floxif | a8ec8938bce8bf5ab8a66f3bcf33856c29dda4fb386b0cb1c74c3e0e533aee1d

Analysis

max time kernel
76s
max time network
141s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
02-02-2025 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Size

3.2MB
MD5

438477464455a8f1a0d103cd9b55f799
SHA1

b297eca959049877ea8b49f887fbdc2e8c654faa
SHA256

a8ec8938bce8bf5ab8a66f3bcf33856c29dda4fb386b0cb1c74c3e0e533aee1d
SHA512

8de060960a973b00fbc2c04b75d38054f8b51bbfebe1947e98b56c133a36441b2f755915343fe4568df0e4b5447737df715d2944aa3eb879f6df7bd30dd633f1
SSDEEP

49152:iejNYFEUg27EvmG0ilvGD2tJ/G1ZwPSP5Syi414+9FY:iSNSgIEvz0ilvGD2tJ/G0aP5SyjXq

Score

10^/10

floxif adware backdoor defense_evasion discovery persistence privilege_escalation stealer trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000c000000012266-1.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000012266-1.dat	acprotect

Loads dropped DLL 7 IoCs

pid	Process
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
2512	IEXPLORE.EXE
3016	regsvr32.exe
2828	regsvr32.exe
2804	regsvr32.exe
2252	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe /onboot"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012266-1.dat	upx
behavioral1/memory/1736-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3016-20-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2252-27-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2804-26-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2828-24-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2828-29-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2252-33-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3016-31-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1736-23-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2804-34-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1736-79-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1736-300-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\progra~1\common~1\system\symsrv.dll.000	IEXPLORE.EXE
File created	C:\Program Files\Common Files\System\symsrv.dll	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetVL.htm"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\contexts = "243"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download all links with IDM	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24871AF1-E13F-11EF-B985-56CF32F83AF3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff2a927a59d6034a970be4a867827723000000000200000000001066000000010000200000006f99fe0d4b3144b128be89f518e7495803e9cb97008a1597a306073cd35b37da000000000e8000000002000020000000f38bd6925205c33afa998095770a1b52c37db6ef70197da2be0aa01dfd6a57ce90000000e671a05f4458f9c3b5743283bcc0477307e5bb3b76ff804a01ec9bbef20e81b64b64a4d6fa3caf5b5231c30726e3ca74382d4f5ac3ca2e56d61e4164b6a557305e6fdc9c4da95491378fd5b609948f0dd21cf87f2216b549beab77ced192856dac7dc56a51b6830da203be5a421bcce8a3ea9420badabc9389b73b92f5d09eb40522790e6dd4a51cbd0dd6bdd1521f96400000003e9f3efd6791c0ee7e2046d2dcac0c565c5ff23929ea16bd6b6c1722eb0e2b1c519b409ab1ba24d873c20a701116e1a285e3f4226476686e72e5b26464d5e0dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetAll.htm"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444646547"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff2a927a59d6034a970be4a86782772300000000020000000000106600000001000020000000dc95036db071a81813712d7db4b174123e7c0290b019e5de888bb6d5cd54e5b4000000000e800000000200002000000046fa2e5ca7258778a819dbc694fba6bfd17fc3cbe7cad39c5af79a67deb5fff620000000802559c7f0f29653d64298e880413ac88dc60350e9dcf41d78600740dce0bd54400000002b7d1a660b4154c830119c35bcf9ad817d42b9ca256e7497c5a3167c9d17c66a0249d43213ce416a959f58a247885c79b50e652e97ad6dbb8e9dff2dfbfc358f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b971fc4b75db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\contexts = "243"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "32"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\https\	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\ftp\	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\CLSID	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe"	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\http\	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\IDM\ Feb 02 08:24:43.217 2025 Unknown error during CDownloaderDlg::OnTimer(nIDEvent = UPDATE_IE_DLL_TIMER) uq‹R”’’>£šš9¯¢¢4¼\È»º&ÎÆÄÊÇÅ ÁÁÁÀÀÀ	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Token: SeRestorePrivilege	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
Token: SeDebugPrivilege	2512	IEXPLORE.EXE
Token: SeDebugPrivilege	2804	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
3048	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
3048	iexplore.exe
3048	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 3048	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	31
PID 1736 wrote to memory of 3048	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	31
PID 1736 wrote to memory of 3048	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	31
PID 1736 wrote to memory of 3048	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	31
PID 1736 wrote to memory of 3016	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	32
PID 1736 wrote to memory of 3016	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	32
PID 1736 wrote to memory of 3016	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	32
PID 1736 wrote to memory of 3016	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	32
PID 1736 wrote to memory of 3016	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	32
PID 1736 wrote to memory of 3016	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	32
PID 1736 wrote to memory of 3016	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	32
PID 1736 wrote to memory of 2252	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	33
PID 1736 wrote to memory of 2252	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	33
PID 1736 wrote to memory of 2252	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	33
PID 1736 wrote to memory of 2252	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	33
PID 1736 wrote to memory of 2252	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	33
PID 1736 wrote to memory of 2252	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	33
PID 1736 wrote to memory of 2252	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	33
PID 3048 wrote to memory of 2512	3048	iexplore.exe	34
PID 3048 wrote to memory of 2512	3048	iexplore.exe	34
PID 3048 wrote to memory of 2512	3048	iexplore.exe	34
PID 3048 wrote to memory of 2512	3048	iexplore.exe	34
PID 1736 wrote to memory of 2804	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	35
PID 1736 wrote to memory of 2804	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	35
PID 1736 wrote to memory of 2804	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	35
PID 1736 wrote to memory of 2804	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	35
PID 1736 wrote to memory of 2804	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	35
PID 1736 wrote to memory of 2804	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	35
PID 1736 wrote to memory of 2804	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	35
PID 1736 wrote to memory of 2828	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	36
PID 1736 wrote to memory of 2828	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	36
PID 1736 wrote to memory of 2828	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	36
PID 1736 wrote to memory of 2828	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	36
PID 1736 wrote to memory of 2828	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	36
PID 1736 wrote to memory of 2828	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	36
PID 1736 wrote to memory of 2828	1736	2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe	36

