floxif | 0cda691a948ddfc52ceebd7bd282c845c24c76a4624b510f27f22ec8687b82c6

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Size 4.6MB
Sample260523-c2vreabv7q
SHA256 0cda691a948ddfc52ceebd7bd282c845c24c76a4624b510f27f22ec8687b82c6
MD5 7478f7a9355e5a98478de98f7e21b492
SHA1 8117f970cc52181a9d67675e6637a491b6db2a70
SHA512 7c76fbe0e4851dc1e694786f63f80a1de4649a0c5b1254a2433b63a5112da48d4924288b5ffa844f5ec47aa9f40fadbc74509bdced074aae9f8cd3fa2753e088
SSDEEP 98304:JVWRBt6AX2BnzhIue03T0Ji7nt/bNARMgR:vWN6C2xzhz9Ikt/c
TLSH
T1A926BE027BC4C035D7D604314C2B776853FBEEA04A7186B77398BA2D7A349D2A539B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor defense_evasion discovery floxif persistence privilege_escalation spyware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x001d00000002b276-2.dat	floxif

Custom signature

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/memory/3644-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/files/0x001d00000002b276-2.dat	UPX
behavioral2/memory/3644-35-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3644-48-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3644-56-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/700-63-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4496-76-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4496-371-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/700-610-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/700-666-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/700-684-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x001d00000002b276-2.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
700	uTorrent.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Wine	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe

Loads dropped DLL 5 IoCs

pid	Process
3644	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
4496	DllHost.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
File opened (read-only)	\??\e:	uTorrent.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3644-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x001d00000002b276-2.dat	upx
behavioral2/memory/3644-35-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3644-48-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3644-56-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/700-63-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4496-76-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4496-371-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/700-610-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/700-666-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/700-684-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
File created	\??\c:\progra~1\common~1\system\symsrv.dll.000	uTorrent.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4724	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	uTorrent.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239773859792995"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btsearch\OpenWithProgids\uTorrent	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\shell\open\command	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Magnet\shell\open\command	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btapp	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\DefaultIcon	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\bittorrent\shell	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\bittorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btkey	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btkey\Content Type = "application/x-bittorrent-key"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Applications\uTorrent.exe	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btsearch	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btskin	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btapp\ = "uTorrent"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\shell\ = "open"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Applications	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	uTorrent.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btsearch\OpenWithProgids	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\shell\open\command	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\DefaultIcon	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btskin\Content Type = "application/x-bittorrent-skin"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Magnet\ = "Magnet URI"	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Applications\uTorrent.exe\shell\ = "open"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.torrent\ = "uTorrent"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Magnet\URL Protocol	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Magnet\shell\open	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Applications\uTorrent.exe\shell	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Magnet\DefaultIcon	uTorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{1B30693F-E6F7-4E65-8B9C-2F6928236BCA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\shell	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.torrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\shell\ = "open"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\bittorrent	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\bittorrent\shell\open	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\bittorrent\shell\ = "open"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btinstall\ = "uTorrent"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btinstall\Content Type = "application/x-bittorrent-appinst"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btkey\ = "uTorrent"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\uTorrent\shell	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\bittorrent\URL Protocol	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btskin\ = "uTorrent"	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\.btsearch\OpenWithProgids	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3644	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3644	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3644	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3644	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
700	uTorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Token: SeManageVolumePrivilege	3644	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Token: SeDebugPrivilege	700	uTorrent.exe
Token: SeManageVolumePrivilege	700	uTorrent.exe
Token: SeDebugPrivilege	4496	DllHost.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
700	uTorrent.exe
700	uTorrent.exe
700	uTorrent.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 700	3644	2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe	92
PID 700 wrote to memory of 2732	700	uTorrent.exe	95
PID 2732 wrote to memory of 3512	2732	msedge.exe	96
PID 2732 wrote to memory of 4724	2732	msedge.exe	97
PID 2732 wrote to memory of 2832	2732	msedge.exe	99
PID 2732 wrote to memory of 2832	2732	msedge.exe	99
PID 2732 wrote to memory of 72	2732	msedge.exe	98
PID 2732 wrote to memory of 72	2732	msedge.exe	98
PID 2732 wrote to memory of 72	2732	msedge.exe	98
PID 2732 wrote to memory of 1568	2732	msedge.exe	101
PID 2732 wrote to memory of 1568	2732	msedge.exe	101
PID 2732 wrote to memory of 1568	2732	msedge.exe	101
PID 2732 wrote to memory of 1152	2732	msedge.exe	102
PID 2732 wrote to memory of 1152	2732	msedge.exe	102
PID 2732 wrote to memory of 1152	2732	msedge.exe	102
PID 2732 wrote to memory of 2160	2732	msedge.exe	103
PID 2732 wrote to memory of 2648	2732	msedge.exe	104
PID 2732 wrote to memory of 1660	2732	msedge.exe	105
PID 2732 wrote to memory of 2160	2732	msedge.exe	103
PID 2732 wrote to memory of 2160	2732	msedge.exe	103
PID 2732 wrote to memory of 2648	2732	msedge.exe	104
PID 2732 wrote to memory of 2648	2732	msedge.exe	104
PID 2732 wrote to memory of 1660	2732	msedge.exe	105
PID 2732 wrote to memory of 1660	2732	msedge.exe	105
PID 2732 wrote to memory of 4152	2732	msedge.exe	106
PID 2732 wrote to memory of 4152	2732	msedge.exe	106
PID 2732 wrote to memory of 4152	2732	msedge.exe	106
PID 2732 wrote to memory of 1560	2732	msedge.exe	108
PID 2732 wrote to memory of 1560	2732	msedge.exe	108
PID 2732 wrote to memory of 872	2732	msedge.exe	109
PID 2732 wrote to memory of 872	2732	msedge.exe	109
PID 2732 wrote to memory of 940	2732	msedge.exe	110
PID 2732 wrote to memory of 940	2732	msedge.exe	110
PID 2732 wrote to memory of 940	2732	msedge.exe	110
PID 2732 wrote to memory of 2040	2732	msedge.exe	112
PID 2732 wrote to memory of 2040	2732	msedge.exe	112
PID 2732 wrote to memory of 1320	2732	msedge.exe	111
PID 2732 wrote to memory of 1320	2732	msedge.exe	111
PID 2732 wrote to memory of 5016	2732	msedge.exe	114
PID 2732 wrote to memory of 2872	2732	msedge.exe	116
PID 5016 wrote to memory of 704	5016	msedge.exe	117
PID 2732 wrote to memory of 4024	2732	msedge.exe	118
PID 2732 wrote to memory of 4024	2732	msedge.exe	118
PID 2732 wrote to memory of 2524	2732	msedge.exe	119
PID 2732 wrote to memory of 2524	2732	msedge.exe	119
PID 2732 wrote to memory of 1640	2732	msedge.exe	120
PID 2732 wrote to memory of 1640	2732	msedge.exe	120
PID 2732 wrote to memory of 1552	2732	msedge.exe	121
PID 2732 wrote to memory of 1552	2732	msedge.exe	121
PID 2732 wrote to memory of 5620	2732	msedge.exe	122
PID 2732 wrote to memory of 5620	2732	msedge.exe	122
PID 2732 wrote to memory of 6008	2732	msedge.exe	125
PID 2732 wrote to memory of 6020	2732	msedge.exe	126
PID 2732 wrote to memory of 6032	2732	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_7478f7a9355e5a98478de98f7e21b492_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
  uTorrent.exe /NOINSTALL /BRINGTOFRONT
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e46036
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7fff6847c188,0x7fff6847c194,0x7fff6847c1a0
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1798944535826927412,12525821892862626833,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
      4⤵
      System Time Discovery
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,7686686200807730717,14271832597552841684,262144 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:72
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,16038798615532696585,8771988422965445300,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,2171851554525846369,1383960004775353523,2097152 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,18351655922130340851,13266287351100847078,2097152 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,14174673910802758685,1362262144719694269,2097152 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,3083374628181515157,2515606350341264885,2097152 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4192,i,6057700201469608268,17322723602807238333,2097152 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4204,i,3390904807560517046,7498424397978425395,2097152 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:9
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,2476507530601311273,407484439101245401,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,5401440087344330355,3844483750906576785,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5612,i,2697293274522495973,1220314230263946726,2097152 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,18221342926452499185,16459239208355513264,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,14751045727582400643,2023444541031138874,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,17192452823118704063,13573878769568227793,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,18214092730451260882,29768089967181218,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,18214092730451260882,29768089967181218,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,4156471770798943911,7891941846501565986,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,14932296709393500169,10344760821725130011,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,6850134498488532627,311396507671403582,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,12053406835211302267,2610089740280298427,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,15953163377095668757,3154328311814416783,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,13322501514226253467,11037709938255591064,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,6748975150590922778,18033953363396995760,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,5044844324634849703,12754502843286693786,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,14963327786743980182,2507334532180356840,524288 --field-trial-handle=2152,i,9448105106028702530,6557334713405377164,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14
      4⤵
      PID:5628

