floxif | hxxps://google[.]com

Resubmissions

07-02-2025 23:34

250207-3khzdstlgs 8

07-02-2025 23:30

07-02-2025 23:28

07-02-2025 23:25

07-02-2025 23:22

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250207-en
resource tags

arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
submitted
07-02-2025 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

10^/10

floxif backdoor defense_evasion discovery trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x001c00000002afb5-523.dat	floxif

Downloads MZ/PE file 3 IoCs

flow	pid	Process
46	4884	msedge.exe
46	4884	msedge.exe
46	4884	msedge.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x001c00000002afb5-523.dat	acprotect

Executes dropped EXE 15 IoCs

pid	Process
5060	Mabezat.exe
4012	Floxif.exe
2340	Floxif.exe
3480	Floxif.exe
1940	Floxif.exe
5060	Floxif.exe
2680	Floxif.exe
2780	Floxif.exe
2584	Floxif.exe
3120	Floxif.exe
1368	Floxif.exe
4636	Floxif.exe
4848	Floxif.exe
1968	Floxif.exe
3724	Floxif.exe

Loads dropped DLL 14 IoCs

pid	Process
4012	Floxif.exe
2340	Floxif.exe
3480	Floxif.exe
1940	Floxif.exe
5060	Floxif.exe
2680	Floxif.exe
2780	Floxif.exe
2584	Floxif.exe
3120	Floxif.exe
1368	Floxif.exe
4636	Floxif.exe
4848	Floxif.exe
1968	Floxif.exe
3724	Floxif.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
46	raw.githubusercontent.com

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4012-526-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x001c00000002afb5-523.dat	upx
behavioral1/memory/4012-539-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2340-561-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2340-564-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3480-567-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3480-570-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1940-573-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1940-576-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5060-581-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5060-584-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2680-587-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2680-589-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2780-592-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2780-594-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2584-597-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2584-600-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3120-603-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1368-606-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3120-609-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4636-612-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1368-615-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4848-618-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4636-621-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4848-624-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1968-627-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1968-630-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3724-642-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3724-645-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Mabezat.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 14 IoCs

pid	pid_target	Process	procid_target
3612	4012	WerFault.exe	118
4860	2340	WerFault.exe	122
3936	3480	WerFault.exe	125
4508	1940	WerFault.exe	128
2240	5060	WerFault.exe	132
4912	2680	WerFault.exe	135
4520	2780	WerFault.exe	138
4144	2584	WerFault.exe	141
3776	3120	WerFault.exe	144
3532	1368	WerFault.exe	147
1448	4636	WerFault.exe	150
3220	4848	WerFault.exe	153
2808	1968	WerFault.exe	156
4392	3724	WerFault.exe	161

