5ba64eae248e366b5362924ea14c37ad6f6b13edf490a08d8a73d3ae17074a1e

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Size 5.9MB
Sample260925-n7txvaxt5j
SHA256 5ba64eae248e366b5362924ea14c37ad6f6b13edf490a08d8a73d3ae17074a1e
MD5 3731a3514c9c45ca0d1e41a9c595bbe9
SHA1 d351b66565db5db35b0e14ca2c7d8535c4844cd9
SHA512 c31dd6c5b0fc5eeda7b4bfdd94bccc19d8f2ca80ba534c5614d501738e4acc110255cd15a67b163256ade98636c76d9657e4ad6943989a26c8ebbfd46480de2f
SSDEEP 98304:SN3UCn8wP3ZQiZW6n8f+aI8lB14c5l1twuXnvfNUMoHl:WJ9Pu+WJF
TLSH
T12E56BF1376C18037D69300714C2A677951FBEDB81A718AD7B398BA2D3E745C2A53BB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000400000-0x0000000000A23000-memory.dmp	UPX
behavioral2/memory/4664-21-0x0000000000400000-0x0000000000A23000-memory.dmp	UPX
behavioral2/files/0x000d00000001c508-33.dat	UPX
behavioral2/memory/4256-34-0x0000000000400000-0x0000000000A23000-memory.dmp	UPX
behavioral2/memory/4664-41-0x0000000000400000-0x0000000000A23000-memory.dmp	UPX
behavioral2/memory/4256-52-0x0000000000400000-0x0000000000A23000-memory.dmp	UPX

