Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/08/2026, 05:07
General
- Target 2026-08-22_8d6aac37d75935a9a6d9b293c51bc18f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
- Size 6.0MB
- Sample260823-fsdcjshd27
- SHA256 80d1859b4ba26d1a6614360dcc491328365906982cbc18b609681d6ff8478757
Score
10/10
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
- UPX dump on OEP (original entry point) 14 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- A potential corporate email address has been identified in the URL 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 22 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 18 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_8d6aac37d75935a9a6d9b293c51bc18f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_8d6aac37d75935a9a6d9b293c51bc18f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- A potential corporate email address has been identified in the URL
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 26983 -prefMapHandle 1948 -prefMapSize 270110 -ipcHandle 2020 -initialChannelId {b662e245-b3f1-45de-b27c-2def527a9820} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27019 -prefMapHandle 2420 -prefMapSize 270110 -ipcHandle 2428 -initialChannelId {96e95dbf-4487-44c5-a8a0-8753aa2fb717} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 25118 -prefMapHandle 3800 -prefMapSize 270110 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {e32fd163-977e-43fb-8b23-760f5ae8d988} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27209 -prefMapHandle 3956 -prefMapSize 270110 -ipcHandle 4024 -initialChannelId {a69b5e9f-23de-4fba-afc8-f8d83d690a65} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 34696 -prefMapHandle 2640 -prefMapSize 270110 -jsInitHandle 2792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2796 -initialChannelId {37ce591a-8a24-4b35-bfe4-4d8a0105f662} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5084 -prefsLen 34803 -prefMapHandle 5088 -prefMapSize 270110 -ipcHandle 5068 -initialChannelId {0999e87a-b12f-4339-be8b-16b7bd6d8d38} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2840 -prefsLen 34855 -prefMapHandle 2852 -prefMapSize 270110 -jsInitHandle 5324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1620 -initialChannelId {9a45ea9a-08b8-4dc6-9fbd-8bbe26e31cdc} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2884 -prefsLen 32764 -prefMapHandle 5324 -prefMapSize 270110 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3140 -initialChannelId {1768adb6-7e42-41e4-bd38-ed1ac945aca5} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5924 -prefsLen 32764 -prefMapHandle 5928 -prefMapSize 270110 -jsInitHandle 5932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5940 -initialChannelId {533d346e-c304-48da-a574-6cd86b1a1caf} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6108 -prefsLen 32764 -prefMapHandle 6112 -prefMapSize 270110 -jsInitHandle 6116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5932 -initialChannelId {1420e318-f354-4c51-918e-38d4589f28f5} -parentPid 1236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b082⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7fff65eec188,0x7fff65eec194,0x7fff65eec1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,17073673522339870367,17738350616319814845,262144 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,17161575975875500583,17367788663376420385,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,4840467123252277251,10284776605494643354,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,14878342087668820261,1749766840344394552,2097152 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,11498091521268679317,16093387636371391772,2097152 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,4921463582325456105,2208504037345054968,2097152 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,11702861955016905728,2217002031612463005,2097152 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,5245804452027812749,1011373523381726677,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10288865996087460695,13116699699628352958,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,12265735198328398386,13969326244030014609,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,7688772947754644307,11567155282047906502,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,7688772947754644307,11567155282047906502,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,7254794534061850279,16385878247027978507,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,13143244272544731868,9793170914721305265,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,14765394322863092940,14283021836169291982,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,5568008939196690908,773026181694709654,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,7358458492193019679,1722592102668167749,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,8785132923401686236,3502557883265532668,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,2180988989999500470,15708323168777488764,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2848,i,764917973927799178,10437042138284746659,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,5557884536697924664,2253403699156365928,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,5690964613563974361,11699774574705048460,524288 --field-trial-handle=2268,i,4058325188720794862,4900255133168810563,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
settings.dat
settings.dat
the-real-index
the-real-index~RFe59d48c.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5a6831.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
3b407d30-b579-450c-9c4e-05ae8beb0c91.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json~RFe59a4d1.TMP
activity-stream.discovery_stream.json
86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
webext.sc.lz4
df28a5c1-ef04-414d-a290-81191f4b71e2.tmp
content_new.js
tmpaddon
tmpaddon
compatibility.ini
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
0db6b0d8-7a4b-4f8f-b60b-89bf6f9aac5d
3046ef46-6302-4b8d-bd6c-4287ecb94550
4f3861e2-242e-4514-ac33-13571038d099
e6eec59e-7b53-4e91-ba26-f5992acd39fb
e8dfed32-bb59-4701-8a9f-92daec47603d
fafac334-546a-46e3-8ce8-339171e405b9
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs.js
recovery.baklz4
recovery.jsonlz4
memory/2520-458-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3060-467-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3060-468-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4460-462-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4460-461-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4748-13-0x0000000000730000-0x0000000000D23000-memory.dmp
memory/4748-479-0x0000000000730000-0x0000000000D23000-memory.dmp
memory/4748-469-0x0000000000730000-0x0000000000D23000-memory.dmp
memory/4748-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4748-393-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4748-980-0x0000000000730000-0x0000000000D23000-memory.dmp
memory/4748-986-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4748-470-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4748-14-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4748-12-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4748-9-0x0000000000731000-0x0000000000732000-memory.dmp
memory/4988-465-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4988-464-0x0000000010000000-0x0000000010030000-memory.dmp