Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/09/2026, 04:48
General
- Target 2026-09-04_85bb7f928841b466a72100525252ab71_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260905-ffa2natwcv
- SHA256 ac5c8b66972fa0a6e95f834bbfeef744450568de653d716c7ed5d3984b36979e
Score
10/10
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
- UPX dump on OEP (original entry point) 18 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 22 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 19 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_85bb7f928841b466a72100525252ab71_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_85bb7f928841b466a72100525252ab71_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {397e33ab-f19a-49d0-b15f-84f29fa4dbc1} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {5a7c30f8-9cee-4193-b0b7-a0e000d028b8} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {690e0b65-cc33-4531-b2f1-16cd30310cf9} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27276 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {d3b7877c-a3bd-4d2e-9d8f-f7495dd1ac6f} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 34775 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 4436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2816 -initialChannelId {2dc2a5b2-13f5-4371-9204-063cc69dc4f2} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4736 -prefsLen 35012 -prefMapHandle 4760 -prefMapSize 270279 -ipcHandle 4756 -initialChannelId {4ddc50be-8826-4780-b7f4-ce16493093d6} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 32952 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {2dc5e078-142f-41f2-aa5e-c663bbf43f32} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {734955f4-64ae-4f19-a007-fbde8fea4c50} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5616 -prefsLen 32952 -prefMapHandle 5620 -prefMapSize 270279 -jsInitHandle 5624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {0325df71-9a67-490e-a9b7-b5d926deb826} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6000 -prefsLen 32952 -prefMapHandle 5948 -prefMapSize 270279 -jsInitHandle 5996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4880 -initialChannelId {6ff45c47-a41b-46fb-abde-aa47a4eb224e} -parentPid 1472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b632⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c0,0x2ec,0x7ff8bd30c188,0x7ff8bd30c194,0x7ff8bd30c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4305845839613067992,9943947888289561057,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,12312533666274420209,13004393334447979691,262144 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,2465086041862502842,2583663146018783117,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,1803142934813004128,3312270425619907023,2097152 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,6014687262215397058,2755334866897677434,2097152 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,2223815346653746107,7429092426809583193,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,6963751094845054200,2376056704813172213,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,551377354303366941,1357690892476301505,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,551377354303366941,1357690892476301505,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,8601545615311849866,18211315373298795081,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,14960089194578581500,16148488055754652561,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,18416977642128762939,6504770747245314925,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,3128494880545471769,14664984436932886516,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,17134994043443972289,2342429391319523888,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,5235041500640942434,5111824445962906501,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,11855608038922425932,10638254526706383114,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,4501415188180982464,12871494295678480771,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,3227511679294120833,10080176482397432280,524288 --field-trial-handle=2312,i,1842946726209655229,14706538708360474065,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
manifest.json
manifest.json
manifest.json
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index~RFe59425e.TMP
SiteList-Enterprise.json
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Secure Preferences
sync_diagnostic.log
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
keys.json
metadata.json
metadata.json
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
tmpaddon
tmpaddon
compatibility.ini
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
05ecfc0c-6c24-48af-8282-2ee20b807c5c
05f7ff9f-8ba9-4d5f-953a-68b919a34f41
35995b29-c04f-4ed0-8bfb-9dc933c35fb5
3a29ad24-ace8-47fc-ae86-0b0605b118d4
b315fde5-cb79-458e-8eb9-8e136dace7b6
ed4da738-904b-443e-9369-1c782fe9f46a
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs.js
prefs.js
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
memory/3564-335-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3564-612-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3564-479-0x0000000000C10000-0x00000000011E1000-memory.dmp
memory/3564-481-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3564-378-0x0000000000C10000-0x00000000011E1000-memory.dmp
memory/3564-379-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3564-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3564-5-0x0000000000C11000-0x0000000000C12000-memory.dmp
memory/3564-12-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3564-17-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3564-16-0x0000000000C10000-0x00000000011E1000-memory.dmp
memory/4396-364-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4396-358-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5040-356-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5040-362-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5468-360-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5468-368-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5548-366-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5548-370-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5676-15-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5676-13-0x0000000010000000-0x0000000010030000-memory.dmp