Downloads MZ/PE file 2 IoCs

flow	pid	Process
112	4256	BitTorrent.exe
164	4256	BitTorrent.exe

Executes dropped EXE 13 IoCs

pid	Process
4256	BitTorrent.exe
2304	bittorrentie.exe
4612	bittorrentie.exe
1300	bittorrentie.exe
2396	bittorrentie.exe
1348	bittorrentie.exe
2192	bittorrentie.exe
5780	bittorrentie.exe
2660	bittorrentie.exe
4516	bittorrentie.exe
108	bittorrentie.exe
4344	bittorrentie.exe
5004	bittorrentie.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Wine	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	BitTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Wine	BitTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000400000-0x0000000000A23000-memory.dmp	upx
behavioral2/memory/4664-21-0x0000000000400000-0x0000000000A23000-memory.dmp	upx
behavioral2/files/0x000d00000001c508-33.dat	upx
behavioral2/memory/4256-34-0x0000000000400000-0x0000000000A23000-memory.dmp	upx
behavioral2/memory/4664-41-0x0000000000400000-0x0000000000A23000-memory.dmp	upx
behavioral2/memory/4256-52-0x0000000000400000-0x0000000000A23000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bittorrentie.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4340	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	BitTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	BitTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	BitTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	BitTorrent.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	BitTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\bittorrentie.exe = "1"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	BitTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\bittorrentie.exe = "0"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	BitTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\bittorrentie.exe = "11000"	BitTorrent.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348114532297704"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent\\maindoc.ico"	BitTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btsearch\ = "BitTorrent"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\shell	BitTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btapp\ = "BitTorrent"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btskin\Content Type = "application/x-bittorrent-skin"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btsearch\OpenWithProgids\BitTorrent	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Applications	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Applications\BitTorrent.exe\shell\open\command	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Applications\BitTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent\\BitTorrent.exe\" \"%1\" /SHELLASSOC"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent\\BitTorrent.exe\" \"%1\" /SHELLASSOC"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btinstall\Content Type = "application/x-bittorrent-appinst"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.torrent\ = "BitTorrent"	BitTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\Content Type\ = "application/x-bittorrent"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btsearch	BitTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\URL Protocol	BitTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent\\BitTorrent.exe\" \"%1\" /SHELLASSOC"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\DefaultIcon	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btinstall	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btinstall\ = "BitTorrent"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btkey	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Applications\BitTorrent.exe	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	BitTorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btsearch	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\Content Type	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btapp	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\ = "Magnet URI"	BitTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app\Extension = ".btapp"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btkey\Content Type = "application/x-bittorrent-key"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{9C2BC8AA-1FA0-4F58-B475-CC4E3575EC79}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\Content Type	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\Content Type\ = "application/x-bittorrent"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btskin\ = "BitTorrent"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\shell\open\command	BitTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent\\maindoc.ico"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type\application/x-bittorrent	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\shell\open\command	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\shell\open	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-key	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.btsearch\OpenWithProgids	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Applications\BitTorrent.exe\shell	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent\\maindoc.ico"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\BitTorrent\\BitTorrent.exe\" \"%1\" /SHELLASSOC"	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\.torrent	BitTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	BitTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	BitTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\Content Type = "application/x-magnet"	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Magnet\DefaultIcon	BitTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\BitTorrent\shell	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4664	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
4664	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
4256	BitTorrent.exe
4256	BitTorrent.exe
4256	BitTorrent.exe
4256	BitTorrent.exe
4256	BitTorrent.exe
4256	BitTorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4664	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
Token: SeManageVolumePrivilege	4256	BitTorrent.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4256	BitTorrent.exe
4256	BitTorrent.exe
4256	BitTorrent.exe
3060	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4256	BitTorrent.exe
4256	BitTorrent.exe
4256	BitTorrent.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
2304	bittorrentie.exe
2304	bittorrentie.exe
4612	bittorrentie.exe
4612	bittorrentie.exe
1300	bittorrentie.exe
1300	bittorrentie.exe
2396	bittorrentie.exe
2396	bittorrentie.exe
1348	bittorrentie.exe
1348	bittorrentie.exe
2192	bittorrentie.exe
2192	bittorrentie.exe
5780	bittorrentie.exe
5780	bittorrentie.exe
2660	bittorrentie.exe
2660	bittorrentie.exe
4516	bittorrentie.exe
4516	bittorrentie.exe
108	bittorrentie.exe
108	bittorrentie.exe
4344	bittorrentie.exe
4344	bittorrentie.exe
5004	bittorrentie.exe