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll.000

Path C:\PROGRA~1\COMMON~1\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4970154c03e71372a250182be039e454337be64d232075875a85fe45679e9791
MD5 f5c5af3b32bf2f99864931d9fb64fb42
SHA1 f24e357193c4d16a3e2dd7ccb217f49678a9ab6f
SHA512 e13cff7f429aabbf53f978beb247cb48c5b6dc77f3bd5cc5401dd0008d1b0788c163e99967285b341713f8d21e369c5402e6a1776cbc28df24efbcdd678eba70
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T11EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f4fe4c0a68c57129c3852ff3d2709e311233475a27b930855ee9deb021b658e0
MD5 ffb29f8933c11f2eb711e962c78c7312
SHA1 82e2031a9c05f1f9698cbd6fc70ff01d052f4599
SHA512 b7596fa53a8a45d199c82e872c89d700c7bd26f06843bcb1f7c6bc4e7826dc3458b956d763d4227ba4620dcda1ba2af0fa8f6b46d7db0fcdd1671e8d8d4489bd
TLSH
T13781823055E2C99BD7234E3D82C1751C77B3459A0D335E120288ABBAAF33772C232AD9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d0b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d0b4.TMP
Size 3KB
SHA256 ee7240d97cf2ab346888790944a1e9993a4c537be4c5f33bcc922031d4809b23
MD5 d8d4148d7a400ec7f23e3a7857800f69
SHA1 6a0eacc083b79b5567eb4537cfd9b9e53eae4aa9
SHA512 75338504eb324cda78572274bdc68a20ed5ced28738ca47e156db89bd2845ea6aab40b589a394777cd2edce3e17547873eab5e4e5a356e8fa49dd33baef309bc
TLSH
T1DD613C3459E2C997D7274E3EC2D1760D377306AA0E334E061088ABB5AF32772D675AD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b711b282586f0e7d98f1493f092d6027be41d027b5b285eb1603d68041b2f974
MD5 bc400d4ed33bd8347f86c1694ef5c4ce
SHA1 1de81e6bcf72355fd4db35d1f9427041b6cc6ad4
SHA512 4a8ebc93a6ccc58515482d4abc14be1f20af98b5fc62f64fe00fe34d7aba24ea7b1eaa98dbda70e859d9a62a29883eb433339c4c1a272531b58b7a113f8b939e
SSDEEP 192:sxZeR5yM/jK1Ml8Mc9/fzsv+4kxebvIdpGr/W6+WN7ymZ/P3zw5u0a9xHIg4J:sxZen09/fzsv+4kIbAs/bR/PUR6c
TLSH
T12B52FA46AA34597BCCDBD219FA55BB53D6F9147292940D44AEFCCA0C04E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b4466e74470c7c60a404177bdb9b3e50ab4a43d6841791d9cb4b5e0df9220afc
MD5 a98d1c1bf80ece9ccd9f7ef0ac1c5cff
SHA1 d3dc8bf65cd5c875a33fe8b51c4c0b18d164d5dc
SHA512 587a2589c6d22ca6a50b7f7b739d520b5b4a9874bb8b54211f9403e997c510e8c16323cda259476c9f66b21cdbab76c0bc80e7b0ab96aad1fcd2d499bf2f21ea
SSDEEP 768:uR/zh8dF2UL7pLuLXEkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3lVJjLlW:uR/zh8dF2UdEXEkWRmEcQXwu1jaKlVJQ
TLSH
T18A030B3F280CCB7E4F804E9CEC2A7E9A6EE8018B5698895447FA844C03C66EF55175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a585bb52a5f4dabc437a0e6c87d09c8f80e019254828218ea0342d701d8c7ef8
MD5 7ac0c3a2a613227d7606f996095f45ef
SHA1 e2f6801acc4b67c22403d7dab2c1bd484753f6a3
SHA512 6081c26fdb1d237a84d1fd067f0d5fe14761cdf8ee65fa42e945c319144a6b58fcafd50ae84884f2e4b2245f92d709a002148bf436799276191d700c7bd82d65
