floxif | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
204s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

floxif backdoor bootkit discovery persistence trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000800000001d8b5-538.dat	floxif

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe
File created	C:\Windows\SysWOW64\drivers\spoclsv.exe	Gnil.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000800000001d8b5-538.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
6044	spoclsv.exe
3944	Free YouTube Downloader.exe

Loads dropped DLL 2 IoCs

pid	Process
5768	Floxif.exe
5896	Floxif.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ClassicShell.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5768-541-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x000800000001d8b5-538.dat	upx
behavioral1/memory/5768-544-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5896-547-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5896-550-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5844	5768	WerFault.exe	143
5952	5896	WerFault.exe	146
3572	5184	WerFault.exe	161

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alerta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClassicShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlashKiller.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\THE_HEURISTIC_OF_NORTON_IS_VERY_BAD_AND_PRODUCE:POSITIVES-FALSES	WScript.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4828	WINWORD.EXE
4828	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1168	msedge.exe
1168	msedge.exe
3848	identity_helper.exe
3848	identity_helper.exe
1860	msedge.exe
1860	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
5768	Floxif.exe
5768	Floxif.exe
6016	Gnil.exe
6016	Gnil.exe
6016	Gnil.exe
6016	Gnil.exe
6016	Gnil.exe
6016	Gnil.exe
6044	spoclsv.exe
6044	spoclsv.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5768	Floxif.exe
Token: SeDebugPrivilege	5896	Floxif.exe
Token: SeAuditPrivilege	4556	WINWORD.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
3944	Free YouTube Downloader.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4828	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4556	WINWORD.EXE
4912	FreeYoutubeDownloader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1920	1168	msedge.exe	82
PID 1168 wrote to memory of 1920	1168	msedge.exe	82
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 4376	1168	msedge.exe	83
PID 1168 wrote to memory of 1436	1168	msedge.exe	84
PID 1168 wrote to memory of 1436	1168	msedge.exe	84
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85
PID 1168 wrote to memory of 2040	1168	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc46f246f8,0x7ffc46f24708,0x7ffc46f24718
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1396 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9724340292634786910,13459146147360865949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2160

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:432

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4576

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Melissa.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Floxif\Floxif.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Floxif\Floxif.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 432
  2⤵
  - Program crash
  PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 5768 -ip 5768
1⤵
PID:5820

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Floxif\Floxif.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Floxif\Floxif.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 408
  2⤵
  - Program crash
  PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5896 -ip 5896
1⤵
PID:5932

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\Gnil\Gnil.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6016
- C:\Windows\SysWOW64\drivers\spoclsv.exe
  C:\Windows\system32\drivers\spoclsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6044

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Carewmr.vbs"
1⤵
- NTFS ADS
PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.avp.ru/
  2⤵
  PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc46f246f8,0x7ffc46f24708,0x7ffc46f24718
    3⤵
    PID:5216

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ClassicShell.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ClassicShell.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:5860

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ColorBug.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ColorBug.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1596

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\FlashKiller.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\FlashKiller.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 240
  2⤵
  - Program crash
  PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5184 -ip 5184
1⤵
PID:2352

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Frankenstein.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\FreeYoutubeDownloader.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4912
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SendNotifyMessage
  PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
471B

MD5
0f4717b52caa82774dd22c5ab72c0f87

SHA1
c1b720ffc33cf79b5561d118d13afb137965ba63

SHA256
df721db9ecdd176810d298d286a1d5d4dea6517903458dec247a1ccdbc458d04

SHA512
1960ec6874930da15dd3966016582327de1a34dd65df0aa1cd9f7968bdc616795e41cb36610142e79c661829ef887eba8a842a75ddf6e7dfdba6acb6aa643c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
56c916b69bbf8e145c66a2fb4ff6d7ec

SHA1
b4961c8510e476aa0f42f7e224ea6f060ec63a9a

SHA256
54c1e3f108e7bed90fe9fec57b572641d5d7eaaa778b9a7adc39f01c89f7a685

SHA512
d2087cfbf4b07906e66073f66c551331d5f5bf9e562bd8ae712ff4a120f832acc1924c2fe8a86fa179b7e802c4690154baa071378ed2b1be5b1c5c91382ba1bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9fab59bd8e18266c8e2d9b6d44551ac9

SHA1
9913e25ac0f6d97157f23eaebb42c47aec1091f5

SHA256
93510554ac0840426a1fa0ee016d75543860b248abec2b850a907365be5aaccf

SHA512
2c2e4ba17cf9424407941930d44882935c5d233899ea0c804a3bde78d35b337b0b3a2e4d6378015b33e46b70e6be021d77b79718bbdccefee5415519df2121b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
0028a1a5c441a3cd5a60c34da771564f