5004	bittorrentie.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4256	4664	2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe	91
PID 4256 wrote to memory of 2304	4256	BitTorrent.exe	94
PID 4256 wrote to memory of 4612	4256	BitTorrent.exe	95
PID 4256 wrote to memory of 1300	4256	BitTorrent.exe	96
PID 4256 wrote to memory of 2396	4256	BitTorrent.exe	97
PID 4256 wrote to memory of 1348	4256	BitTorrent.exe	98
PID 4256 wrote to memory of 3060	4256	BitTorrent.exe	99
PID 3060 wrote to memory of 3848	3060	msedge.exe	100
PID 3060 wrote to memory of 4340	3060	msedge.exe	102
PID 3060 wrote to memory of 2316	3060	msedge.exe	103
PID 3060 wrote to memory of 2316	3060	msedge.exe	103
PID 3060 wrote to memory of 2316	3060	msedge.exe	103
PID 3060 wrote to memory of 2892	3060	msedge.exe	104
PID 3060 wrote to memory of 2892	3060	msedge.exe	104
PID 3060 wrote to memory of 424	3060	msedge.exe	118
PID 3060 wrote to memory of 5880	3060	msedge.exe	106
PID 3060 wrote to memory of 424	3060	msedge.exe	118
PID 3060 wrote to memory of 424	3060	msedge.exe	118
PID 3060 wrote to memory of 5880	3060	msedge.exe	106
PID 3060 wrote to memory of 5880	3060	msedge.exe	106
PID 3060 wrote to memory of 792	3060	msedge.exe	108
PID 3060 wrote to memory of 5200	3060	msedge.exe	107
PID 3060 wrote to memory of 792	3060	msedge.exe	108
PID 3060 wrote to memory of 792	3060	msedge.exe	108
PID 3060 wrote to memory of 5200	3060	msedge.exe	107
PID 3060 wrote to memory of 5200	3060	msedge.exe	107
PID 3060 wrote to memory of 1696	3060	msedge.exe	109
PID 3060 wrote to memory of 1696	3060	msedge.exe	109
PID 3060 wrote to memory of 3472	3060	msedge.exe	110
PID 3060 wrote to memory of 3472	3060	msedge.exe	110
PID 3060 wrote to memory of 3472	3060	msedge.exe	110
PID 3060 wrote to memory of 704	3060	msedge.exe	112
PID 3060 wrote to memory of 4504	3060	msedge.exe	113
PID 3060 wrote to memory of 704	3060	msedge.exe	112
PID 3060 wrote to memory of 4504	3060	msedge.exe	113
PID 3060 wrote to memory of 3892	3060	msedge.exe	115
PID 3060 wrote to memory of 5976	3060	msedge.exe	116
PID 3060 wrote to memory of 5976	3060	msedge.exe	116
PID 3060 wrote to memory of 2532	3060	msedge.exe	117
PID 3060 wrote to memory of 2532	3060	msedge.exe	117
PID 4256 wrote to memory of 2192	4256	BitTorrent.exe	120
PID 4256 wrote to memory of 5780	4256	BitTorrent.exe	121
PID 4256 wrote to memory of 2660	4256	BitTorrent.exe	122
PID 3060 wrote to memory of 972	3060	msedge.exe	123
PID 3060 wrote to memory of 1408	3060	msedge.exe	124
PID 3060 wrote to memory of 1516	3060	msedge.exe	125
PID 4256 wrote to memory of 4516	4256	BitTorrent.exe	126
PID 4256 wrote to memory of 108	4256	BitTorrent.exe	127
PID 4256 wrote to memory of 4344	4256	BitTorrent.exe	128
PID 3060 wrote to memory of 1548	3060	msedge.exe	129
PID 3060 wrote to memory of 1548	3060	msedge.exe	129
PID 4256 wrote to memory of 5004	4256	BitTorrent.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_3731a3514c9c45ca0d1e41a9c595bbe9_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos_zxxz.exe"
1⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Roaming\BitTorrent\BitTorrent.exe
  BitTorrent.exe /NOINSTALL /BRINGTOFRONT
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_428610303 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2304
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586570_335746804 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4612
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586570_754631512 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1300
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586570_1381826181 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2396
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_1412597275 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bittorrent.com/prodnews?v=7%2e10%2e5%2e1%2e46211
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa184fc188,0x7ffa184fc194,0x7ffa184fc1a0
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,4883512442319124903,1579872618362900209,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
      4⤵
      System Time Discovery
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,17639116927014670311,10569897449674248240,262144 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,6926893776555792522,782461615422349158,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,6946444472512518930,14557408976134057199,2097152 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,16236109287000481610,2885471006835740320,2097152 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,14921737210680718201,11344322470721372929,2097152 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,4661702184396428070,8651807657602878844,2097152 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17077250099406149120,12213866891653226339,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5264,i,9800432871971530517,423384173608766648,2097152 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,16746406071284348396,1931450694872284513,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,16199758021525252176,9815359701910270899,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,11548548256664965318,16665841504778591863,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,11548548256664965318,16665841504778591863,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,1163768653543267462,11565028655615979,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,4542360067002511726,12636367762779601227,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,17117842328234843548,14988979703016897292,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,12302576380082642308,8023787241937336716,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,14618896661519294106,3556495318729947379,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,925693232337516253,12211304250067732913,524288 --field-trial-handle=2516,i,10107822119978974707,15750625233808572819,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:1548
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_180948957 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2192
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_2055744691 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5780
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_539145458 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2660
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_174817795 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4516
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_1132990544 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:108
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_1455638326 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4344
- - C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
    "C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe" BitTorrent_4256_04586148_798302879 BT4823DF041B09 BitTorrent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5004

