Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 02:11
General
- Target 2026-10-13_ed1cee60944c7d461cc6d19c3e400ade_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample261014-cmplvaez7r
- SHA256 05b153e7d94af148a46c1a7de268cc5b0b25946f13aa537a2783150d38fbfd1e
Score
10/10
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
- UPX dump on OEP (original entry point) 13 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 22 IoCs
- Modifies registry class 19 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_ed1cee60944c7d461cc6d19c3e400ade_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_ed1cee60944c7d461cc6d19c3e400ade_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {0762b7c0-b4ac-477c-88ea-e1ad117d8feb} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {b2fcd689-afb0-47d8-8e45-8d163595c862} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25164 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {731851f6-9cc5-403d-ae2a-dbb61532bb12} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3796 -prefsLen 27274 -prefMapHandle 4044 -prefMapSize 270279 -ipcHandle 4116 -initialChannelId {0dd6884c-5203-4908-9355-982ecb2fb316} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4528 -prefsLen 34773 -prefMapHandle 4532 -prefMapSize 270279 -jsInitHandle 4536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4544 -initialChannelId {fbbf158a-39c3-46b8-b0c6-f397bdbe2874} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5144 -prefsLen 34929 -prefMapHandle 5148 -prefMapSize 270279 -ipcHandle 5160 -initialChannelId {31aea454-6898-40e0-8e99-740096eba636} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2836 -prefsLen 35062 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {9057fba0-1ec8-4b07-840e-fe6d0dbde9b9} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1628 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5780 -initialChannelId {42ead87b-ca46-4047-b43d-a91f2dc06b69} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32952 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5792 -initialChannelId {29d8bc5c-b785-4f63-9236-8f759c70901f} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5920 -prefsLen 32952 -prefMapHandle 5924 -prefMapSize 270279 -jsInitHandle 5928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5936 -initialChannelId {46404f8b-fafc-4fad-aeb7-5007f0f82132} -parentPid 1436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b632⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x304,0x7ffe3e62c188,0x7ffe3e62c194,0x7ffe3e62c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,15247240032817604380,7992157464106554441,262144 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,6671317501582544595,13461782489177761661,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,9296828312226987832,6268426687922788671,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,13489118263329113593,13361831423171058476,2097152 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,5548481333048591982,1849094542351911381,2097152 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,13689334812401823964,9345751904764935924,2097152 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,16138552867685900000,15452976000545989280,2097152 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,17889634500513427308,3148358482046288899,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,371373473971686743,1292987279157024882,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,358824559302989429,12514417542778424066,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,17684213558238047359,10299783441025507566,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,17684213558238047359,10299783441025507566,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,1719867393866752665,13951303813802208092,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,16605004942073562713,5422632009786171952,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,14475815345031322600,12958808669151943221,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,11265516613564770237,9633147747866164410,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,8381834744759835099,10070591430221486868,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,2330624876056768861,6084388779242134525,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,1972037994949140261,12304756079403359694,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,11641501211600018052,1174575316679843117,524288 --field-trial-handle=2460,i,13870280085238836732,14666534312884639715,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
96b5f595-1b3e-4d64-b630-4a02f6d82f86.tmp
settings.dat
settings.dat
34037930-ce1f-44ac-9d5d-f3b3fac078c7.tmp
421afda9-c140-49b5-a515-fb208462fb64.tmp
4ae721c9-7b0d-47c7-9ca4-f9a255bba5c3.tmp
624cb55e-b07b-4565-b4eb-58527b042cae.tmp
7cf31208-6f52-45f0-a5c9-186dcf252171.tmp
temp-index
the-real-index
857b3610-7204-4734-94a0-9e968dbeb095.tmp
SCT Auditing Pending Reports
ba939bb5-7272-4c15-aaee-484eab175923.tmp
c785d061-8d25-40f6-a08d-7a67766523d1.tmp
41db3cd6-9d33-47ba-8940-e8aa4e31b5c6.tmp
OperationConfig
70356a26-bb4f-4538-b5f6-297a5cce74ab.tmp
d6d055ca-20db-4a78-b0f4-6b10645b2384.tmp
e80a5a76-7811-43e6-a731-eecf0ae3300c.tmp
898ac2c3-5dba-4e5f-966a-5936474cadf1.tmp
f09b3ce3-2cc7-44d9-9ec3-e3026c4d3a22.tmp
f37b6e36-5853-46e5-b87a-61aa3f6a834c.tmp
f5cb2933-c4cf-43e4-87fd-a49eaa14e519.tmp
activity-stream.contile.json
activity-stream.discovery_stream.json
E9338C5CCF1E2FCF149487351399F198A4F9FCD6
webext.sc.lz4
webext.sc.lz4
02808bd9-6ad9-4dd2-ac28-25165497dec3.tmp
b712957b-0172-4021-8d65-3aa7b21aed47.tmp
c7b1467a-a8f5-4dd4-8a2a-8f8ef33495d3.zip
content.js
tmpaddon
tmpaddon
tmpaddon
addonStartup.json.lz4
broadcast-listeners.json
broadcast-listeners.json
compatibility.ini
store.json.mozlz4
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
420eab5d-41b6-4396-ad0b-4422ef8c5d86
60d99c73-427d-424b-99d4-690688b702d3
bf1369a1-6b8b-4ea0-9762-c500dc1c7fc4
ec41e9db-38f9-415b-8e44-dae7258cf76c
f2247740-5e1e-45a2-8639-f9239fd15539
extension-preferences.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
sessionCheckpoints.json
sessionCheckpoints.json
recovery.jsonlz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
targeting.snapshot.json
xulstore.json
manifest.json
manifest.json
memory/244-415-0x0000000010000000-0x0000000010030000-memory.dmp
memory/924-418-0x0000000010000000-0x0000000010030000-memory.dmp
memory/924-419-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3612-435-0x0000000000510000-0x0000000000AE1000-memory.dmp
memory/3612-700-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3612-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3612-698-0x0000000000510000-0x0000000000AE1000-memory.dmp
memory/3612-9-0x0000000000511000-0x0000000000512000-memory.dmp
memory/3612-343-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3612-420-0x0000000000510000-0x0000000000AE1000-memory.dmp
memory/3612-13-0x0000000000510000-0x0000000000AE1000-memory.dmp
memory/3612-14-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3612-12-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3612-421-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4784-410-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4784-413-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5812-408-0x0000000010000000-0x0000000010030000-memory.dmp