SSDEEP 48:KEWIHKvjuI/K/6IHylNINKmg43yBGInKvKgY:KEWgKvjucK/6SONmKmgiCGkKvKD
TLSH
T106B1284631BA46113D7E390DA3A4CB170A8273673059E92F7B6950724E6BF206DFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d9381bdad384f6a5820ed6ec051e7a2468a276ee555329c3f624efad3d8fff1a
MD5 94b9a6cc02d882d947ff5bb90def56ab
SHA1 46d30520aad096d75f5238d8544787d7c71bd8a3
SHA512 56266358459523ac8b85e224ed687730f5785a1fe9d4ed2f6b11f4d12cc1088a376f73cbd42451b7d9d4c0abfd7bf0d1f267a7d3cdefa9d761a8dd1a6828868b
SSDEEP 384:nmtNnNnb9o8N98pW0ubT7LnscOjKywqIiU1bJD:mjZb+c0k7scOOBqIiWtD
TLSH
T170927C7658396D779DA6A505F54A37135FF810BB9C892FC8E9C84F0E01DB78C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c4dbfed5ff7443579013c3acfb30433d5534d46efbd1337deda8dbdd1770168a
MD5 c8243a7e710782efc168ee8c3ac237fc
SHA1 723567dc9cd128e954bd72b07260639cf5bca625
SHA512 10f6d0c13296669c93f7c699a789edcc81497883b459659d5f360bbbda9c1e33c519cf49886299b08c3650a2e4cfbae788ec0ff817eb629e12b37bf8a2e05d94
SSDEEP 384:nXtNnNnb9o8N9bpW0ubT7LnscOjKywqIiU1bJD:XjZb+f0k7scOOBqIiWtD
TLSH
T16D927C7558396D679DA7A505F64A37135FF810BB9C892FC4E9C84F0E01DB78C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 594e079e8fc11ca64b2fcb3983e76e44126e2998ac8a204df74a7214638668b3
MD5 0c06dfa89101aeb16f32f4dd19c5391d
SHA1 8f98f5661d3bec85f739592b203830a00cac9b72
SHA512 a82b2b78e7df24c717354a777bc61fc32dc781dd4c28048dc309665150faae9ebb11a1d0c521a75bb08e8555934c810b2b4eb7b9a01df7ac659cb602b3f50cb6
SSDEEP 192:BGN96P2UOcQmiUyBIUoqGv0cOjTwSRCU6:BGN96eXs+IjqGscOjjQU6
TLSH
T15702E9796D782CB78FA2AE45B88677134FD8106BE9962B84D9D41F0C00DB65C3347926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83276f594e0213484440a15c0f64e047d0bf254f4fdec95eb08fc0dd31b88cc1
MD5 f67a7df64f0a94b9c28341cbb0eda0da
SHA1 760baf47703a98d2b6c95732f29a6cbcb970fe1d
SHA512 210c05baace2ab8e08339fb3eef6153f033bb22c9af5d8a69073e537bf76bd59d5ad09f53ea01b4f67c915cdcd19eafda52a8d7ad6a1da367687d8760d88d65c
SSDEEP 192:BGNA6P2UhQmiUyKEoJGv0cOjK8NC0Be/qkU6:BGNA6eEDTJGscOjKyHqU6
TLSH
T1E412F8B56C68AC671EA2A545F8C677538FE820B7DD862F84E5D41F0C00DBB8C374A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9be34b6a739c6d33a275ec5c81cf6dceb69191431b78524091dbcddc4b106d05
MD5 62efb49b61bead3f3e96dd579498ce4f
SHA1 e38ec8e8e1e94c712c413e9e3faa329fa7f4d888
SHA512 a1b664a741b2ea55fe315299626e2fb490218e433d4249e4455738e406e85f64b128e7326e5606e5e9b9e6ee29031bb8f187839c527d9e12a8d970d147970e2f
SSDEEP 384:nBtNnNnb9o8N9opW0ubT7LnscOjKywqIiU1bJD:BjZb+c0k7scOOBqIiWtD
TLSH
T153927B7658396D679DA7A505F54A37135FF810BB9C892FC8E9C84F0E01DB78C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea240328-f222-4b82-866d-a3263f381077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ea240328-f222-4b82-866d-a3263f381077.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