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:3228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4108

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4f662ff539e49e4eaa72074aead8affadd0acae7a187915c3dce97a2828ec294
MD5 7cb5fffd9965982719e24b4e57caaff4
SHA1 89d4b35e9584f9793a24afd759c28eae36665a8a
SHA512 deef6e7f681284f28ad8cdc75864db14bb044800188bb508c3a2f61a4af49ab0ec96c90f0e26ff5eabeab17037de36ca5c7f119d16606e300090610dfa2e8582
TLSH
T19A51FB40F0818055F7E42B30B0C93C7BF6383D6FA58B9D1268A8C4F5891F7669A217F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b1edf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b1edf.TMP
Size 2KB
SHA256 a816afebde44aedb5d76891c0922a9d853b95f2b6871faf1b4268fd142d16316
MD5 b41de209fe5780b5a182f44614013e9d
SHA1 7b73461ec2165fa7eaad668bcdb6c5eb1ea01019
SHA512 46d48e2e11d80161d474b6f56199a3408bed3e19509347483f9b7a9aacbb3178640d969766918df4467c261c002ff4e8487930503cc2fa167fc5bf3073c85425
TLSH
T1A751DB40E0458055F7E80B30B1D938ABF6353DBDA683AD122858C5F58E5E77A9E353F4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 617dc6cd7be35c0a28ab8755819ff06388212237bd3194f6a8262a99a8cf7b54
MD5 f628076db9ddd2a2ddc440946e5606e8
SHA1 a0decaa9f46e7e1efd48d7ba6db90b2725465da5
SHA512 eab5f74579a8d7d82b080cd7b2f7b0b804c0a503aa837039b018da94bda93d3701e9c87cc05ed61f3d9ebee45067ef00d289c223a151f37f3ace281822f6bec7
SSDEEP 48:YALlN6O3H3mgyRtzAsf3Rsfifo7CZs6jhhnONzsPQzs46zBjG8sa9sN+Wzsseys9:D0OXWndn30ia2jhhy6zBS+G+Q5lGbwQ
TLSH
T1C291BFF7C7E8C62EC90156F0AB146E2BCE6D0954436C3D5AC8D4DE5B93E2472E24194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0e4df9caeccf7bfdc6b40dff235550fba30e0ea4f2db69a23ac73d02a259fda2
MD5 c4120c919d306e332ad3ee9093cc87a3
SHA1 67bebbaa5df2f273013c02056f6116ee77180877
SHA512 49bb4b782ac3739ea3c11fc7f88ebc8bc673a30253ee2f5c1edb79eafce32ad92af2696a8d43a8bcafe905fbec8f6134f0edb61aa18491e85b50fb6c188b99ea
SSDEEP 192:sxRQR+Cd/fos7eDZwsxhZBzoA8pky/g6+WNVf4/P25DFefG6IgV8J:sxRQrd/fosCt5xhKb/5q/+sO
TLSH
T10642B71AAD28A93B4CDBD219FB55BF13D2F91072A0901E58F6FD8A1C04E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 766197e0e842efed51f2ec171068087e35dedf00936c66850a511ae3c8214a5c
MD5 f87810ea81b21331dc1de72914a54bed
SHA1 7ba0234211ab78062980b06166603b27036344d4
SHA512 7b2a7f8231b0625462bacc381a26d29f02c59aecb2deeda26d281752e5e64fe76d19a03a4c60cefd46b9951b75a146881571a648c75845602470f6dc46a97a90
SSDEEP 192:sxR3R+Cd/foszvDZwsxhZBzoA8pky/g6+WNVf4/P25DF3fG6IgDP8J:sxR3rd/fos7t5xhKb/5q/+fc
TLSH
T19642B71EAD28A97B4CDBD619BB55BF13D2F91072A0901E48B6FD8A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7bf641ff95aed090163b7ba2fc03f7247c7a2ee790270ccd2807af52e9785a16
MD5 bf3d53d5b0f1efb4cd1216c2c0b6ca8c
SHA1 c9bc86c7eaadd99493e7065fb6bf257569009f78
SHA512 09073ce171ba1d427147c59b89bc51b4733d54d464bbe6e2dbf60ba77d082a10e542f23d19b548f7a2923b9d2a9e8567e17a70f741b90b25a889b5bc782370c0
SSDEEP 192:sxR3R+Cd/foszeDZwsxhZBzoA8pky/g6+WNVf4/P25DFefG6IgD18J:sxR3rd/fosat5xhKb/5q/+sy
TLSH