C:\Users\Admin\AppData\Local\Temp\2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-02_438477464455a8f1a0d103cd9b55f799_floxif_icedid.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.internetdownloadmanager.com/welcome.html?v=604b2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2512
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3016
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2252
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52c1db49ad7a6423b0df9d103ab3b8e6

SHA1
ed86bb8f060b1edd5c58851cd0feb8f23ace5e87

SHA256
be5a307b142f7d0be595b358fe6ea6a5ff988ca1b0883d5cfd655499224285d3

SHA512
1c6bc156359ef73a397fae76454e42a05fc3029be4710b8d844dd4d2fea47015906dc977f8c53511a409e4b5c416a27d1488eed5c581afd7cb6b3316d4c6db1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a5e3055a991c7204f9f2dfe2357b82b

SHA1
9db2f8b3ef15f899dfba6dc42f4cf17c4a23226e

SHA256
3d1da21b6535e0415c0d83e0b20d7c21d3ac9efc5c764930fb6d785518d8e387

SHA512
51c5aee9882556ec20a5285e69df8acceb26b12e32d946d2fcf8e7c1070d69f9901012c5f775de7795bc264e73587aabd77b2ca8b5c026bf5ebac5b2f7aa0cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9542a82037f660df8f5770308948d1d0

SHA1
3bdf592672c0e1ac967635e2b80069c42f6866ad

SHA256
bbc0ff40c7b2d7da1a09e5326d30e0a5cd50253bcf75cb9f59a32def0d912396

SHA512
4e5eabc2055860bf58999918c1222378b77dd8fba6934099c7533cad9f9c858190d8fb7deaaa29c43cf28501eb6fd55cb3d6fec948dc84f3443a912a351b4aae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf968c4921621a1a32d4e930247f93a6