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mabezat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2097721802-4245722245-2268422190-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Mabezat.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
584	msedge.exe
584	msedge.exe
5036	identity_helper.exe
5036	identity_helper.exe
4576	msedge.exe
4576	msedge.exe
3064	msedge.exe
3064	msedge.exe
716	msedge.exe
716	msedge.exe
2160	MicrosoftEdgeUpdate.exe
2160	MicrosoftEdgeUpdate.exe
2160	MicrosoftEdgeUpdate.exe
2160	MicrosoftEdgeUpdate.exe
4176	msedge.exe
4176	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4012	Floxif.exe
Token: SeDebugPrivilege	2340	Floxif.exe
Token: SeDebugPrivilege	3480	Floxif.exe
Token: SeDebugPrivilege	1940	Floxif.exe
Token: SeDebugPrivilege	5060	Floxif.exe
Token: SeDebugPrivilege	2680	Floxif.exe
Token: SeDebugPrivilege	2780	Floxif.exe
Token: SeDebugPrivilege	2584	Floxif.exe
Token: SeDebugPrivilege	3120	Floxif.exe
Token: SeDebugPrivilege	1368	Floxif.exe
Token: SeDebugPrivilege	4636	Floxif.exe
Token: SeDebugPrivilege	4848	Floxif.exe
Token: SeDebugPrivilege	1968	Floxif.exe
Token: SeDebugPrivilege	3724	Floxif.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe
584	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 4348	584	msedge.exe	82
PID 584 wrote to memory of 4348	584	msedge.exe	82
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 3828	584	msedge.exe	83
PID 584 wrote to memory of 4884	584	msedge.exe	84
PID 584 wrote to memory of 4884	584	msedge.exe	84
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85
PID 584 wrote to memory of 2432	584	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffafb683cb8,0x7ffafb683cc8,0x7ffafb683cd8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  PID:1968
- C:\Users\Admin\Downloads\Mabezat.exe
  "C:\Users\Admin\Downloads\Mabezat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2764
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 456
    3⤵
    - Program crash
    PID:3612
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 424
    3⤵
    - Program crash
    PID:4860
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 424
    3⤵
    - Program crash
    PID:3936
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 424
    3⤵
    - Program crash
    PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,5103213233922609997,12168408168497971366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 424
    3⤵
    - Program crash
    PID:2240
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 424
    3⤵
    - Program crash
    PID:4912
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 424
    3⤵
    - Program crash
    PID:4520
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 424
    3⤵
    - Program crash
    PID:4144
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 424
    3⤵
    - Program crash
    PID:3776
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 432
    3⤵
    - Program crash
    PID:3532
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 424
    3⤵
    - Program crash
    PID:1448
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 392
    3⤵
    - Program crash
    PID:3220
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 424
    3⤵
    - Program crash
    PID:2808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4012 -ip 4012
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2340 -ip 2340
1⤵
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3480 -ip 3480
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1940 -ip 1940
1⤵
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5060 -ip 5060
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2680 -ip 2680
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2780 -ip 2780
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2584 -ip 2584
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3120 -ip 3120
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1368 -ip 1368
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4636 -ip 4636
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4848 -ip 4848
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1968 -ip 1968
1⤵
PID:3744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5040

C:\Users\Admin\Downloads\Floxif.exe
"C:\Users\Admin\Downloads\Floxif.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 424
  2⤵
  - Program crash
  PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3724 -ip 3724
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
070fc30bfc53f708275a178f8921647e

SHA1
4b5da28d566ae66c5d8dc3f0aee8508923b4fa96

SHA256
edee4263542b61a3bb706f766f237944a2d00ee8e13b7571f2e203e09fd7c6c6

SHA512
cb5e881d60291b61621af74df692cc8f08fc645bf74f914a04976cdd9de95bd7cb986056086de37e36a5042d500178ec691ae33b2a0bc78afd9ec8a57b69c4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
badd0dac71046586465ccb14eab1d68b

SHA1
f4894f3e60ccb39a0d7fcccfd0555f8a52bd0fc9

SHA256
23ecea53503b1ccd1270630b6dfd6229cd60062ae7b68344b9dee3d25cf858bf

SHA512
484f87e4bc520a6636350204caa8f078d88c3f32da7210a92ff767e2822d50b99b508e4fdf2d5a6695fd1482b7b1b2431f0ba777fcf94d3ea27ca5b9f82599a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a2b6fff9947c9fa50e0a19ecf7139306

SHA1
6dea3a13c4dca4ea01d0e025be0e4b7fbc0b5ee8

SHA256
b920c01623ed2220044f21f343ca3d9a321489fd845b6a53bf635b7a600855d8

SHA512
43a0885a2eb2d51f0ba6c61979d6ed6434503822aaa66cbdc299deb30fdd1d91f89cdb6321170b76d2959fd017395a5b13eb6d0269f70b9fa459bcb584d9fcf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6d7dea702203316ab48c6458da824422

SHA1
322959027775e67b08dd259b9d9010f4914e28e5

SHA256
9406f27fb9604f8d358b3df4b240443acec29b7ff04b025b87914b6b90fb78e4

SHA512
cc475fe44c9534ad8a1d8d3097f69f6522deb73e4f7b48da78d2888dcd8ac14975669a9b7fc550920bfe314ee2005bed21130c3615cc6043986c1244fe1b0cd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c22816472e7887c5357745ca4a63beba

SHA1
2e1d4b2902dd1890639f780628eb6e89dbb7ccb7

SHA256
55ede82a5773a6ee12c27cac72a35e3b36f60f785302494fd0be1bf9f0ab3e72

SHA512
cf5b4d4804b35300f2249cc991a03f11deed8895b661edd1ef4b533e4f5c112829ac28c33b49082e929598c1d3f396ec5f72cb04543c7789e8eae1f2045297bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7cb94dba1c2c735c312b5abf7787182c

