floxif | 37f9f893b593006bc2bbe7fd7ab21f402c5098717ccb18298b2f3f62b5e0614c

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Size 4.5MB
Sample261114-nfapwsf12y
SHA256 37f9f893b593006bc2bbe7fd7ab21f402c5098717ccb18298b2f3f62b5e0614c
MD5 6e8052e5c57488c6621c64abd55563d6
SHA1 dc07bca319d935cf083bde396549222f07cf0510
SHA512 2f818ffe40ce33bef6c66054c9d7f72cdd3075ebcae02e4db515e0afd85837c55f54d940d3976243590004130cf646dafadb9857db5e341a08cd2b00d662763b
SSDEEP 49152:zx03rTNg/OqfwR87Vox/3SuTRbT9PYOwcYFhaLG+NdAM8rHbLXv3aDKduRmWJgK1:zxsgGGwR87Of/gOsvSDsomWHQXRMgg
TLSH
T1BC26BF127AC0C075D7D204314C2B776852F7EEB0197186B77399BA2D3A346D2A93EB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor defense_evasion discovery floxif persistence privilege_escalation spyware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000d000000006908-2.dat	floxif

Custom signature

UPX dump on OEP (original entry point) 13 IoCs

resource	yara_rule
behavioral2/files/0x000d000000006908-2.dat	UPX
behavioral2/memory/3264-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3264-37-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3264-40-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3264-43-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3264-58-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5128-65-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5544-79-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5544-210-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5128-322-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5128-371-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5128-381-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5128-464-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Modifies AppInit DLL entries 1 TTPs
Modifies the AppInit_DLLs registry setting, allowing a specified DLL to be loaded automatically into almost every Windows process across reboots.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d000000006908-2.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
5128	uTorrent.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Wine	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Wine	uTorrent.exe