SHA1
5d9b47b5910c08b48942369ceb95331e5b246176

SHA256
bcb617f8c4b3112c49f46b34a30e24b17f4f838a230ef489490133350e4388da

SHA512
22fbebfa133ec3b3e66fce212b065fea71a2a162cc4a957de8e2f96a606fa9804dac8cf07752679082464d1b02a5fb1ae63e959497ff610ba5280f45a8f4703e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f7ee9d657eb3f75ab962fc318c83f46

SHA1
d4ffea2a1984eea51bb65b489a0c90040c925a8a

SHA256
77284032cfdaebd227ab992d3a13de53608fd8ba10d09584c6e32f0443cfb78c

SHA512
289ee1e19a4d5c4a1cdb52f44b05b8fe8783016189e74dd78bb5445dc80ca1ea2446ed0cec1f925707bc8edbdb1b3e3d61b3c04c6cddb1d09ce7b17897ed306e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194f16fab53c8cf44686c845849d912b

SHA1
91437ecf7ac40311e6bff24c34a291ab03a50ef4

SHA256
b33bab6a6c04d4eb310bb7686ab9119e91f22983ee7cdf5c577fcc0c430c331e

SHA512
73c492fc421fe685d3de1b4936649f966d6cd9cb588b0ffa6123bb7a2c4a821bea8a3d4c558255b54a3269591fc564a8b7c627a7cef2be4d6c27b0119703a418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a24c0ae62d13884b135e91e6f72709f5

SHA1
f5e2ebd66c114c615c16ca34279947d9a6ea70bc

SHA256
980d0347163b4cf0754be63fe90ff63ca6851aa308434a5577424801a8305f5d

SHA512
2a6f5b56f68850a0567810c75779528ac30ee21dca7f845136d704b8f237a37542334f8d11708ff4a5f56c9c9d8cd8fc6838dda1e730640bf7970395e03a9c32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daaaedfc4cc4d120d3079ef319a65b78

SHA1
2c077e0cb042e3422ba88c400fddc19d8cf9226d

SHA256
dd43131575509d6c36313b287987a461f5ea592aca53bb604108ab57af588613

SHA512
82249ec17a1ff887871c033734873b9d8d8770c9511c5bdd36c04546f6acab786506aae886c69f9d2920af3f14d48ff235954712d6a4b60c54c534943521e3f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb6579285eaaba4c7df0b74b8a4f4b86

SHA1
68c89e242412ea2a65ff1ccdd0663b338550a547

SHA256
c70d32a642a840903d160ebed43bea51cd84a23f9c319b531777af2828a54569

SHA512
d75d074b37568a572f4d9860f9a3f2bebbf7f658e6f3f84661599b26b0fce9f2716bdc3afb48f93180bfd6af651d5ddb03183413946bad2654f40f2485a483ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
626ae0987405bc298765bd5e2b2dd4a3

SHA1
aebfac29097800575eb02b6dc9460017f1de47d0

SHA256
b6fd31921a5df8b172f4d2fa1c3a6e704c19fb17fd63da454e06dd2509875c90

SHA512
43383a2f992240c58ebcc18f25f1bf1b555d8300fed851bafa5cbb284dc41a5ba8343c8b3808f0598d3272940fd45daa64fe49f416bed1003aab01adbef86d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50f12fa7175b28a2bca6bb29ff30f6d4

SHA1
77c461ef7f43ebd3510ee57ed99f96d09cc58920

SHA256
965e2290ea4bdd2e25f27d91459a79a6f47d2a91557fb5a78d3df91c76a83b23

SHA512
5556b64ee042f0c493ba5b57f226b9cd6c4e3b1f5210d7f4f85e8161488cf459c0d214e05f64fcccc62160438dfe0d64b68152b7e8f1a42f40621ff0335ee589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54ac26a5c2935134765a2c6979aa957f

