Analysis
- max time kernel
122s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 14:41
General
- Target 2026-06-02_df3e11aaa0ce250c034a57d8f0fd263d_elex_remcos_stop.exe
- Size 10.1MB
- Sample260602-r2txfahs5p
- SHA256 48fb984b6e3e2b60577c81fed89f1ae9d460ebea06000b82a3c276e0dcfbd9d3
Score
10/10
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
- Modifies firewall policy service 3 TTPs 3 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 12 IoCs
- Custom signatureDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs
- Custom signatureUPX dump on OEP (original entry point) 40 IoCs
- Executes dropped EXE 33 IoCs
- Windows security modification 2 TTPs 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- UPX packed file 39 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_df3e11aaa0ce250c034a57d8f0fd263d_elex_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_df3e11aaa0ce250c034a57d8f0fd263d_elex_remcos_stop.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x360,0x7ffce436c188,0x7ffce436c194,0x7ffce436c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,9116978129151305727,15723738062293979359,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,668304344012456254,6359433359154129037,262144 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,1358270123983697553,8244668323185867552,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,18312763326769797482,9587473822100455391,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,18416861390771542228,5091269099965641607,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,3857532852223272700,13847935816996632707,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,4340406863184082790,16987179417017464029,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,10982585268425168266,6334452676472573551,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,10982585268425168266,6334452676472573551,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15958805204891450568,127725500859188958,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:144⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11085⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6220,i,15921350801872656647,2448020287898453118,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5800,i,14233638059534199976,215939998664781897,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5848,i,12701382368759096763,14916245393928635330,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6724,i,9928730565644520199,15690258193127795520,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,17395510911525476186,15008429928756989524,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,12038228098966814642,16027293241333714480,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,12015048003607688519,1724521208266955110,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,5862492665554141410,2047346529375847532,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,9445131684042285893,2821046741571447933,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4996,i,47950777159332293,17527745346987182319,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5360,i,1958408036751151125,16234616598528160373,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7012,i,10248026146195270482,11391932930051098227,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7128,i,16582147252162409682,14758963484680347394,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,4226566235209092710,4457129955217089235,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7324,i,10973675238047235051,7896850986464691860,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6020,i,5548826192688643037,11975523025276448730,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8000,i,16818899821456747420,7655545390619913295,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8116,i,5685853885538329155,1386548731977631898,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:144⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7680,i,12043096794794321451,7564385391863986696,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5980,i,12815948187619357774,17343027636951351478,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8484,i,2830040400522872717,9401451630167110883,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8600,i,10170861323791049712,8247222142774681322,524288 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8764,i,3335518548042979613,17098864530153045274,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8624,i,10752091436695311739,17350447328096570330,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9028,i,5735551354616729168,16577923088177658813,2097152 --field-trial-handle=2204,i,17531052967483152549,17187575142399257060,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:14⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\popcfg2\readme.html3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
msedge.exe
MahjongEscapeAJ.exe
license.txt
readme.html
Visit PopCap.com.url
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Secure Preferences
sync_diagnostic.log
ec507147-5975-44e9-a2fc-15b8a3d705f8.tmp
Local State
Local State
Local State
Local State
Local State
typosquatting_list.pb
metadata.json
metadata.json
d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
metadata.json
defines.xml
files.cab
props.xml
Mahjong Escape - Ancient Japan.lnk
Play More Great Games!.url
manifest.json
data.txt
manifest.json
lnrpwo.pif
memory/1716-629-0x000001F2B8F30000-0x000001F2B9F30000-memory.dmp
memory/3528-54-0x0000000007C70000-0x0000000007C71000-memory.dmp
memory/3528-584-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-80-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-79-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-404-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-78-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-420-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-422-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-424-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-426-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-429-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-431-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-71-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-69-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-67-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-66-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-469-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-64-0x0000000002230000-0x0000000002232000-memory.dmp
memory/3528-488-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-62-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-501-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-61-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-60-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-56-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-57-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-82-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-586-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-58-0x0000000006090000-0x0000000006092000-memory.dmp
memory/3528-592-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-0-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3528-55-0x0000000006090000-0x0000000006092000-memory.dmp
memory/3528-52-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-50-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-51-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-7-0x0000000003EC0000-0x0000000003EC1000-memory.dmp
memory/3528-8-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-5-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-43-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-41-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-990-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3528-42-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-10-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-40-0x0000000002230000-0x0000000002232000-memory.dmp
memory/3528-14-0x0000000002230000-0x0000000002232000-memory.dmp
memory/3528-11-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-6-0x0000000002230000-0x0000000002232000-memory.dmp
memory/3528-1-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-3-0x0000000002350000-0x00000000033DE000-memory.dmp
memory/3528-4-0x0000000002350000-0x00000000033DE000-memory.dmp