SHA1
e15d27a8322b435564ebcd36467b997d0fa8ef32

SHA256
8dc36283781a25af9e2ae76d255ae311b2715396f710ff0e9850b0e64525759d

SHA512
e26efd2be3114e733acdc00fb54150790872b10c88a7c4d3a19a16383bf58897ad89f14b3255a984f836666b98bafc099d8988532d03acda0dee7a7a7da3f40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4254ecc603c97bcfca71143dfd2c6256

SHA1
3c301334cb88bf992aaffdb9bd89efd061e8ce73

SHA256
c4c2548d614e051c95f0da317819bd697ec44df0e844221d328041d6e381238b

SHA512
8d4eb9f7f08a897fb004428e1ba0e644ec04280b0071b6acbd594750261ef67af7d12ef12ca43c65fe1f02447824b2682801736c7510c7ee81991f6d14646bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96cbb59a159ca2f1ecf508684dd46c0f

SHA1
3cc98e57e7bfc18cacf067380bb0ee08d8163f97

SHA256
c5ed3d03f5ffbfb3c5a94ad0a77e7aaa5d0549ca0e168e09fb4e16331fe73d3c

SHA512
644830a23d8e648123c2a835681631a5017ad94992f13201e801b28096ad4bd4db4af16168ae2fd2178e46b85454b1a03cd6997650945252a23d8f38ab2049f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53cc669f7800fa0ba7b18ba43b0c8467

SHA1
a15a0a7838cedfa7576eea8a7add61d07521ec0c

SHA256
0b0b610af2c28e89675551638377b993661f689c44540e9008a591e9372161b3

SHA512
77c77fad2b663c0d0f2d2876cad2f1e2effd32a00634ab2cbbf0640df6f4aa0662750ded71ec821012b73ae5892c2365eb0733c02b01f28148ea40bdbd8b7d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4ec4dd713efb31a77205f7ae3236647f

SHA1
b6ca9ecb9d0e0a40ce81b1560a00dbba9f351454

SHA256
69aa2bfb9cabd6c5d9f1f141319ed8bbe72fefcb9aecb39976c3a944278a8d33

SHA512
f8b1e789f8f07135414a0e93f40455a018f246f04cff19cdbf664692d61e708916e30502baf8f275af94b6e6ba2fb943d01b7dbda0be0c64523c1fed990956a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
941285d8d5ce564585ec029340ad9732

SHA1
5aff51f24ea56e755a63661898491c5cd2549a21

SHA256
09dbfeee0fa19d6333ea1e8f21d580e5c29dac17d3bffbdbc1965bc3723df50a

SHA512
abfcc4ebbbd3459331894be867940de8cdf1e4403b5a1caf1959f6dd59033e141d84cec066bbf51a70f1328cd4e6e4625332a9674ab505d1bcb43759f988b095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
08439f81c2ae8625749f51671eed09d7

SHA1
37673b8ddaeac8a63e3d3406a3bfff0ea89fe9ae

SHA256
6dddf663055ec331dde49ad36608776a780aee89a9053b91ca5ab61ec03a0955

SHA512
e7b5ff2a0206807e9afdd66549d13ea8f60d903d997ad0bbdc4d332d208665fab705dc6569a3431e1ea54d600959332934bc72e4013c93892d369b90f009f362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582035.TMP

Filesize
874B

MD5
d5a00fd6fb3466e51f29f1dfae229c5f

SHA1
041b4e800d0ef12a12060ec62f96083be440d2ad

SHA256
fa98fc1674edecbe5b021f7216b1e80ee9ce1bff5b6e1bd35882ea4b2c9f093b

SHA512
6167f291cdd496eac9a2aa846ce4ec75dffd6741cb07c1eead3c4cd60b2835014dcb82ec64659f78985eb6fa8408ea7f26cdc34828e91cf3d7dcb7eac8934bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1beed76d047136846a70c2f29b30c1da

SHA1
529dc9a6ecf78344fd528c92fa157a73c297f305

SHA256
363370d9d587331d64889f185af616dcd6ab11aae6c57b792f6c0fc6541e5368

SHA512
058306a43436db56102268e7d260d564a01cb928c7eca3e98da0e9069a6a18dfd98db9c85a2aaefdcc11610caa321c11424f4fbfa953b9cbc7957df8b754b0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
371bfc8729de18120ffd77caeada6333