SHA1
40a42892ec51778099ba0b7210b63d63927e4d7e

SHA256
97058070e5b0ed6b79ee96a6e03f5229e3f009899c581963db792ba2102b7c4a

SHA512
8c68255b78c5b3f8378cd146512c245af30dcf1aba3c464a7a14c65329b440a1212eb73f440bd52098775b51fe5e5aad3586a60bf38dbc35ea8f4e031fbe92c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27e064249097ad8d8588ba9151c85052

SHA1
b7afcb5b2eecfcdbee17c115c8d04c6d62a5ff78

SHA256
e89708db698e6bdbc746377455f55a1a4261014a869869e6f5d45da1f22f092d

SHA512
fb1e5247c95e067127da0403928be819525f7664cef329973dc2380c94f91c618cd22ff85db352ffe40785788c8b01af7eec851629ed1147d5362d0586245ab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99c0ca25dbec2fd3bd45438e09d950d4

SHA1
af90357cf6b18b4b7d2920d1141eea3849431797

SHA256
d18e027824db5c01749ac58a27336f7ceaadf0ae23ed438ae9702334d74e3f35

SHA512
dcf5a6694569082881b193f984895bae79486d15b34650f901a3f46d8c64c34fde47e85b80f88ec30ff596ae0e4dd71ddf11166506b4979556b2ae6ecfa840c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fb5242aa093dbd7ba51d10e5f5a686dd

SHA1
cb3f81cf584065c4098c65e2eb0458a9b047f46f

SHA256
6acd6d2224660f1d2a4463e0d0f5742714832b250bed7f732a386cde4bb7fb03

SHA512
a35b198885d01fc409278ba45959c5c537b62db14863c717cb7d03cc4a1fce5f65ccec25b37f475178239b018b9e4e7acb17b5aa1c3c2aa9f961b071df7ccb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6251e40a5a377dfb917b1e79921ca84

SHA1
307f9aa49c99c90ee28221556364a90ddddce77e

SHA256
540f80cf783db09adcbd2c65aaf19018fa614e2146a8ad4d4c8e1c7ff74b35db

SHA512
78ae3ceeab179b80fc28f65123b575328acc820829c351dcc9703f2d1a7d1451849126d428e880ef76b7cf11c5e4aa249455f88f3d1690f0d8159d1f1c50f1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9cdb87abd0d093f32df3c870994a38e8

SHA1
a1cff71912ab8009ee203c84ce0acf422e5e9a70

SHA256
67e1896978909b6217006f0b60709840761d4690de5bc54e154a10e6300361a0

SHA512
8f52be4dda5d76a3aab082b66802dbd0be9caa4ed12461ca34453b114ec039e518400a9b7616ab41e3c5efcdacaa862c448c1883ba16a98a19ba14a4d3ddbcf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1aff482e250b2dde8b105d2e2fbefcd1

SHA1
b4e18b7172325324285e1e9823d2de1a9254da69

SHA256
9895112bf044221b1b100813a35baa5df599d94ea73a50eae29390344b68c313

SHA512
ae04c81f38a8adfb167630d3401873e811300c6d43c2f0158264ed5231a12092fe551853cd4bc4c967a671c85d69b8ebd8159561d873b67b25fb9ffcd0c2efb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eba6533090e76c400284a485bd70cb3c

SHA1
26ae664e381dd5369d1fdaa44fb00512dc6b2c8b

SHA256
58f8ce8ee3b079df79120f8df21aaa71d120b4a08dc24587f483ae0c1f29ab4c

SHA512
fd82ad34ed010278e81976da532fa630867ee07eb3216a3b87833299181d65797f301437affd2791e646e68f6c48012ca1c2a2c89ec18ca5e405b7123a15c2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
756e3229a4183bb800acc766e3dd5478

SHA1
642ef1c18de5e543f9de5e1251f374c09f3c3c3c

SHA256
6497c240320da75b1dc94de05783685ffa2900b2823a8b5e5924230f36478dc5

SHA512
9998906a4d104bc746a1fe1fd1ae75c54e02fea7b62d30d426f3e6914c84b5d2cf3396ede9050807e3a8d95398144ae6a494579a67d5f63b68ba60016eddab46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
38532343af7f2f890925cefa490cd081

