Overview

overview

10

Static

static

10

2026-06-28...op.exe

windows10-2004-x64

10

2026-06-28...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    126s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 20:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_a18f4cd9a46bc79d699a4c6bcee71366_darkgate_elex_floxif_glassworm_remcos_stop.exe
  • Size 5.5MB
  • Sample260628-yyszasdt21
  • SHA256 f97609dda50d8d8c8d60d5780f02f28f0eb9b7b99e1cd062ba7b2b5974985e7d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 7 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 7 IoCs
  • UPX dump on OEP (original entry point) 18 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 55 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_a18f4cd9a46bc79d699a4c6bcee71366_darkgate_elex_floxif_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_a18f4cd9a46bc79d699a4c6bcee71366_darkgate_elex_floxif_glassworm_remcos_stop.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5752
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1504
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1708
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5684
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3496
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3968
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=638b25
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:6052
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdc2bcc188,0x7ffdc2bcc194,0x7ffdc2bcc1a0
        3⤵
          PID:808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,7848821927064796535,11906886620122454198,262144 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
          3⤵
            PID:2796
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,8239728253470881095,17217792893684383680,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:11
            3⤵
            • System Time Discovery
            PID:3544
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,4034762735342572220,10495429559543000679,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:13
            3⤵
              PID:3720
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,13780351738113572477,17868926260767627061,2097152 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
              3⤵
                PID:1912
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,13242725024984317976,579499835658178792,2097152 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                3⤵
                  PID:1012
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1724,i,4764817787505542909,5094214578533962130,2097152 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
                  3⤵
                    PID:3644
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,5025478187897305038,12032863019055618407,2097152 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:9
                    3⤵
                      PID:1312
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,1580868139463196456,190042119465658806,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
                      3⤵
                        PID:1104
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,10867898352945025739,17829696411853305159,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
                        3⤵
                          PID:2672
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,7230018647968058925,13289580961956099406,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
                          3⤵
                            PID:6128
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,1079369014209499663,7421245935176678092,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
                            3⤵
                              PID:964
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,1079369014209499663,7421245935176678092,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
                              3⤵
                                PID:3404
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,449504421181029195,16099260558188162085,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
                                3⤵
                                  PID:4668
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,13037055891218124092,17971933730790716283,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
                                  3⤵
                                    PID:4752
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,18401854525668417027,15428018883817713062,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
                                    3⤵
                                      PID:5096
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,15062131903523721477,13887343947204637686,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
                                      3⤵
                                        PID:4092
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,7957421759401074274,15035689020711393312,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
                                        3⤵
                                          PID:4668
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,13087983057880268661,16575819884147255582,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:14
                                          3⤵
                                            PID:1312
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,5266876472152274783,5737256715111605335,524288 --field-trial-handle=2296,i,15330052929042062693,8203747414381017410,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
                                            3⤵
                                              PID:2548
                                        • C:\Windows\system32\OpenWith.exe
                                          C:\Windows\system32\OpenWith.exe -Embedding
                                          1⤵
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3276
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                          1⤵
                                            PID:4108
                                          • C:\Windows\system32\sihost.exe
                                            sihost.exe
                                            1⤵
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of WriteProcessMemory
                                            PID:5528
                                            • C:\Windows\explorer.exe
                                              explorer.exe /LOADSAVEDWINDOWS
                                              2⤵
                                              • Boot or Logon Autostart Execution: Active Setup
                                              • Enumerates connected drives
                                              • Checks SCSI registry key(s)
                                              • Modifies Internet Explorer settings
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3744
                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4148
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4836

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Active Setup

                                                1
                                                T1547.014

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Browser Extensions

                                                1
                                                T1176

                                                Event Triggered Execution

                                                1
                                                T1546

                                                AppInit DLLs

                                                1
                                                T1546.010

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Active Setup

                                                1
                                                T1547.014

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Event Triggered Execution

                                                1
                                                T1546

                                                AppInit DLLs

                                                1
                                                T1546.010

                                                Defense Evasion

                                                Modify Registry

                                                4
                                                T1112

                                                Credential Access

                                                Credentials from Password Stores

                                                1
                                                T1555

                                                Credentials from Web Browsers

                                                1
                                                T1555.003

                                                Unsecured Credentials

                                                1
                                                T1552

                                                Credentials In Files

                                                1
                                                T1552.001

                                                Discovery

                                                Browser Information Discovery

                                                1
                                                T1217

                                                Peripheral Device Discovery

                                                2
                                                T1120

                                                Query Registry

                                                4
                                                T1012

                                                System Information Discovery

                                                5
                                                T1082

                                                System Location Discovery

                                                1
                                                T1614

                                                System Language Discovery

                                                1
                                                T1614.001

                                                System Time Discovery

                                                1
                                                T1124

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                1
                                                T1005

