d8c7edb192df6d59ce77caa8b1d17cf4e656408fc61d1b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 199B
- SHA256 9efb98c82acfd9249755e0be0107a0f8909e34dfe9ee23d2c7b5042f21bf7592
- MD5 cc952a0ec78aee2c6bc393212307f9aa
- SHA1 6b295f8f7b0254124afdc515bca325fdb3b48e6a
- SHA512 a9eb04e158cebe1121bfa2ac57a3b4135068310f956d65dbfee319ba3da225962761d9af03e5acbc6b375182df29a437324f789f6ad759a5df6bb122fe8ebd30
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 1c3fb8f9c71788cda94f09b1b4435f00c1c6646a4ce1794b9530a6f06f66f7a8
- MD5 eaf31393fe948c645265ba7c24affa5b
- SHA1 eadde4088794744ebda88759b47ead328ff09245
- SHA512 c430e0fa1229ad2c937c80457c10ec145bc683084632c44a1f85429061624ee8875bac0b43d0a43c1c3ccfaad24f549ddb858fd7c479c2db9e03669e3840d1b4
- SSDEEP 96:nJkvR1x2UJaZjuwpvWMoiVmdeHvSSWjUWQyV+VDCziEwb:nJkpfrJaZjuGWMXIjro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 37b12da83fdc261a13417f8faaa164ae954ab507a4f8f33e7a75510f4b0a832b
- MD5 fd5332584d1636ac8135f24daad9428a
- SHA1 13fce505e9658982fb467883886e3e0674f9ce0d
- SHA512 2be72002381db6fcac966be471fd80a95dad9ff145be2279b72f7afc31021ff5211744de94971411128081d73a3c203a87d53a0f8f92ffc8dbada17e6045d989
- SSDEEP 96:nJkKR1x2UJanjuwpvWMoiVmdeOuG1jvSRFWjUWQyV+VD7AiEwb:nJkefrJanjuGWM+uGh9jrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 f00cae46f2853f917988a74621a6f1eed97c4bd84e03b2fc52be6dd40d80471b
- MD5 05cba80c82c39089239ef5f42e6a6976
- SHA1 b027b6831ab940295251cfbf29088664204c0c7d
- SHA512 b409e50cdf809ac12452fbc2bf735786bb5f5713b85ca1121c170bf20e25c27db5875c489f42a157b059c4d1072792b286a30551db6d56634db1211d7a2dfb0f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1J1Gyde2RUUm4uonL3z2O/:A9iIxuERzA83h09RZxY1J1Gy5ZykLaO/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\update607_1\update607_1.log
- Size 1KB
- SHA256 4e5d6e2096ba64b953c0e44a85e4340bad94097b687971fc1465d6887daf5bdf
- MD5 2a553dbbef56508ce2c1827ce71faed7
- SHA1 33af15efae7074bc5c79b21aed73100484bad231
- SHA512 d58d05a9067f7b153e0985ae5faa1eb6abc82d17e825b291b50c372c0c6db6989d73f28284c0123960c69c79558ab86fb9fb1e2161adf19fbeb8cfe9e1f61634
- MD5 SHA1 SHA512