floxif | 1efff2f7f7fe00e430c8af7601e8b0ed8d5305e2fa8eec590b290c4ec3c0c5ad

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Size 4.6MB
Sample260718-jb5l9act2l
SHA256 1efff2f7f7fe00e430c8af7601e8b0ed8d5305e2fa8eec590b290c4ec3c0c5ad
MD5 7944bed9cf3af139b1a46e880683e0aa
SHA1 faac5e4ba5592095ecab7fff019bf25080c91895
SHA512 15773eefa67d25f2a5f5908c14236370e42cb14d5e16d93cefcf9f1bb8084848d822702de2c9106aa2ef600435d0494facbdd08a52a155a5682d582c2fb9b293
SSDEEP 98304:JVWRBtvAX2BnzhIus03V0Ji7nt/bNARMgi:vWNvC2xzhz3Gkt/X
TLSH
T19826BE027BC4C035D7D604314C2B776853FBEEA04A7186B77398BA2D7A349D2A539B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor defense_evasion discovery floxif spyware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000600000001b86d-2.dat	floxif

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b86d-2.dat	UPX
behavioral2/memory/4952-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4952-32-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4952-35-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4952-38-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3828-56-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4952-57-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3828-315-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3828-397-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3828-409-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3828-424-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000001b86d-2.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3828	uTorrent.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Wine	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Wine	uTorrent.exe