SHA1
e99d0ec9cce2f98ef1ee3ff83adeb6c9ea050140

SHA256
a86e38c4ced0153f64c6b39a98a04ac83be4f4c09729eeba40c8b2736d7c976a

SHA512
122e0682c23727b873d788c7f16785cb12f54470d451bbae242112ca53aa461894f6219a11d2ceea884b9dc9d46f664bef7de740abd877840b6fc47a26cb5d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d3cb.TMP

Filesize
204B

MD5
013c4fe8892782646b9591fc5a6e5af8

SHA1
87320e2b0c1ef1eac788c5435ef849c63d76e551

SHA256
a4c436c67045bc6678ff7ee5237614226d3e4d745a4185d9f59aaee7b59b1cde

SHA512
8afcfcb524e6ef1350e23eeff414c7d8ecfd30cdba2d93a5db93dfa434de2a2a62149fbd98567bc71093d1e377b4751b472dd814124fc858cb636e2ebc84fb32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d2ebc9bc2f0c9847fc56000b9872186a

SHA1
8124357e1d363ea562eb9516d476497e25b9ff1c

SHA256
83a43dc26bf67255d8c095df398250721ae8f8543fa485990265e769e277f5bb

SHA512
9cadbd420adc78c5b25c01c99a6d026ad075019afce58382756012bddbf96dfc9ab3debf5a3d88f02cc2ed177a84044c15f758a20f3a4d3b5d9f5ff98f85b47e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
065c57738409d66bf80b1d0f0e426236

SHA1
ff7e63516413e109b9c4df2086da2b96e27ca0d1

SHA256
ceacdb90797759e499d914c7fac02f5f33ff5cec3484e25fee4d5936dc36a6d6

SHA512
f6cc8d33fcd1d87513828923f0e7ac42ff0e43a6c6e2f49ee3d5ddfc5153a6c2407001f20313e335acfb324dbf520e4ccf5ad08f08e47d0d77cdc8eac533f115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b026630818a4b671a5ebcefef080a0f4

SHA1
a7f97da1fe29514b1ab94e26b60abc7e8110115a

SHA256
3ead029580b847ce43f0dcc7b361a19079848a6057d85d8004121d7cbea6f2eb

SHA512
76ac76b6e8fd457c8ba43d7599f259a4e351be2a7671f154b9ff59072981588ee2d13685b97972264ff44096a8f3e350be60e96dc05682be5689020e5ed9a8a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e583241b560d09b2c7aa6a13bb3ee874

SHA1
44eba46411487bfe840916c0202d4d9482242e6e

SHA256
32d4828fbc90462833c5bf547c8e76b1853cec5c4711751f635b3172269e34ab

SHA512
c93103c6f2fdfa483e4e6eb754244d7312684232d4e4ad1cb44bc2510d6ee43ba58ea5b5204ecd476b0e6781b69456f7c2ba3c85bd649c3e41828c1ade7b77a0

Download Submit
C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 322173.crdownload

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 459616.crdownload

Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 783096.crdownload

Filesize
141KB

MD5
de8d08a3018dfe8fd04ed525d30bb612

SHA1
a65d97c20e777d04fb4f3c465b82e8c456edba24

SHA256
2ae0c4a5f1fedf964e2f8a486bf0ee5d1816aac30c889458a9ac113d13b50ceb

SHA512
cc4bbf71024732addda3a30a511ce33ce41cbed2d507dfc7391e8367ddf9a5c4906a57bf8310e3f6535646f6d365835c7e49b95584d1114faf2738dcb1eb451a

Download Submit
memory/1368-615-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1368-606-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1940-573-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1940-576-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1968-627-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1968-630-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2340-562-0x0000000000180000-0x00000000001F5000-memory.dmp

Filesize
468KB

Download
memory/2340-564-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2340-561-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2584-600-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2584-597-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2680-587-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2680-589-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2780-592-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2780-594-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3120-603-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3120-609-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3480-570-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3480-567-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3724-645-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3724-642-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4012-526-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4012-537-0x0000000000180000-0x00000000001F5000-memory.dmp

Filesize
468KB

Download
memory/4012-539-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4636-612-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4636-621-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4848-624-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4848-618-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5060-473-0x0000000001000000-0x0000000001026000-memory.dmp

Filesize
152KB

Download
memory/5060-584-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5060-581-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download