SHA1
192f30f82fe8d33196a26ec268b9266b4a33f1b3

SHA256
6b387535e71e9787ac0a6d36c1b92978dc1ca9675deba7e779e795cda0a1db7d

SHA512
1c46a7c1f559ea2ea897f50361fde22fbb31c0a1b2eb1457bff869b8d427b59acb1a738c7f34794fbeeb2180f4838b2e5263044476f6e7fd741e1cc677c6a724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e40ee201a18d5772b26d49f426d01c63

SHA1
691b0146e3264d4277217424cf8eec4b6292e527

SHA256
f301077a5cabef2358e98704b613d772f8287ecc48c7058433bc0f40c5bf1191

SHA512
44c24e3cce4488c532108040ef055f2c777a1ddeee289c08925b2a39615a81373b50c89f47612cdd2bc08f55cfb39a34de0f304ed0f8150507cf162539482d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
264f0f5b69901b232f2bc0b312d1decd

SHA1
40e5c6ca86a08393a375757ffc15be88d8ca76c3

SHA256
11ef4ef267ffff9a6e7bc813edf8a9f34be4fb4e51c6d214c8c09420e8269f54

SHA512
352358b6d70a892fa6374847c0f6aba971a10508e0e39b4492c00b767488a0b092a1b27abf8c6b4da33bec2d3313b547d3d8dacef7e8bd2dc9d56eb8b2e7095f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d026f07ce94b8f7dc77542d3fe765b6

SHA1
e6ad8b105082651920677a76232e413f44d9938a

SHA256
5e27aff7bf14607739fb9a7672c21319d4d81be786e2abc44f829674728808a8

SHA512
9d84f0250370f7a24a5856808adaebb59a79dcfab7490f004c82c373249449e81d257ed2b7573306515c5c1c4221b3243ec4014be6e13a4a985da9dd4174f114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2537644c09f749b3b37508e8a92f5261

SHA1
be309ab72acea8436c6adbe485333dbbcd62775b

SHA256
54926a6603e39a5c82cb42882633ec3b9821dc415ba065171a8a3364f18b0e35

SHA512
6250873d9a7cc9a16d915d17d6b862b6d97180bdb8bcbda384ee0a83c4ad4898cd44de5ad97d1cdd7b7df2a905d7e978e5e317245caee34dd0725fc30d2dd9da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bdb82dd5eef658f384887264031df4d

SHA1
130a3c8f2928968054706adcdf15745785e504a7

SHA256
c163125135a1427e6e2a4ab16a49c7af242cebc78c47744a1b29208ff1903032

SHA512
977f0920d8fa82fc36811462594f0aad08d4e35d02e3d3257c46ab818f00c399722ea2cf5a1c308b06e095d09e7361209429b38a02d0f64534dfe96b411622c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4cf74bfb6666d1b5f8d815bfc658ff2

SHA1
f9e6b52a3064f8c25522a92be2528e96188d9b80

SHA256
4f9ecc7753b38f2391eb7882109c822561fa6fceec56af0efe17c40a1da66423

SHA512
a7f16b338a7a3fa59f1f9197f12185ce43c30547dd58ed73129e4cacdcfcf383a43f87cb46b74b971dfc5b3acb7ad0d71b4f474a6023214d6b7b4c1a082078a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41f0841d1db7c36d2803e147556109a4

SHA1
daef3e207ed781a905118b2670c97426c53d109b

SHA256
4ef4fdb5971b5c1153b6e167b65104df3e9a962e4fc07e1a74dd688344e21fe4

SHA512
f5ec17340f6521b1ff08487b6739f19660bdc66261c4aab4fdb7756caf37c713951ebb8f5abf35c0d98a4e2db824d72ac5ef389b0999413983ec44086cb6d507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41508be2eceb33fe14b95c22d5254422