096312be-c117-4d7f-980e-dcfb7700280e.tmp

Path C:\Users\Admin\AppData\Local\Temp\096312be-c117-4d7f-980e-dcfb7700280e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

24863a29-3bb8-4e77-a62d-1f4a4bcbc760.tmp

Path C:\Users\Admin\AppData\Local\Temp\24863a29-3bb8-4e77-a62d-1f4a4bcbc760.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8481154E3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\A1D26E2\8481154E3C.tmp
Size 4.5MB
SHA256 1f39d582ff6e6ab4af6c377670c9e8c2b1859f0c2484b1cd9c28629c652161dd
MD5 bfefeac4bc2447bfda3ab718200db2e9
SHA1 49aa1da5becb748d974c71673ec497d8e63ad6b6
SHA512 8b9f30417d78f4c999c63932ea57ad12660dfd59d4fc1d0e323e7af99025761fcf1a072387d3c8b5ce61599a8f94611f8c8831fd180e7d426a3a0d36478b616a
SSDEEP 98304:JVWRBtvAX2BnzhIue03C0Ji7nt/bNARMg:vWNvC2xzhz9nkt/
TLSH
T12826BE027BC4C035D7D604314C2B776853FBEEA04A7186B77398BA2D7A349D2A539B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf3d86ce-1e2f-4db9-b184-80a96a35c9cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2732_1370486190\bf3d86ce-1e2f-4db9-b184-80a96a35c9cb.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2732_801927867\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f91d2d17ea675d4c2c3192e241743f9_26c1aebe-42fe-413d-a497-f47c50f079d9

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1679180529-4058988202-686829476-1000\1f91d2d17ea675d4c2c3192e241743f9_26c1aebe-42fe-413d-a497-f47c50f079d9
Size 1KB
SHA256 7b8b8057095144e4855c798ded6303593b7c9be9746d18c4e985fdac825bbf20
MD5 547e67099a6d695357faf3e55a4841fd
SHA1 e6c2f00e5cbb5680e42b1524e8f10b258e9cfdb2
SHA512 5bdee85c1f341360ea69639adeda13537b9d249fc3795164942196880783c569fb1e95523c2dd106a13ab4111ec5f78b246b16a4e73edc3aa50ac6ffd82621e2
TLSH
T1B9319619624390C1F058067DAB4B46E58DD2AF281A73DDFA57ACAE6112257101839B93
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 57122ac16692906985d361a3ecedaf88a9180f4d0c6ef815b987a6de5e757ecc
MD5 eb3b271706349d8cc9cd8ec8d46ffe26
SHA1 968f1bd61e3df784cf4ed508005e419e736c0cf4
SHA512 06ac7736e1ef3450d368c2ab85bd448b6c4f7eecb4141c316d438ae85a26410fce227bb8aee85325e73e2499e203b2bef98434a39794d02c2d569a64bf52cd29
SSDEEP 96:xLCT09JrlflTlt8Aa0L06wZLJXuju50eIB+PJ:xuT09pvENHl5uI1
TLSH
T127021A232CFFC9B0E4AEC13A6BB5400B717A1B81D5B6F612A05989F0340262F0CDBF16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 8KB
SHA256 9cae0b8fe7374de296208e13631b1a52c9616d5ef0d32fd55c98b9b1974fbd9c
MD5 82327e0c956513d65a13dd8508c7080a
SHA1 0afbef70afe012d4c883cb75591558a03cea755b
SHA512 e714a1371da5765ce26ee251fda7ce11c85101d5df4e075165682f703665793dbd3c3ca42ac247506c52a32403a454a54a952cf2b1e9f4c9be7c317760d33c08
SSDEEP 96:/L8T09JElflTlt8Aa0L06wZLJXuju50eIB+aJ:/4T09qvENHl5uIY
TLSH
T137020A236CFFCDB0E4AA913A67B9400B727A1B81D5B6F652A05989F0350152F0CDBB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 7KB
SHA256 816f6167b9e27a021a8492918f51ae809dba2805b293e53172f37d9a4c484d10
MD5 c9c91acd34ad78907106f149bdcf4122
SHA1 2e7122e1358e43a770522412dd4f903b7ebd25c7
SHA512 662f3dc7d165ab0bbcfa17f4799ba3d78e5f6ae525d348111f93e3f1744f740864583a5bd695cf74ce0fd10ed581db8b82417d7f7ac1e12c5b9854fea643076f
SSDEEP 96:YwL57T09JYlflTlt8Aa0L06wZLJXuju50eIB+AJ:YwF7T09WvENHl5uIy
TLSH
T100F10A236CFFCDB0E46AC13A67B9404BB27A1B81C5B6F612A09989F4350152F0CDBB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbar.benc.new