T1F042B71AAD24A97B4CDBD219FB55BF13D2F91072A0901E48F6FD9A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d97bc198b5acc58e94095d36330a1874fd68af4f554c0783da0d98d327011079
MD5 f8020b4b2ef0b7e97c63497b464c3d23
SHA1 07782d0fbb9db8ed3486964716e83bee8f967693
SHA512 74b1dceae204236207ae5904abb32f29a54c41d46c409edc906828867c60b7d9a243e96dd97a2991d7d3a62ed9dd17d697ed294631168db428aa072249bf3586
SSDEEP 768:SzYbbR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVTqw8WSNroGY7aJ:SzYbbHEbxUWgasfA6u1jasqwtSmFaJ
TLSH
T13DD2DA7B640CCB7E4F904ADDEC1A7A9E6D6802CB96D8C98047FA941C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76e5972d-c972-43b8-8c74-e7ea58382b26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\76e5972d-c972-43b8-8c74-e7ea58382b26.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 df763f47b4a10a662129d3fd04f5ebc7a7b74b7a5730cdbdfb9aca56b60b33a8
MD5 0c78471e53223988e3b2cb3f18087469
SHA1 62e83f90e8ed9d92d75e2f6bc83a846ab9c7d5ab
SHA512 3e6fdf4ba6a02f9583c1b3852e622fe9b51a9ae3faa7b24bcd6c2e7fb17c35cc7e932c7ae19b85357ddd38840178f5e0f165c3341dda4d197ed6481e267f41e0
SSDEEP 768:Jq3aG7aybNbFmtiGOeRFZD1fTos7Rjq2s5n:Jq3rOQY1fT/RG2s5n
TLSH
T120F2BF39B8E48D335CFAE244B24A77027FF455B389D94A8495E99F0F0497FAE130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 377ccdd7641e9d84f79dfa426515ae04a3f5128d0c80e2d5c72dc6554399e495
MD5 789d1a6c04bd43280f2ed0624d30f7a4
SHA1 a4f037e3c86c1352273df24f55662f8aed7775c6
SHA512 ebcadab6eaab0455cad7939cdd8392fc07809ced645b73fd2911042b06e030d3806d44908914d0c29bd2112ff026fca25fc76f4913c25b28ef4fc551b04f9916
SSDEEP 768:z/UxvxjgC+k34bSybNbFmt0OeRFZD1fTos7RzAl/+Pu:GZj3+k34GpY1fT/RSKu
TLSH
T1E103BF3AF8D45C338CF6E244B24A764BBFF455B386C91A9809ED6E0E058B7AC1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 bdeee040680b3f4e2bd483d03460a344939e95586263ddf9c4886ea57c9ab508
MD5 d1b344e01da14e64616df138199089a2
SHA1 2b998eb728d5377ee0dc6481ff8b73ca288d8cc6
SHA512 9f1e33eaa479a0a739b8d6b457bd3a3b454b14882217413cf65da4c2af2fa71e838b6ea16fb6cc6a8f8fb7247a234703f89f1a5c9f773965f3fcacffa8beb6ed
SSDEEP 768:2q3RGgaybNbFmtiGOeRFZD1fTos7Rjq2s5n:2q3M1QY1fT/RG2s5n
TLSH
T115F2AF39B8A48D335CFAE244B24A77027FF455B389D94A8495E99F0F0497FAE130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 68fb9e314200b7f287ff93c4680a8d7c80b86cac49a55da2a09b72eb024c5a15
MD5 825e269c12baf6db4e9451ad659fac76
SHA1 f63b2f81e11e59c64453f781bd104cba44a83173
SHA512 11d18cde46300c4817a05f011237e43cfda25cacf08204f502a6843baa57cf029e8040378a72cf52c96bef4367c023310d242d989cc53420e88fc4641d459d7e
SSDEEP 768:MFQ43swg0GiSSFmtaGOeRFZD1fTos7Rjq2s5n:/43OmY1fT/RG2s5n
TLSH
T1F81329F998D38937D8AE9743A37D6E025EBCC0A3B4885584B7D45E0DCC826BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a59a0756-808c-4f32-b129-00fbd7ef2450.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a59a0756-808c-4f32-b129-00fbd7ef2450.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3060_472454693\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BitTorrent.exe