SHA1
7bcbdf5fa4e25b333f84518601d981d03fd57a5f

SHA256
0a04a6c919efed6384b7ef06d842fe18f3ca9daea05247b6e56055fb0a27cefc

SHA512
99f71f005bac8b1509df4d848fd6810f938113dc584cb77e715776882c64979f96fc9e03e3a7463b4eafba9d71928a20b84c7f1e621be1aaeea43783887103f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43e583dd4e0a4f57d692b370783bd901

SHA1
156e452373d6ba3511793fbbfd680f3e7d0cbe9e

SHA256
81bd3c10a4b1e3754c4c7bbdf6d00276be144554fcfbce38c72845fc06bbb17d

SHA512
ee8009fdfb0da7825cf9a2ef5d1581aa8abc1f0f9abf1cd20e89bc55bdda20aca88bf4fa7f24a2d64823c071de0af3e951042933426486b5166800c5ed030e39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caaef16571dde8a09adad1c9d9392700

SHA1
4438587377a467432fa452b68f71f3e83eca2dc6

SHA256
04321bfe2ff1b7c68031f1379be77070dcb686204a31294c812f5ed1aae1643d

SHA512
2a512ecf57a5430f1ffaeda621d8bc62ac7ef879fc4487fd592e993111ec163dca68381068c642888af2256943db0790a3fbd66f9ca2df3faccdc2f2256c3391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b435d73b305a6f9935d1b1253273a5f

SHA1
ac8d253d0b0a32e689dcaf4b234be31d7556fb4e

SHA256
abbb899fd149ce1f10138589300b77f07a3bd49227d1f48a9473be111cc919cf

SHA512
94443c7bc8394860c3ed27a8f3fc8d23b3afa5cc20d67bfcf5ee5197a0b4775048714797e4bfd65773f760bd722066901f3514d25ca619f944d54be3fc0a3285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f6ee487954285fa2bd3adcb066561c2

SHA1
71344c4147d66a6d70399fc4dedb6be74426e3b6

SHA256
fc7644241a4b37d66761d635b0884f92153decba5430f63a29778a5eb1065b1e

SHA512
cb97a9aba93443964c59692d80cc78f062af7646d1e28f868d75b7379ead79170c5c993184b44ddefeb646da8bbd2e84ec56726d5dd6dc5c607be87302aa687b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99fa53c484d17fca43832cdd0bcc208e

SHA1
a5c9e2959a2e8eb4cf1c44dfc1bdb2809d44ad07

SHA256
4fafbe8f52e829e47b80affc3f58c2e71bcf86f66c5e0f9de2b9c8ed89fefe53

SHA512
43646df39f08228036e9e9aa4d7def26b32a4c6d6e6334d86022c995aaa09e3dd5237bafaf587ce65a3c4fd5dd777d70a104a29a93df8460b09cb443e79b37e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db90fbc643ba0565bd734ae97561972

SHA1
7706660f49f64287db6d20a2848673ed8f1e0aa6

SHA256
3334416c868cb9739dc4fbdb15318aa5fb9565d6d2fbdcaf1b75d94fdce27ac2

SHA512
0ef4e35ae982673e31c9db8bf00f96da867449beafa1966dc1d02f5b36788465c0075f2e86f8a7ee65616d3082e37be6717775791908727d04ac437854223bf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9a2a23ed837eb8d5ab08a5c46ae5408

SHA1
49a673d02a467b6f6b1b384373f1ffc5987e506a

SHA256
10cf0ceaa20193626525f0b782bad3a42b8c167d218a2a8b18982ddaae94e153

SHA512
ca82bb5967f591afb18755fd3c6c557278b450853946a7811d3a22375f192ddce648e7bb24074ef0483b57ae49235e793d737e4827a4faa541d34df005955a1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35767d812a4bc64e4064dd4b8803e475

