Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 14:06
General
- Target 2026-04-15_0f26b4628045a04d0a8bfbc990111a32_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260415-reffjaa181
- SHA256 722f93cb6bcf8f011108063faac1f0b3d31da25ab8457ccf5d62c6291f05e82d
Score
10/10
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
- UPX dump on OEP (original entry point) 15 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- A potential corporate email address has been identified in the URL: [email protected]
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 6 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 22 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 19 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 10 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_0f26b4628045a04d0a8bfbc990111a32_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_0f26b4628045a04d0a8bfbc990111a32_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {4dc9238e-f40c-41e4-945b-9049329c7ff3} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2336 -prefsLen 27133 -prefMapHandle 2340 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {fa896f9d-8432-405e-8234-8d22d546c27d} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25164 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {d5794f44-9a9d-4002-9065-c5601d8d0117} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27274 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {38e5ff43-c7c8-4257-8b73-5fa6222ab6b6} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2580 -prefsLen 34773 -prefMapHandle 2744 -prefMapSize 270279 -jsInitHandle 2748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1416 -initialChannelId {17db1007-d61e-4ef9-8a4d-c67df4764e39} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 35010 -prefMapHandle 4972 -prefMapSize 270279 -ipcHandle 4980 -initialChannelId {b80110ac-d759-4803-abca-86b07f83d02e} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 35062 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {c9b68a05-132e-42e1-9116-49654e38e2b9} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4676 -prefsLen 32952 -prefMapHandle 4672 -prefMapSize 270279 -jsInitHandle 4668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {00ed8edc-046e-4422-a832-89fd0884f082} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4676 -prefsLen 32952 -prefMapHandle 5600 -prefMapSize 270279 -jsInitHandle 5560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5760 -initialChannelId {a5a5f39b-014c-4827-b2fb-c8a308ff67c9} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5928 -prefsLen 32952 -prefMapHandle 5932 -prefMapSize 270279 -jsInitHandle 5936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5944 -initialChannelId {6812eb98-5acc-403f-8890-23c3bbd6953c} -parentPid 2468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b632⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffd5ce9c188,0x7ffd5ce9c194,0x7ffd5ce9c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,8191984059267529201,8133265230278762255,262144 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,11492840935971760558,3208241009652895752,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,5469162774012388655,4067405303917399726,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6436986677795946073,7653818474196463063,2097152 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,17437785481026770787,16123414427316550914,2097152 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,15083153234671748100,1445219730611033926,2097152 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,1236726899324333733,285373078571332538,2097152 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,7722548117175631671,14255525096409956341,2097152 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4268,i,9094234700963530869,13565158940441357211,2097152 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,6383268639847278898,6561976007868473857,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,16506456584734713584,8833738024934705316,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,183513430199013355,11591359974708663591,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,2382235226735822206,6047616755709036864,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15494824878980389718,11678585979697124531,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:143⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11284⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,16199695899861348676,17925461084244374029,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,16199695899861348676,17925461084244374029,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,3642308095786013711,18270737755690916720,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,16385750849585068007,17665094720073365883,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,14232023539439755376,16716541465601258423,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,15012312979578338387,7378851977472762428,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,18399349138163740608,14402463922459646987,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,18137917176016640119,2069802206152727908,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,16973869677667038570,13048714609499139236,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,11925468524377951054,7987027335334595305,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,239336345070519595,5399104054568452954,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1046507437668501559,5317888325491777677,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,14458239848759585665,13099701282585380786,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,8436139357714938620,15032493571730339535,524288 --field-trial-handle=2172,i,4992500575535644503,2137514135024839568,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
temp-index
the-real-index~RFe591488.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
ccb73538-2177-4594-8344-04406a004472.tmp
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
CD1C116DEEE8F4F97C1806976E10E7E2B349E486
67de884a-fb27-4ac3-93b0-d32480b3d435.tmp
8095f4c2-3b93-4350-8a6c-babb73d0bb8f.tmp
content_new.js
afe7e110-5bdf-465e-a8d6-2f36c3d3bd9f.tmp
tmpaddon
tmpaddon
compatibility.ini
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
5610e0d4-4b5e-42c1-bc57-1d3ae4dfcdcc
562e1fbf-5c4e-4945-bba8-82403bc80520
984100ce-941f-4475-9ce1-129bb2715264
d2ab34a6-e143-40e3-a94f-13105634ab67
d4a08698-2cf0-4ec7-ab7d-5f33003b7f4e
f653ba30-4399-4254-9243-7cd133ff35c1
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs.js
prefs.js
prefs.js
recovery.baklz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
manifest.json
manifest.json
manifest.json
memory/416-402-0x0000000010000000-0x0000000010030000-memory.dmp
memory/416-405-0x0000000010000000-0x0000000010030000-memory.dmp
memory/416-404-0x0000000002520000-0x000000000266D000-memory.dmp
memory/2176-412-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2176-401-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2176-410-0x0000000002770000-0x00000000028BD000-memory.dmp
memory/3048-516-0x0000000004960000-0x0000000004AAD000-memory.dmp
memory/3048-11-0x0000000000B50000-0x0000000001121000-memory.dmp
memory/3048-514-0x0000000000B50000-0x0000000001121000-memory.dmp
memory/3048-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3048-515-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3048-5-0x0000000000B51000-0x0000000000B52000-memory.dmp
memory/3048-423-0x0000000000B50000-0x0000000001121000-memory.dmp
memory/3048-424-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3048-425-0x0000000004960000-0x0000000004AAD000-memory.dmp
memory/3048-10-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3048-13-0x0000000004960000-0x0000000004AAD000-memory.dmp
memory/3048-12-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3048-369-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3364-484-0x0000025D94860000-0x0000025D9490F000-memory.dmp
memory/3948-408-0x0000000002500000-0x000000000264D000-memory.dmp
memory/3948-411-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3948-400-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4868-416-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4868-413-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4868-415-0x00000000025F0000-0x000000000273D000-memory.dmp
memory/5760-1148-0x000001EED3510000-0x000001EED35BF000-memory.dmp
memory/5864-534-0x000001E3AB5F0000-0x000001E3AB69F000-memory.dmp