Loads dropped DLL 2 IoCs

pid	Process
4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3828	uTorrent.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
File opened (read-only)	\??\d:	uTorrent.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001b86d-2.dat	upx
behavioral2/memory/4952-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4952-32-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4952-35-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4952-38-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3828-56-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4952-57-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3828-315-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3828-397-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3828-409-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3828-424-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	uTorrent.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5888_1423529311\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5888_38951488\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5888_38951488\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5880	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	uTorrent.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288334971078005"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\shell\ = "open"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btkey	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.torrent\Content Type = "application/x-bittorrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\Content Type	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Magnet\DefaultIcon	uTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\shell	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btskin\ = "uTorrent"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btkey\ = "uTorrent"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Applications	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Applications\uTorrent.exe\shell\ = "open"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.torrent	uTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btinstall\Content Type = "application/x-bittorrent-appinst"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key deleted	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btsearch\OpenWithProgids	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Magnet\ = "Magnet URI"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Magnet\shell\open\command	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\bittorrent\DefaultIcon	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\MIME\Database\Content Type	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btinstall\ = "uTorrent"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btsearch\OpenWithProgids\uTorrent	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\bittorrent\shell\ = "open"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btsearch	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Applications\uTorrent.exe	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btapp\ = "uTorrent"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btsearch\ = "uTorrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\bittorrent	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\MIME\Database	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btsearch\OpenWithProgids	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\shell\open\command	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btsearch	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\bittorrent\URL Protocol	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Magnet\shell	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\bittorrent\shell\open	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btapp\Content Type = "application/x-bittorrent-app"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\Content Type	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Magnet\shell\open	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\DefaultIcon	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Magnet	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.btskin\Content Type = "application/x-bittorrent-skin"	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Applications\uTorrent.exe\shell	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\.torrent\ = "uTorrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\uTorrent\shell	uTorrent.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3828	uTorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Token: SeManageVolumePrivilege	4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Token: SeDebugPrivilege	3828	uTorrent.exe
Token: SeManageVolumePrivilege	3828	uTorrent.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe
5888	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3828	uTorrent.exe
3828	uTorrent.exe
3828	uTorrent.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3828	4952	2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe	91
PID 3828 wrote to memory of 5888	3828	uTorrent.exe	94
PID 5888 wrote to memory of 6008	5888	msedge.exe	95
PID 5888 wrote to memory of 2720	5888	msedge.exe	98
PID 5888 wrote to memory of 5880	5888	msedge.exe	99
PID 5888 wrote to memory of 2720	5888	msedge.exe	98
PID 5888 wrote to memory of 2720	5888	msedge.exe	98
PID 5888 wrote to memory of 8	5888	msedge.exe	100
PID 5888 wrote to memory of 8	5888	msedge.exe	100
PID 5888 wrote to memory of 5464	5888	msedge.exe	101
PID 5888 wrote to memory of 5464	5888	msedge.exe	101
PID 5888 wrote to memory of 5464	5888	msedge.exe	101
PID 5888 wrote to memory of 1376	5888	msedge.exe	102
PID 5888 wrote to memory of 1376	5888	msedge.exe	102
PID 5888 wrote to memory of 1376	5888	msedge.exe	102
PID 5888 wrote to memory of 4388	5888	msedge.exe	103
PID 5888 wrote to memory of 4388	5888	msedge.exe	103
PID 5888 wrote to memory of 4388	5888	msedge.exe	103
PID 5888 wrote to memory of 5424	5888	msedge.exe	104
PID 5888 wrote to memory of 5424	5888	msedge.exe	104
PID 5888 wrote to memory of 5424	5888	msedge.exe	104
PID 5888 wrote to memory of 3392	5888	msedge.exe	105
PID 5888 wrote to memory of 3392	5888	msedge.exe	105
PID 5888 wrote to memory of 1312	5888	msedge.exe	106
PID 5888 wrote to memory of 1312	5888	msedge.exe	106
PID 5888 wrote to memory of 1312	5888	msedge.exe	106
PID 5888 wrote to memory of 1532	5888	msedge.exe	107
PID 5888 wrote to memory of 1532	5888	msedge.exe	107
PID 5888 wrote to memory of 3036	5888	msedge.exe	108
PID 5888 wrote to memory of 3036	5888	msedge.exe	108
PID 5888 wrote to memory of 2888	5888	msedge.exe	110
PID 5888 wrote to memory of 6028	5888	msedge.exe	113
PID 5888 wrote to memory of 6028	5888	msedge.exe	113
PID 5888 wrote to memory of 3140	5888	msedge.exe	114
PID 5888 wrote to memory of 3140	5888	msedge.exe	114
PID 5888 wrote to memory of 2324	5888	msedge.exe	115
PID 5888 wrote to memory of 2552	5888	msedge.exe	116
PID 5888 wrote to memory of 4908	5888	msedge.exe	117
PID 5888 wrote to memory of 3860	5888	msedge.exe	118
PID 5888 wrote to memory of 3860	5888	msedge.exe	118
PID 5888 wrote to memory of 4516	5888	msedge.exe	122
PID 5888 wrote to memory of 4516	5888	msedge.exe	122
PID 5888 wrote to memory of 1980	5888	msedge.exe	123
PID 5888 wrote to memory of 1980	5888	msedge.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_7944bed9cf3af139b1a46e880683e0aa_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
  uTorrent.exe /NOINSTALL /BRINGTOFRONT
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e46036
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc83cbc188,0x7ffc83cbc194,0x7ffc83cbc1a0
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,6471273545295121306,14697372617944414362,262144 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,11080357737688483796,16086055904987966385,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
      4⤵
      System Time Discovery
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,5531626436601043634,6226935393091815153,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:13
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3320,i,411614847351636571,2893614294354641904,2097152 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3324,i,7653747229208669523,16856231150035547482,2097152 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5688674964520098934,12012692166714996009,2097152 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,13487904333525190650,4726085178885919275,2097152 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,7910359182865570553,16971874751007045816,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3692,i,16460658318351304773,10300659102579992306,2097152 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,12168037219777282793,1280408093064602076,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,8800533164014632268,770495394257817024,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,1926748039691884024,9948897160690766082,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,1926748039691884024,9948897160690766082,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,15827347072735121538,10051412526058220416,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,15187603142114077906,9621309407753195437,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,2267659989238889616,17185915782824758229,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,7934765435265034276,10180028424134889298,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,18056264593481247742,15856010936591830367,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,16064978545438535598,14394879650217729799,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,15465605483121465051,6962104467810650771,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,12868673082226934276,11936567810707499810,524288 --field-trial-handle=2204,i,7902377376457466390,2656763498265648261,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
      4⤵
      PID:1980