Path C:\Users\Admin\AppData\Roaming\uTorrent\toolbar.benc.new
Size 231B
SHA256 ffe5bcba6dac90958524e5b4ba06e0a03707a46cbf7d92af505ca77a61dc8967
MD5 1cda5503e74f672c3affe109b6bde393
SHA1 514283a5b5cf53c218ce4d53b1a8d38d4f2a9667
SHA512 fa5f127bfb79564a4f37dbf4fdf4a044b916d12caebbcce1347901467dfd89bc06c07a754fcc4354db5fd0c2246c313b30a9542fb2aadebcc3cd2d8d4ef67066
TLSH
T1BED09730EBF143B45B02B8B9B1CA805F6D202404202FB4F948C0F55AA8F838C43D0050
MD5 SHA1 SHA512 TLSH

Submit Download

uTorrent.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
Size 4.6MB
SHA256 0cda691a948ddfc52ceebd7bd282c845c24c76a4624b510f27f22ec8687b82c6
MD5 7478f7a9355e5a98478de98f7e21b492
SHA1 8117f970cc52181a9d67675e6637a491b6db2a70
SHA512 7c76fbe0e4851dc1e694786f63f80a1de4649a0c5b1254a2433b63a5112da48d4924288b5ffa844f5ec47aa9f40fadbc74509bdced074aae9f8cd3fa2753e088
SSDEEP 98304:JVWRBt6AX2BnzhIue03T0Ji7nt/bNARMgR:vWN6C2xzhz9Ikt/c
TLSH
T1A926BE027BC4C035D7D604314C2B776853FBEEA04A7186B77398BA2D7A349D2A539B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updates.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat
Size 344B
SHA256 96ef9068aea5118729b95d8dd69053bca9a69285a7005f2cf0ab97ac1a4e9d74
MD5 7ab06c720fe955833e14b6bc2d4b19a2
SHA1 844aee5ad1f15f77d5ef22dbc32eec9db429d5d7
SHA512 dbb1b8872fddb56bd9c276b3772bdcb71b8eb29fc745dde80e5e63f44b015535372b8a814f376e1612a65f19e7ba4ccb7d3b39e5a7a289c6428548104cbc0731
TLSH
T18CE0C0B801F4C51E3831C76E55B420F083736891554893B850460C8DAC8053446D1D11
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-64-0x00000000026B0000-0x00000000026E0000-memory.dmp

Download

memory/700-65-0x00000000026B0000-0x00000000026E0000-memory.dmp

Download

memory/700-684-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/700-610-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/700-612-0x00000000026B0000-0x00000000026E0000-memory.dmp

Download

memory/700-611-0x00000000026B0000-0x00000000026E0000-memory.dmp

Download

memory/700-57-0x0000000000400000-0x00000000008C5000-memory.dmp

Download

memory/700-63-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/700-666-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/2872-656-0x000001EFD9A50000-0x000001EFD9C71000-memory.dmp

Download

memory/3644-56-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3644-48-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3644-0-0x0000000000400000-0x00000000008C5000-memory.dmp

Download

memory/3644-47-0x0000000075DA3000-0x0000000075DA4000-memory.dmp

Download

memory/3644-35-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3644-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4496-371-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4496-76-0x0000000010000000-0x0000000010030000-memory.dmp

Download