Path C:\Users\Admin\AppData\Roaming\BitTorrent\BitTorrent.exe
Size 5.9MB
SHA256 5ba64eae248e366b5362924ea14c37ad6f6b13edf490a08d8a73d3ae17074a1e
MD5 3731a3514c9c45ca0d1e41a9c595bbe9
SHA1 d351b66565db5db35b0e14ca2c7d8535c4844cd9
SHA512 c31dd6c5b0fc5eeda7b4bfdd94bccc19d8f2ca80ba534c5614d501738e4acc110255cd15a67b163256ade98636c76d9657e4ad6943989a26c8ebbfd46480de2f
SSDEEP 98304:SN3UCn8wP3ZQiZW6n8f+aI8lB14c5l1twuXnvfNUMoHl:WJ9Pu+WJF
TLSH
T12E56BF1376C18037D69300714C2A677951FBEDB81A718AD7B398BA2D3E745C2A53BB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

165F6EF40A81DD175FFAEA69E77ABFD30B27E71C

Path C:\Users\Admin\AppData\Roaming\BitTorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C
Size 1KB
SHA256 ec9e7c253d599175af470832da851cf4f59614a4c4d4e37183159801b13abf5f
MD5 4280089022fce23da2c64031bf137c08
SHA1 0380334f420bc6677795fda8f5201c1fb7355c1c
SHA512 9eafb6f30baf09a32601b1f9da1316e1fcc44256784221da85f54718de6f0539c2bb601feba194c2ba801c8b95834f5029c93e3508f79daddf8c3343fc848a05
TLSH
T19621354CF54454019949FC4118EFE027892748C0E5D0F6A5BCCFDC5E19641F681658DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\BitTorrent\settings.dat
Size 8KB
SHA256 ca3645cee6fdbd00966ae0706b7d4230254f4c89e340ed10365984ded6eab436
MD5 68edbe6612190ee1dc9fa389714e0f79
SHA1 a1fa9b3f8d6b7e9422e2bf47d255b44a9641c010
SHA512 308c9bcfdde7fb6e4e160cd0033dbdb7a80ae3d92414cb3486c361e75cb478a5b82548f8896c246dcd2551ff29b607d52c75f32386bcc5e971bcac4dcfc0b059
SSDEEP 96:vdET09JPlflTlt8Aa0LI2BMgT8UI+5IXIq+JukLTbSxJ:vGT09dvEN9nU+XIq+JucT6
TLSH
T11902F9225DFBD9A0E46E423F477A9407B1762B80C976FA11D09C85F43502A1F09DBB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\BitTorrent\settings.dat.old
Size 7KB
SHA256 b5585633bf8243d30670254c43b2a3f0bdec1bbe8e3e9619488a493e24ec3e3f
MD5 facee8cb831550d4a70191f1f43d1e67
SHA1 3a514b515a25d4dcac916cafd5d1e6c47685ed47
SHA512 fb4342090198b1c6a941e1344b3103e293efb1a12678e8cc99b588ce53929154b7420276cccbdcca20be06fda7fc6bfcc63224879a83a007837db43ba72e156a
SSDEEP 96:bdYT09JklflTlt8Aa0LI2BMgT8UI+5IXIq+JukLTbSIJ:b+T09SvEN9nU+XIq+JucTv
TLSH
T101F1EA225DFFD960E46E423F477A940770362B80C976FA11E09C95F43912A1F09DBB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.old

Path C:\Users\Admin\AppData\Roaming\BitTorrent\settings.dat.old
Size 8KB
SHA256 ae4a4fe329dc15c2bfecc24577440bc43bb6d5a94ae82be4d3bbcc06f4203e6d
MD5 3934c1a2106b454723f206df30d81ad7
SHA1 f38e8eb27d85948c075710096e18a05ea59460cc
SHA512 9a7779d8f3aedd06e67ae471adb076b426077759bd235e56f44419932ef1d2a2f6c2d7f714c9d7c1b5dd5bdb9eeb13805cd589ce09410b85877267ef2da144db
SSDEEP 96:/d9T09JklflTlt8Aa0LI2BMgT8UI+5IXIq+JukLTbSIJ:/TT09SvEN9nU+XIq+JucTd
TLSH
T1C302F8224DFBD9A0E4AE423F477A940771362B80C8B6FA12E09C95F43501A5F09DBB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbar.benc.new

Path C:\Users\Admin\AppData\Roaming\BitTorrent\toolbar.benc.new
Size 170B
SHA256 ecfc9bfd26fdeabcb1c16977dd59a68bc3a455d15caedfb00d2a95adfc826306
MD5 07b90fbc748d0a63ef45591bcb27f0a5
SHA1 1ca2089793608af4db3f9d4b9f1da3b68427e70f
SHA512 fa1357a42ff2ba92dd6ba73e0d3ef3e43fb0a1f188ef072a652a4b9879e217a558301c37857f15cfc0da783c855c8ecaf814fac31590fc1a7d50b2e4101c3e43
TLSH
T192C08C3857FD95980A2B884320FD293EA18696E8648AB68888031B36CCCB2864BF4134
MD5 SHA1 SHA512 TLSH