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 608724b8d1151852958d549a6c7ac1002a66b5f03d68080012b6fc3d48c8f6b5
MD5 4d6b550138e2b4c763bbbca25d4bdb5c
SHA1 fe180d19461c4c156173dc0cb9178bbd7f4ca36f
SHA512 0224c13f75286c66f7121da290d2b0a1fb43457ab477cb38b61c8650d8aeec3cde284e152b761aecc10012ca36462c8a05802e30025e909bc37fcba87a226642
TLSH
T14271BAFB63711DE3CFA2427863EDDA99B6F7889101E39E3054825E3E4E02F4450E0987
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5f30d3655c416150b206e2118699b2ff16b7280253aebb1da307490f08f29a7e
MD5 001e5f016180235290d9198438f010f9
SHA1 ae5a1e9969b7000552e49742af3d2461ebd04e2f
SHA512 a4e8bbbd95d1ae5c5781dee128c4051aacc134c86a349bee7a530e47116d2421963b96837e2ab991dfda4aa9f18002d05ce78936b63dcc62929a451d105a77a5
TLSH
T1B271BAFB63711DE3CFA2427863EDDA99B6F7889501E39E3054825E3E4E02F4450E0987
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6013.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a6013.TMP
Size 3KB
SHA256 9d67d1bd0a8f438283f122e5ca140fb43f38c45ce230877c57341322ee766101
MD5 c1ac4e5275219e7ff053e6be335b544d
SHA1 874a97273ca9d1105e83a216e8718f11a8c7847b
SHA512 6b50e6a978321d7b7ece93d037d502800fe87c03d3b73df2c5c7c927c16232aae2c21099399adbc0916d2d7aeaf29af7b9ac3862d05c2b31d78a9272c9480519
TLSH
T1AC6185FB63311DD3DFA2477963E1C699B2F78C9101E79E2054425E3E4E02F0565E099B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f032ca5fbe1f2e2aef79b87779efad8dd16ee969c180dcb5b7ce357213398ce3
MD5 c50a6d270c2a2f1c943763e28146508c
SHA1 a0333efef78de6042f7f723f937cbee2f162bec8
SHA512 74cfea1d4b7ead3c48887205914ad1bf6b136f4de621f02ac0b221c9106d59f8fad5e72ef1b0bfd985a7ab635742cbe740dd18357e5cceaa0582aec8d7b50699
SSDEEP 96:D0hOhmh5+hVRRMzaSjhnhrhBzBh5hqh7aCihzhrV1h/AwQ:D0Ug2FRMzaSjhnRL1/M8CiBFV1iT
TLSH
T151A1ACF3C7E4962DC81156F0AB152E1BCE5E0928532C3C5A89E4AF5B93E2470E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ec820f3f20a8ab23a4dcf2e48a1c806d1434028c31e8bfd955d55a464f29eab0
MD5 2b433cfa818e2b6d00c29f5dc1800a21
SHA1 776d6bf339414f981704dfd7db8764b6c9a21f9a
SHA512 e702e15a445a2ccc595cbe580fa80b633b25def5c631a12eaa8fb061d2c2235fa705224d5605086abd1d050b159cba6ea1cc6dc183a48935380aadd15ee28a74
SSDEEP 192:sxR03RbCn/fz1sD+7w5aZ69WVXzoA8pYl/g6+WNlYX/E5aVI7kKl6ibGfIgDnJ:sxR030n/fz1sDCw5M8WV+I/5C/JVk+N
TLSH
T15B42C767AD685D3B5CCBD219BA55BB53E2F91532A1D45F48A7FC870C00E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e609ed14cc4b026bacac6fa23fec018077be5db384ca2fdc77321f00283448a2
MD5 75e6cad80586fdd28929d86d8d2cee81
SHA1 328be9dd903b0ed6dd3101f5e2ed84ec33524405
SHA512 5de48422a044cdf97f988c4863f377dcd19e4e935b83c3080343b1412b738e69be8c89575cbf15e9c0281e45515a83805f63d97292c8cbbcb113d9c278309461
SSDEEP 192:sxR0cRbCn/fz1se+7wnaZ69WVXzoA8pYl/g6+WNlYX/E5aVI7kKllibGfIgtJ:sxR0c0n/fz1seCwnM8WV+I/5C/JVB+3
TLSH
T10842B7666D689D3B5CCBD219BA65BB53D2F91532A1D45F48A7FC870C00E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f28847d4d572df8d482da8b59a89352587733717cd44d40f75988d93fd06cb1f
MD5 108f3c20fb018f2e6dd41db1d2d47c4c
SHA1 fd5246dbe76ca3ef1f857da39d4a2af4284c8704
SHA512 3022d72793dce0b3d622a3c3ad5ea6f54e47f34bdcc14aa8336073fa0a58f23dfdb496e69925971d9041fc4b36dead2e83f46cfcd1f3132f0058f767bf63730d
SSDEEP 192:sxR03RbCn/fz1sD+7wnaZ69WVXzoA8pYl/g6+WNlYX/E5aVI7kKllibGfIgDVJ:sxR030n/fz1sDCwnM8WV+I/5C/JVB+j