SHA1
cb5e0b3756410c22e953dad88c7149c0bb792c90

SHA256
6a538035baaa0b2626650b10e0f2b14c96070a0921319717dda72f2a2951b63f

SHA512
73678536591cccab6dccd5ed6f6efac2b525183782a5c5b3c8ad40bc71a916c4642933a5a7012441a8bd7cbf864dc5fc842b44effe6ea8f7b9ea3184389c180c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1ef1d498cdc2e7a6c7fc5c1958a00441

SHA1
f9b8fd5e1628856f18a877583c8085e30b6304bf

SHA256
6cdc8c1740a67dec86c36164039a658ab44e27f1152e681c528070065a54a5a7

SHA512
0e53efa401e2e6327cb598b291f4b337e7c14fab34abcb15e3322cfef9197b9d7434e5a31c81ca92ab6cc278755fcc496fcd659f56c879c2e7c3f314a751dde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6662faf-bbf9-4729-82fb-f860a0f47750.tmp

Filesize
11KB

MD5
9fe16ed1ceaad3ea2f3b0652a9a7d121

SHA1
434885bc6ee32a6887eb95757ea9525e21443a17

SHA256
1e778a1d36f28583cdba27dbe88c247f056a2659c78f7cbcf4edb895c9f8c7e0

SHA512
864ab4cf884be00a81e41ef6ce474e059dc3f434d772eb810ae5a1aa5aa81ebe5699968804acd36b3c6fefea00efa31a107bdb672a617df424b31b1a4378cece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\3AF7C5AC-7735-4BBF-AB6F-6503CA93085A

Filesize
177KB

MD5
8d5bb185fc0783b0b1c7954e8e545dc0

SHA1
cb9e04b07963eafe2979dab421ebbe201726c74d

SHA256
00e097e46e754ee969515b6e57a7363ede8c9da930664cb61f6ca50ed1d35af0

SHA512
bd9d7f824b94c9b5d6d20d30e3ccd9570c0a01ee36d05a1dadba3b44334151fc40f06aebeb8a37fec30b7a98fd07cac6574e005faffca1777b1f410790065e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
11KB

MD5
68fabd3d75add239514956fe27579094

SHA1
2417e8148c6f2c61ef503674c08f773f6f3d9e4c

SHA256
50f25cc60583b6d0eaf552d8c32a1321943b6ed77d95dbf1bac58c981a0a4479

SHA512
8a0529ebf47b39093e55786c4719b568e9846ab3428e73d0139c4323e9de00f5e4591e07a56e1ea960146297cf8b9f1943fe8d14ffd17df199c53cd82abb7ebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
8665de22b67e46648a5a147c1ed296ca

SHA1
b289a96fee9fa77dd8e045ae8fd161debd376f48

SHA256
b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

SHA512
bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
a64653d64585bdb161f17cf16b5dff38

SHA1
f9ca7dd034bbba4ab43d64700a361d16959457c0

SHA256
32ec11996445af02f46f8ae033de51c01c0e5409bedd4223285d76e65884dbfc

SHA512
0d6ddb5c03359600b8f57615fcbf5913ffc31b72c2ba68e6b5cfb819b8e4d38c1185ef8719c78e4a7563424b5c18cc85f1dc996d8835dde6bca8e3548f4ac7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
913e89f519a52d55dfb49b56403afde3

SHA1
bfdb6835425099155f781ec2f5e7aba7095437ee

SHA256
35618c078390528b83373786cd73b3c5f870bca319110338bc0924de5960d12f

SHA512
d62a39a06f3359ff68a456ffafd7e7ea58c69a8f48558392c4f622ec1545ae3270a79d555705d0c5e8ad949fc448740350ea54922c91657d45036c5608ef3215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
450d7474af1deb75b9302c405d72ab9b

SHA1
ccbfa1ba817a87d8926ade6c8f976e4b4dffa304

SHA256
f10d2589f69ef01fd681260029e2df84f45c09694de032c1aebeac6e24337dc2

SHA512
74051a47a8bca2a498e891be3949bce9f5b2f17efbabacea70e6c32d2fccbcaf3c421db24abde291975e667ec6d169183a2082c6ca2e1f6836305efc5346e971

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
430B

MD5
0d1047ffb5f08fe388c78bb1da51a5dc

SHA1
c8f1d033223eb3c735e5b6175ee9bd7557ace467

SHA256
45b53ce3856e557710bd7f76d88fd973a12125e18b23b6590cb91a764426791b

SHA512
5ccc8bbd8aec6c2f3d7f07d0a3e9f4b3c81f6b4969d7814bd2b5f4c7dee78591c2f1411bf290fd9881566ca0472d088852befbb6be40dd99ff6a960a5e099c53