Submit Download

updates.dat

Path C:\Users\Admin\AppData\Roaming\BitTorrent\updates.dat
Size 347B
SHA256 e796c4f66747081007879c59f48bf7286e4dbdc683b8198c9c7439d57fbb4e67
MD5 7dca2d8cfd436d321e5b53b17e15b358
SHA1 cd49f7b50c179a1dce5f591b4eda8cfbf0d3ad6d
SHA512 e03d5dfe8241bafc209f75cfc844a26fc69fccb1e56b5f91757938d2ce72a7b694c61f60a975051d9d9325adbc21938affd3984cbdc15835dd01a606bf2e6c3c
TLSH
T1B3E0C0B104FDC67E3C31C3AAC9B430F983727881982073784043054CAA8063C07E6C15
MD5 SHA1 SHA512 TLSH

Submit Download

bittorrentie.exe

Path C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.10.5_46211\bittorrentie.exe
Size 537KB
SHA256 65f32777d56a9bc778800492a9b1db40b6dbfde54628405808c276556e7c3ab8
MD5 0eb34002d91ec0e59b90e6eb922895cb
SHA1 1fc53d114fbe6c2d8d56e5b375304e3986cfdf2e
SHA512 8bc3107e4ef6671ae85c9e8a77d92c0837e619c81c655404c0aa82b606a5395cfa2a51f46afdb84f3266984bf63650606eb26f07b219482a6b98ab8f550c2ccb
SSDEEP 12288:4dazCSObmI+F5nLRpPghTdpvujS/8K+z9uwEgk5/p8BWSW7e:44HI+F5nLRpPghTdpvujrhuwxkxp8BWM
TLSH
T127C4AD213AA1C133D96181B14D6CE74A647FAD700F6249CFF3D81A6E1E75AC16B32A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7.11.0_47255.exe

Path C:\Users\Admin\AppData\Roaming\BitTorrent\updates\7.11.0_47255.exe
Size 3.7MB
SHA256 e26e4495d2b67b68b5e40fa923345d37e20f346b3dd19996af2fa166f9883c5a
MD5 e21004426ccd74cfa8873b5667d8e653
SHA1 54e31e528bb441bf7cf9c3117a323ffb544dbfe0
SHA512 da195566f4236db35ee7043693f58a042cdcbe155c103e186c4df6f194ce5b599ad3c7e24d95371084e3cc3f4fa42f99a2076435c35aec93c91a6698a9bfc3f7
SSDEEP 98304:es2vEa7BJjvmd3i2t3awxirEgbrCFIukntxMxmzCj:es07nSZqwxoTXC0xUmzCj
TLSH
T16406337B93004497F03615B322AF57919FF2746277A8326F324EF42E2D61E90791FA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d1627c087e30ee6fe8c9cce3c77e841_71306956-741d-496c-97c6-468adc86abdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4154726816-2055034831-2297277433-1000\9d1627c087e30ee6fe8c9cce3c77e841_71306956-741d-496c-97c6-468adc86abdb
Size 1KB
SHA256 a838a0bd328eba740af614a914fd3ce98559b41b8eaa5304375ef089da1f2f57
MD5 47c63a6d286a2acf1dcad07c184df054
SHA1 e974f5860c57d9525cef4897cf16a79861fe6cbe
SHA512 aeb3f9e0e0cafc83835d0ecec8cc45dcc3637cb77a3c00223d5cf27c30edd924d8c547982745cd6e045928ff966649683c8e4b51c2ee6374ee0da7c6a02dc3c2
TLSH
T12E31E669FB731886D3F5353D51EF0A11418BC474223AEEC3E886852DA72A2C48D70AF3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4256-34-0x0000000000400000-0x0000000000A23000-memory.dmp

Download

memory/4256-52-0x0000000000400000-0x0000000000A23000-memory.dmp

Download

memory/4664-0-0x0000000000400000-0x0000000000A23000-memory.dmp

Download

memory/4664-21-0x0000000000400000-0x0000000000A23000-memory.dmp

Download

memory/4664-41-0x0000000000400000-0x0000000000A23000-memory.dmp

Download