TLSH
T1F842B667AD689D3B5CCBD219BA65BB53D2F91532A1D45F48A7FC870C00E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 650fed9597f095c607ad37b74b6a3a31b65f28796a3aedc99b97cce0bc9d01b6
MD5 a693872020fb7b8295b896fbfa315d8f
SHA1 c4e5a785839f5e7689059ac763efd733d743f3ae
SHA512 6775dc63e6ef0685bfed74899e0c873d93bd97f328d36540d4b73f524d0fdfef1ea98ee73626c6a026f3bc6331a264512dd6d1214b12afd942d3593a82fadcd9
SSDEEP 768:dofA3j7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfkN131zro1K:dofA3VE7AxWgg+fJJu1jackNl1A1K
TLSH
T177D2DA7B640DCB7E4F804ADDEC19BA9F6DA802CB9698C94047FE851C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5aea23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aea23.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1e9dfbf848be43d9287cbc5cb4589ad45720964f80e66ff7fa0e63782ce3a039
MD5 e233285eca233f79631f315e6f1ae054
SHA1 112f596a238620cd0293d3fec9c25636cf0abc57
SHA512 a84045e3399cc79030f8c9aeca484aff7f2a09952a878d51b0751efea9ebab4171efe0260409bef676fc670ccecaa7cb1abef009b76782b8b57a411ebcf7d3b0
SSDEEP 384:nUtNn/s3n9S938NnIlH6O90slzRfY9bYz44cjBQPlLJQXmIkdP9IimIMWEfMbc+f:Uj+9y3sJIiJU44eGNHXmTWTbc+Hmb9MX
TLSH
T1CDF2BE719CA69A339EE68FE9B60B7A5ABFE4026341C81948CED97F4D00C755C035393B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4da7bf00000a78414383eec3130e96ce7f7340f42348c836c38aac837dd6c811
MD5 9f92072b9a77f8a8b561e0072f5cf7a9
SHA1 361d0c502ae7ed9ca6a06548146fc1048f5a04a3
SHA512 4595963fb59d9ea1e2f3ff55419cf39bc9ad060e01160f547d8bf6931e18182ed674dd25a3382d77a72b46faab30a64a9ab45958f58051121e368997b03711b6
SSDEEP 768:arv+4UNbdM3ACziJU41NHXmTWTbc+/seVH1SvyZ:absb+3DP4DeWn10EH1dZ
TLSH
T13F03CF31DCA98E37ADF69A88754BBA573EF8116385C40B84C9C96F4E418B54D030BE3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3401e0625cbadcbfb41ca98f89cf17b3d89440233966d2a49f33c8920871cbba
MD5 ce8ab680c7f587471e7377cdcb7b39a0
SHA1 24d1f8ed31c00a8d9097391e352c985140670152
SHA512 8348100b0691b174e1a5194a1acb7210783fd4c7e71a2acf44d060b7b5ec544b67d0bc5747efef1da18310cf01aa4e3b3efef019468340ef5d37f150239e9790
SSDEEP 768:jrv+4UNbdc3sXIiJU44epNHXmTWTbc+Hm2Yd:jbsb23dP41eWn1Gtd
TLSH
T1D403BF71ECA99A37AEF68AD8B50B7A077FB8126345C81694CDD96B4D108B05D030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 b531fecd0faeb1faa45d5cafb333271e98652b65f167df683cd971673a8eac00
MD5 d54a6eaa505fed7c63384e81b09cdc4b
SHA1 1c1aac6d2576ec26fb42ef2df87fe98b06bb1ac4
SHA512 424705cc3f191c175d4f6d6efb0ee4f4c7f3aae0753b5b2ca9eb67d602a3f34d5ba6b3d27bdb77de0418ff04d4dbed45cadda58c00a22313ceeb7d5c07b5ab3c
SSDEEP 768:7F3j+9D3KwgcfdcU44e1NHXmTWTbc+Hmb9MX:89D3Z4ZeWn1Gb+X
TLSH
T1161307F198D78637E9AE4B97673D6E45AEBCC15371881884BBC45E4CCC8607FC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 606ace66b5ff3c13e1fa120dc96b42081f9ce43459be5c629294c3361108c04d
MD5 23dd132cd9401b739b1194d5fe186e29
SHA1 0e574edfe89f9ba823f24533319640dfaf80925c
SHA512 2cd15e89dbf05b94f72e7980ce1ff846f65b4d280c81ef55e73e0b29518ab22a3b5d7c35381f7297359000a62481d9090be87726791af98ff2f215d0bacbfff5
SSDEEP 384:nHtNn/s3n9S938NnRlH6O90slzRfY9bYz44cjBQPlLJQXmIkdP9IimIMWEfMbc+f:Hj+9y3nJIiJU44eGNHXmTWTbc+Hmb9MX
TLSH
T125F2BE719CA69A339EE68FE9B60B7A5ABFE4026741C81948CED97F0D00C755C035393B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

