Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 02:55
General
- Target 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260905-des5qsbe79
- SHA256 fcaab121d8608deb838394475f5e1736e0175016d7e9ade239d57acef8cd0b72
Score
10/10
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
- UPX dump on OEP (original entry point) 8 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 22 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 18 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {fa56e01c-7c4f-4dda-a661-56d05e257ff1} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {a00ec4ce-eb9b-4443-af9c-acc37be912a6} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3964 -prefsLen 25164 -prefMapHandle 3968 -prefMapSize 270279 -jsInitHandle 3972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3980 -initialChannelId {c77960ea-163c-495e-bf47-bc6ba1cf1c40} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4144 -prefsLen 27274 -prefMapHandle 4148 -prefMapSize 270279 -ipcHandle 4216 -initialChannelId {003e5ab7-11ac-4d34-9f14-a50400e11977} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3040 -prefsLen 34773 -prefMapHandle 3160 -prefMapSize 270279 -jsInitHandle 3164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {16981e30-53c1-48cc-98a8-18d2c04f2cb9} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2808 -prefsLen 35010 -prefMapHandle 2812 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {5aed93b0-2aa6-455e-a58d-7189011e5a7c} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3284 -prefsLen 35062 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4612 -initialChannelId {d988cd12-9ae7-4f03-98c8-162df9d5b70e} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {983938d3-1f45-42ef-91f5-76921219c717} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {c0626144-6ce1-4041-9c00-bc3f89e1b74e} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5972 -prefsLen 32952 -prefMapHandle 5976 -prefMapSize 270279 -jsInitHandle 5980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5992 -initialChannelId {ae08d4b3-a8b7-4c1d-a041-74d21533bf47} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b632⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffeb5a2c188,0x7ffeb5a2c194,0x7ffeb5a2c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,3155821489608032548,5035856304176992800,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,8580108139060801119,13078900092188497883,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2020,i,2536910820570734100,17252854619519792957,262144 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17909750353231659117,14017576127466655537,2097152 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,592576415465582282,2998227023477343248,2097152 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,14908978644371542083,4790231688048096850,2097152 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,4115339856149886344,16925431902918016058,2097152 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,9641571237463537232,320037600160731316,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,8472339764229448647,15471111392952307980,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,11010117234936602890,631566442245092026,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9773327756396844055,194027365346447653,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9773327756396844055,194027365346447653,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,14902708377360521313,15333174292886333943,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,9610822376789002524,1157213922050129182,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,12403010373414051844,8620214526288172138,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,18013582692982774711,11330858870476633665,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13994942993588354624,10520246635954414882,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,4445448862849100151,17720401243800314529,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3321171278724577866,14773786070859129649,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,16447274376673482335,12173171388796147592,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,3064983611740942943,15857317486849678242,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,11039957328131041472,7414860727671890019,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,12342395443612864876,13273916769625125511,524288 --field-trial-handle=2968,i,8507345654284953089,176206400117382012,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
settings.dat
settings.dat
the-real-index
the-real-index~RFe5af5ea.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
697feb10-33b1-4d2e-ace6-d70b46facaa4.tmp
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
75be306e-24af-4b75-968b-229d293b2028.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json~RFe5ac499.TMP
webext.sc.lz4
0b02a2c2-812f-4be2-9914-363949f04c45.tmp
content_new.js
tmpaddon
tmpaddon
compatibility.ini
data.safe.tmp
events
0cc8e69d-3fcb-48d1-a9d9-edd2a1e6e01c
16a3086c-116c-48bb-a1bc-f35c4ab9d753
21ccc950-9f6e-49e1-a2a3-e8a8ec55d404
349e0c48-83d9-40aa-aae8-9634d705d62d
ad61f725-3e30-4c81-ad4d-7a6815a4562f
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
recovery.baklz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
memory/3632-432-0x0000000000920000-0x0000000000EF1000-memory.dmp
memory/3632-321-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3632-539-0x0000000000920000-0x0000000000EF1000-memory.dmp
memory/3632-540-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3632-414-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3632-433-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3632-11-0x0000000000920000-0x0000000000EF1000-memory.dmp
memory/3632-12-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3632-10-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3632-9-0x0000000000921000-0x0000000000922000-memory.dmp
memory/3632-3-0x0000000010000000-0x0000000010030000-memory.dmp