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
478B

MD5
5ccd48164297fd44825621b14fc262c6

SHA1
a8d5fb22e1bab3da125422099cd7f424e04a3880

SHA256
acbdec41510b4e4581c3c8248336e6b9b7ac2aacac22bc97c9d0f32f92d16fb6

SHA512
c5322965bf771932add5096d374aaac06305eb65af7863fcbbeb4df8972b2aa0c2c5a10d5c494749d2a3f5835b65f8d42b30f4d2cfed262789db04ac5880e408

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
31KB

MD5
3390db346699dcecbef01ccacbeaeb0c

SHA1
ca8e858cf1bda8d66c96e5100abdcbcc8269d12c

SHA256
f1f23da411a3b0fe6ef733bd873a96dd14a94fa9620c93237453b0cc848d3b88

SHA512
d4a1340fe2eee9a26cceba6fe8a973a1c33a95b32dffbe39263dafc85fa4c32a17200d03d763abee0bba744cb425b080023f7a12562c922ee6d35330d5a02a0c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
5KB

MD5
ec67c0eced6a2a71992807fa2c8d71cd

SHA1
f901ae5ef19fc4e1b6ae5ca236228cb55500de6b

SHA256
f4a7f3b318c98386100d62a84d5031c7485d990bfa0c65e49d8bd167678b89b2

SHA512
f8a6b0cff23745057848c5cdef9dcb897c6bb94a6c9addeb4cc4400fe4e4c937f766cbf2fda99588ba11bdca957dd880fc394cb5bf94fc63f8913dd4a6ef8f65

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
4KB

MD5
b66ebb40f3d4c56238f8c5e9614330d5

SHA1
af83f78c0c7c5c774964aaf2d1b0a06abdc21223

SHA256
3ab5120a0f4006e0e9d688162ceb168f6e51a559e032251078fb67a9119d0b1d

SHA512
e33142a9929904ac4e4e3a6f3a95b28734b9cdbb3b627280497c5680be23497c2d4e28d2dd4e521c9b45f92367d1f2a67cafc73b5647f9dea5251400ba114579

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\~WRD0000.tmp

Filesize
511KB

MD5
403bb648940a23bf92abe457a4a2fc90

SHA1
9488f2f25ea0015a321d78719e56ea4a922cb21f

SHA256
ffd26e7e419743335abe72da95e95fcc6d571d73a408bf0fbf72bc5e662f1865

SHA512
036c7fc38e2ec6d38d9f53fc4da319880ab247c8da97c441a959cd58dd67bdaf9c154ec3f0b87dc45d636d5242347da91fcb0664b9efb474da1ec4731ed9c60d

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
C:\Windows\SysWOW64\drivers\spoclsv.exe

Filesize
73KB

MD5
37e887b7a048ddb9013c8d2a26d5b740

SHA1
713b4678c05a76dbd22e6f8d738c9ef655e70226

SHA256
24c0638ff7571c7f4df5bcddd50bc478195823e934481fa3ee96eb1d1c4b4a1b

SHA512
99f74eb00c6f6d1cbecb4d88e1056222e236cb85cf2a421243b63cd481939d3c4693e08edde743722d3320c27573fbcc99bf749ff72b857831e4b6667374b8af

Download Submit
memory/1596-673-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3944-746-0x000002A6D3BE0000-0x000002A6D3C0E000-memory.dmp

Filesize
184KB

Download
memory/4556-832-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-835-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-834-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-833-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-681-0x00007FFC12D30000-0x00007FFC12D40000-memory.dmp

Filesize
64KB

Download
memory/4556-675-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-677-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-676-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-678-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-679-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4556-680-0x00007FFC12D30000-0x00007FFC12D40000-memory.dmp

Filesize
64KB

Download
memory/4828-418-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4828-526-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4828-417-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4828-416-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4828-415-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4828-419-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4828-420-0x00007FFC12D30000-0x00007FFC12D40000-memory.dmp

Filesize
64KB

Download
memory/4828-421-0x00007FFC12D30000-0x00007FFC12D40000-memory.dmp

Filesize
64KB

Download
memory/4828-525-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4828-527-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4828-524-0x00007FFC15450000-0x00007FFC15460000-memory.dmp

Filesize
64KB

Download
memory/4912-745-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5184-674-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/5768-541-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5768-544-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5768-543-0x0000000000DA0000-0x0000000000E15000-memory.dmp

Filesize
468KB

Download
memory/5860-672-0x0000000000400000-0x0000000000AD8000-memory.dmp

Filesize
6.8MB

Download
memory/5896-547-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5896-548-0x0000000000DA0000-0x0000000000E15000-memory.dmp

Filesize
468KB

Download
memory/5896-550-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/6016-551-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/6016-557-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/6044-556-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download