4e5b7f9b-2f3f-46a9-aa43-744f7dd088af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4e5b7f9b-2f3f-46a9-aa43-744f7dd088af.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5888_1910065952\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f91d2d17ea675d4c2c3192e241743f9_f0432820-77ac-4537-babf-dde0594bebc5

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-189034102-168398478-1159367937-1000\1f91d2d17ea675d4c2c3192e241743f9_f0432820-77ac-4537-babf-dde0594bebc5
Size 1KB
SHA256 1e0f01b14e432042b55894a4160c5641de513ba9659afe293c0a3d3593ea5766
MD5 d1ca39e1b54cf6e80a4ecdfa08fd3379
SHA1 9266572e214d08c69ade69e36057365e0841c841
SHA512 549d6cfb184a57be6cf93d315e679521d8d3dad3a2bed572ed34a76e99f3ba463f739b66d60273ef2d13cf7ac8bcc44212040cbe446f12e51093b40b515bab9c
TLSH
T16031E6542BA22861C42FA678CB7F0A458EEE0C20D366CD008616B0742D3334CE8E47A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 3999891b21bc24fa1af02c81b82db205e16c8cb53a531a4d1d6fd1046ace1419
MD5 bc82196282ee5315c77fabca0bea1bcb
SHA1 b7e491d7ed774f9a2bfdafc85a6be2d7d296ea56
SHA512 e4e392ac637fc9513700b1c2ea3eb8985606e5fe9b72c6097aee90481201c87b648632cc2aa4655224513ced7c30786609e2a0adb327abc15446788c513cd35c
SSDEEP 96:ETGST09JElflTlt8Aa0L0kjPA84Q50eYDFQ+6J:ETPT09evENHkjPcmYxQ1
TLSH
T1740209129CFBC9F0F9EE813E02B91006B57B1B41D6B5E612D0A959F0350196F08FBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 7KB
SHA256 f500d905cc8b391941263839e9fe1358223f2e082d5447b555eadaca5686df5e
MD5 7ff8e2bc6fe051f9e05431dd4ba5387e
SHA1 95131677052fb1e5fc30b30ef2743d996574f42d
SHA512 eb669eb59f5964295e3c0abbf0a7795419d73d8d897f68f5dfbe529f5e1a19da8f9afa5f1744c2feaa3fbbf181f3ef07033e569948a2677628738113c9ee48ef
SSDEEP 96:FGUT09JYlflTlt8Aa0L0kjPA84Q50eYDFQ+TJ:FJT09WvENHkjPcmYxQC
TLSH
T1DEF109125CFFD9B0F9EE823E43B91416B1771F81E2B6EA12909949F0350195F08FBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
Size 8KB
SHA256 b8dc0ab8d572f60341ceb8ffc4963a9a84db83ab84ada8a3e3823aab70e4c12a
MD5 c25cfab61da159b18334a5545d5b955e
SHA1 279d38d0f290e3356a0c494bc9f4f7d546a040a2
SHA512 930e0aef737b4deabd9a71668c312e90a8699b326ea04a39e503f8413f65d29ff39ab241793db28da362b2e1becea24bb5c3bcfab5119e7135877466537ae094
SSDEEP 96:LfG9T09JrlflTlt8Aa0L0kjPA84Q50eYDFQ+ZJ:LfgT095vENHkjPcmYxQq
TLSH
T192020A125CFFC9B0F5AE823E03B91016B57B1B81E6B5E611D0A959F0350196F08FBB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbar.benc.new