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                symsrv.dll
                                                • Path C:\Program Files\Common Files\System\symsrv.dll
                                                • Size 67KB
                                                • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                symsrv.dll.000
                                                • Path C:\Program Files\Common Files\System\symsrv.dll.000
                                                • Size 114B
                                                • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                settings.dat
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                • Size 280B
                                                • SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                settings.dat
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                • Size 280B
                                                • SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                the-real-index
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                • Size 3KB
                                                • SHA256 94f8d340f8d0d8df52a5767fe68f9aba0382dc6e82c4a6471c04dd415ca0fe9d
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                the-real-index~RFe59e517.TMP
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e517.TMP
                                                • Size 3KB
                                                • SHA256 b7b034a444f76adea3fde5c3e52727d350fa6767be58ea578feec135cac758f8
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                SiteList-Enterprise.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                • Size 2B
                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                Edge Profile.ico
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                • Size 70KB
                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Network Persistent State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                • Size 2KB
                                                • SHA256 47d8133f636154ee3467e4cca264c6809b9b171a7aee55a9e39dfeeb35b640ac
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                SCT Auditing Pending Reports
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                • Size 2B
                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                Sdch Dictionaries
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                • Size 40B
                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                Preferences
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                • Size 14KB
                                                • SHA256 962cdb6953f71c96f2b861853c9c003e8c2fbd657e9f4844a0e68680ebc3ce92
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Preferences
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                • Size 14KB
                                                • SHA256 ac25f70d58758a096c6ae3b4b025f80cb17cc709c9330bd323f53a65d2aa5a09
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Secure Preferences
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                • Size 32KB
                                                • SHA256 d4e97273e2edfb9a6f1e99fbe62968dfe0becc264d7fd03b48d1f6412d82b166
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OperationConfig
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                • Size 22KB
                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OperationConfig~RFe5a79a6.TMP
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a79a6.TMP
                                                • Size 3KB
                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                Local State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 35KB
                                                • SHA256 cd36e25f4a76a65e6387017c89755970dcf09c938f7edc8be23475bd2a8932a9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Local State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 35KB
                                                • SHA256 76f9e52bccc401672681da39946ee02b6d525f6fc2d44516c2eaca1e3545bd07
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Local State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 38KB
                                                • SHA256 0fba5213ee729f40aad1413fe964e55e11d923fe83feb777e66a5bd8d87afd45
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Local State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 43KB
                                                • SHA256 47ae7b2472a5c51d452bf173dc698dfe1a1736d8fa8435c16a8d90b9cb480719
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ea9f1df5-51d6-4fbd-881a-ac1d961efbc4.tmp
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ea9f1df5-51d6-4fbd-881a-ac1d961efbc4.tmp
                                                • Size 13B
                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                prep_Activatable Class_Hermes_perf.cache
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                • Size 607B
                                                • SHA256 7c21835f01895c1ee4e12f81e71ef06a0f6e2b9281de493ff8ec95f913e9680d
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                prep_Activatable Class_Hermes_perf.cache
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                • Size 599B
                                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                content_new.js
                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6052_348270679\CRX_INSTALL\content_new.js
                                                • Size 10KB
                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                memory/1504-15-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/1708-24-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/1708-23-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/3496-30-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/3496-29-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/3744-444-0x000000000DD30000-0x000000000E5AB000-memory.dmp
                                                Download

                                                memory/3744-476-0x000000000DD30000-0x000000000E5AB000-memory.dmp
                                                Download

                                                memory/3968-32-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/3968-33-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/4148-211-0x000001F681C60000-0x000001F681C80000-memory.dmp
                                                Download

                                                memory/4148-194-0x000001F6801E0000-0x000001F6802E0000-memory.dmp
                                                Download

                                                memory/4148-195-0x000001F6801E0000-0x000001F6802E0000-memory.dmp
                                                Download

                                                memory/4148-239-0x000001F694690000-0x000001F6946B0000-memory.dmp
                                                Download

                                                memory/4148-193-0x000001F6801E0000-0x000001F6802E0000-memory.dmp
                                                Download

                                                memory/4148-201-0x000001F681E40000-0x000001F681F40000-memory.dmp
                                                Download

                                                memory/4148-200-0x000001F681A20000-0x000001F681A40000-memory.dmp
                                                Download

                                                memory/5684-26-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5684-27-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5752-35-0x0000000000F40000-0x00000000014B4000-memory.dmp
                                                Download

                                                memory/5752-191-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5752-38-0x0000000000F40000-0x00000000014B4000-memory.dmp
                                                Download

                                                memory/5752-446-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5752-445-0x0000000000F40000-0x00000000014B4000-memory.dmp
                                                Download

                                                memory/5752-36-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5752-42-0x0000000000F40000-0x00000000014B4000-memory.dmp
                                                Download

                                                memory/5752-39-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5752-474-0x0000000000F40000-0x00000000014B4000-memory.dmp
                                                Download

                                                memory/5752-190-0x0000000000F40000-0x00000000014B4000-memory.dmp
                                                Download

                                                memory/5752-480-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5752-17-0x0000000000F40000-0x00000000014B4000-memory.dmp
                                                Download

                                                memory/5752-18-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5752-14-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download

                                                memory/5752-9-0x0000000000F41000-0x0000000000F42000-memory.dmp
                                                Download

                                                memory/5752-3-0x0000000010000000-0x0000000010030000-memory.dmp
                                                Download