SHA1
37b9043258f8e3ce1ecbefa11a71e9f4a7c70e99

SHA256
4be4e697004e180fbd29353b9b28e53779687a5dcc5ce7cab6889ddca17d009f

SHA512
7d9fe35961311cde539cfa672dd5c89edccbc78e848bf073edbbb1420616dbabd47547e44170ad132cb11b537644676b6a08182c21f876a38061b307030358fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2456435f3bdc85715ddbb54b7cc51d2

SHA1
d24d915b9a88c7bd1810d3b447de70d1fa9b8ccc

SHA256
e4c19dd4ad03d3ffa40aebaff5a9a3f69d2ae0eb771c60edf059af455af7a0ad

SHA512
e0128d7780538ea4c9854ff196098deaebb0486ce7a7ab0987013de481a3ff8932c8b022b329b47818e9f46ffd7a59966ad7ea02d296286d023b6457f202bfcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f237123185c128442826137ee72dd80b

SHA1
15ec29dade20a18557b89531c1bcc75ddf19a11e

SHA256
5dc68f89e16046a4c0ac0fc61f48e199919508efda403f35dc8ba02ed5a47dca

SHA512
36b0fce8cde8db9430fe4f44c064d748ee0bde8c06a3eecf7675669b8a7f44023e422e6802b84b60e8e64eb4e4d9bde28f83c550b6991bfac895526e16d8ae8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f902d9b37c244088fbdde74e5a6e614a

SHA1
48f835f63fb377913e6d138bcbb4f99d18bf54d0

SHA256
e113bb7323973510e540c60894fb7c2eec0e14ce8034d4cdd900cf2b167a4ce3

SHA512
29b7006e9db5094811b1c0267a3de4eb50e18a4c7ed63e9e9e3477e17d814abb1f35d91cdb985f498bb8233ba0455469870dbd5bfdcae9475a69701524f9a5c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\melo7gx\imagestore.dat

Filesize
914B

MD5
344004fd28bd5dff6b17e4ab5b4f84f2

SHA1
2c4286991c01807a0b8746031345e53c6d18adaf

SHA256
595147cbaa318c41febedfb1f6fd58575b5f11b2035f1548caa194e08b151f4a

SHA512
4ae717a9f47dc25732ea2578b1150099ac17025952af2af7f7bab10363af74ea16bc77db91e9f97a9e17c063d8c4e6b1e6fe0e1e41bec455d8e92827840c3640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\favicon[1].ico

Filesize
766B

MD5
b4cb0049adba2125f0aebe6418b7d30d

SHA1
f7991b45a6561f66b22a8bf8e791612c39321135

SHA256
d5b1fa67c87513e54815ec9f9a5388c2435d51a4d36a246f1df3f7bd792a0d05

SHA512
1188024f27920f0d86ddbb2ee3e17714dfb7d0ea383fffb0164151b3e3d43826fc4e585231c384496e223907f22c16ace6aa088133c39881f4e16ce8a0c4b655

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC15E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC190.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\??\c:\progra~1\common~1\system\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\A1D26E2\B8D493C6C8.tmp

Filesize
3.1MB

MD5
9e05900550121972572a85995e583987

SHA1
83505e6a30bf8c1c95f1970647db73f2c8cfa192

SHA256
fa49180bd57ed92305402e6f7d1b4e89127d6b4854925516930b082b0c285538

SHA512
e3d69d6f6694a2b07bcb8bfd365baa260ec60ef544d8afdd5ab5057e29f00b784cfaecbeacaa579e0ece1c03a75457260554a732672f9370932d29cc3f59bd17

Download Submit
memory/1736-23-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1736-300-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1736-79-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1736-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1736-10-0x0000000076D86000-0x0000000076D87000-memory.dmp

Filesize
4KB

Download
memory/2252-33-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2252-27-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2804-26-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2804-34-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2828-24-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2828-29-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3016-20-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3016-31-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download