Path C:\Users\Admin\AppData\Roaming\uTorrent\toolbar.benc.new
Size 231B
SHA256 ffe5bcba6dac90958524e5b4ba06e0a03707a46cbf7d92af505ca77a61dc8967
MD5 1cda5503e74f672c3affe109b6bde393
SHA1 514283a5b5cf53c218ce4d53b1a8d38d4f2a9667
SHA512 fa5f127bfb79564a4f37dbf4fdf4a044b916d12caebbcce1347901467dfd89bc06c07a754fcc4354db5fd0c2246c313b30a9542fb2aadebcc3cd2d8d4ef67066
TLSH
T1BED09730EBF143B45B02B8B9B1CA805F6D202404202FB4F948C0F55AA8F838C43D0050
MD5 SHA1 SHA512 TLSH

Submit Download

uTorrent.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
Size 4.6MB
SHA256 1efff2f7f7fe00e430c8af7601e8b0ed8d5305e2fa8eec590b290c4ec3c0c5ad
MD5 7944bed9cf3af139b1a46e880683e0aa
SHA1 faac5e4ba5592095ecab7fff019bf25080c91895
SHA512 15773eefa67d25f2a5f5908c14236370e42cb14d5e16d93cefcf9f1bb8084848d822702de2c9106aa2ef600435d0494facbdd08a52a155a5682d582c2fb9b293
SSDEEP 98304:JVWRBtvAX2BnzhIus03V0Ji7nt/bNARMgi:vWNvC2xzhz3Gkt/X
TLSH
T19826BE027BC4C035D7D604314C2B776853FBEEA04A7186B77398BA2D7A349D2A539B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updates.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat
Size 344B
SHA256 96ef9068aea5118729b95d8dd69053bca9a69285a7005f2cf0ab97ac1a4e9d74
MD5 7ab06c720fe955833e14b6bc2d4b19a2
SHA1 844aee5ad1f15f77d5ef22dbc32eec9db429d5d7
SHA512 dbb1b8872fddb56bd9c276b3772bdcb71b8eb29fc745dde80e5e63f44b015535372b8a814f376e1612a65f19e7ba4ccb7d3b39e5a7a289c6428548104cbc0731
TLSH
T18CE0C0B801F4C51E3831C76E55B420F083736891554893B850460C8DAC8053446D1D11
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3828-56-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3828-397-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3828-315-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3828-409-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3828-424-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3828-52-0x0000000000400000-0x00000000008C5000-memory.dmp

Download

memory/4952-38-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4952-32-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4952-0-0x0000000000400000-0x00000000008C5000-memory.dmp

Download

memory/4952-35-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4952-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4952-57-0x0000000010000000-0x0000000010030000-memory.dmp

Download