Loads dropped DLL 5 IoCs

pid	Process
3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
5544	DllHost.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
File opened (read-only)	\??\d:	uTorrent.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d000000006908-2.dat	upx
behavioral2/memory/3264-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3264-37-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3264-40-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3264-43-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3264-58-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5128-65-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5544-79-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5544-210-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5128-322-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5128-371-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5128-381-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5128-464-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\progra~1\common~1\system\symsrv.dll.000	uTorrent.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1489069016\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1368693855\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1489069016\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4496	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	uTorrent.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin\Extension = ".btskin"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-key\Extension = ".btkey"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Magnet\DefaultIcon	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\Content Type = "application/x-bittorrent-protocol"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Applications\uTorrent.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btsearch\Content Type = "application/x-bittorrentsearchdescription+xml"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Magnet\shell\open	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\shell\open\command	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\shell	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\DefaultIcon	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btinstall	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btkey	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btsearch\OpenWithProgids	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\URL Protocol	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\shell\ = "open"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\DefaultIcon	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-app	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-app	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btkey\ = "uTorrent"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent\Extension = ".torrent"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\shell	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Magnet\Content Type = "application/x-magnet"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\shell\open\command	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btinstall\ = "uTorrent"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Applications\uTorrent.exe\shell	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Magnet\shell	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Magnet\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\maindoc.ico"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btsearch\OpenWithProgids\uTorrent	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Applications\uTorrent.exe\shell\open\command	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\Content Type\ = "application/x-bittorrent"	uTorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Magnet\URL Protocol	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\ = "bittorrent URI"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\shell\open	uTorrent.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{32205959-034C-40A3-BCE9-B9C0701749CE}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btskin\ = "uTorrent"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btkey\Content Type = "application/x-bittorrent-key"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btsearch	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml\Extension = ".btsearch"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Magnet\shell\open\command	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\bittorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btinstall\Content Type = "application/x-bittorrent-appinst"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Applications	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btapp	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btapp\ = "uTorrent"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\shell\ = "open"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\Content Type	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst\Extension = ".btinstall"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Applications\uTorrent.exe	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Magnet\ = "Magnet URI"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" \"%1\" /SHELLASSOC"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\.btsearch\OpenWithProgids	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Applications\uTorrent.exe\shell\ = "open"	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\shell\open\command	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\uTorrent\Content Type	uTorrent.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
5544	DllHost.exe
5544	DllHost.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5128	uTorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Token: SeManageVolumePrivilege	3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
Token: SeDebugPrivilege	5128	uTorrent.exe
Token: SeManageVolumePrivilege	5128	uTorrent.exe
Token: SeDebugPrivilege	5544	DllHost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe
1976	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5128	uTorrent.exe
5128	uTorrent.exe
5128	uTorrent.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 5128	3264	2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe	91
PID 5128 wrote to memory of 1976	5128	uTorrent.exe	93
PID 1976 wrote to memory of 3420	1976	msedge.exe	94
PID 1976 wrote to memory of 3448	1976	msedge.exe	95
PID 1976 wrote to memory of 4496	1976	msedge.exe	96
PID 1976 wrote to memory of 3448	1976	msedge.exe	95
PID 1976 wrote to memory of 3448	1976	msedge.exe	95
PID 1976 wrote to memory of 3608	1976	msedge.exe	97
PID 1976 wrote to memory of 3608	1976	msedge.exe	97
PID 1976 wrote to memory of 4948	1976	msedge.exe	99
PID 1976 wrote to memory of 4336	1976	msedge.exe	100
PID 1976 wrote to memory of 4948	1976	msedge.exe	99
PID 1976 wrote to memory of 4948	1976	msedge.exe	99
PID 1976 wrote to memory of 4336	1976	msedge.exe	100
PID 1976 wrote to memory of 4336	1976	msedge.exe	100
PID 1976 wrote to memory of 4260	1976	msedge.exe	101
PID 1976 wrote to memory of 4260	1976	msedge.exe	101
PID 1976 wrote to memory of 4260	1976	msedge.exe	101
PID 1976 wrote to memory of 2388	1976	msedge.exe	102
PID 1976 wrote to memory of 2388	1976	msedge.exe	102
PID 1976 wrote to memory of 2388	1976	msedge.exe	102
PID 1976 wrote to memory of 4512	1976	msedge.exe	103
PID 1976 wrote to memory of 4512	1976	msedge.exe	103
PID 1976 wrote to memory of 5092	1976	msedge.exe	104
PID 1976 wrote to memory of 5092	1976	msedge.exe	104
PID 1976 wrote to memory of 5092	1976	msedge.exe	104
PID 1976 wrote to memory of 1176	1976	msedge.exe	105
PID 1976 wrote to memory of 1176	1976	msedge.exe	105
PID 1976 wrote to memory of 2724	1976	msedge.exe	106
PID 1976 wrote to memory of 2724	1976	msedge.exe	106
PID 1976 wrote to memory of 432	1976	msedge.exe	108
PID 1976 wrote to memory of 5144	1976	msedge.exe	109
PID 1976 wrote to memory of 5144	1976	msedge.exe	109
PID 1976 wrote to memory of 3084	1976	msedge.exe	110
PID 1976 wrote to memory of 3084	1976	msedge.exe	110
PID 1976 wrote to memory of 5152	1976	msedge.exe	113
PID 1976 wrote to memory of 1200	1976	msedge.exe	114
PID 1976 wrote to memory of 3464	1976	msedge.exe	115
PID 1976 wrote to memory of 4948	1976	msedge.exe	116
PID 1976 wrote to memory of 4948	1976	msedge.exe	116
PID 1976 wrote to memory of 3188	1976	msedge.exe	120
PID 1976 wrote to memory of 3188	1976	msedge.exe	120
PID 1976 wrote to memory of 2884	1976	msedge.exe	121
PID 1976 wrote to memory of 2884	1976	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-13_6e8052e5c57488c6621c64abd55563d6_coinminer_elex_floxif_glassworm_luca-stealer_mespinoza_njrat_remcos_zxxz.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
  uTorrent.exe /NOINSTALL /BRINGTOFRONT
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://utorrent.com/prodnews?v=3%2e5%2e5%2e1%2e46206
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff93465c188,0x7ff93465c194,0x7ff93465c1a0
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,5855122980494341233,492296577641294283,262144 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,16682534603399524930,7696025549295745205,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:11
      4⤵
      System Time Discovery
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,17407069414429393491,11888051010028387863,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,2607494586147259207,11376244905731331177,2097152 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,10921619119480800095,11800665871034999427,2097152 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,17837279377941722848,12096960325333017381,2097152 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,8278614606813567653,40986642430520168,2097152 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,4317723162307731278,10542041583772520649,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5340,i,8528413736705342309,1877625869045953164,2097152 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,18258078549086969084,4216101248490168783,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,16055988396437824020,18341532289589382091,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,3148426857911460147,16027005684382021370,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,3148426857911460147,16027005684382021370,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,3804450183104787800,16234946588672302599,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,1492831802778711182,14460355423661084113,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17176259281433864114,16983874155723551677,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8685501510310865017,15403924903191665937,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,10996539777890745009,13907624586521822632,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,7670402542743255935,6802607982051872491,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,6292843490137394854,7209637609209851724,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,1901138058444411485,1640063116517588758,524288 --field-trial-handle=2896,i,18016611801390455857,4875461378420305893,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:2884

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

28744d44-0d3b-4969-a198-1c29055ac863.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28744d44-0d3b-4969-a198-1c29055ac863.tmp
Size 33KB
SHA256 340c507f4095f39176d3e788cf9fb9bcc0141e904d7312be3c202f529de2716a
MD5 a767c189500a7b6f902674937acc59e5
SHA1 d7d8a969d01de82479f5428fa3bff390c76ab508
SHA512 84b2c22d37873623fd486ced206a374aa9e238580f73f514d0295e42abb7afe85034b597a362d8896452843cc33886764a5e31c26c20dc2f0bcfd7cfa894296b
SSDEEP 768:p+3DAtSFaju2EGnqMwQi5BgK5/CwYcZeE75EviLU:p+3DKLVmBg8/dokmiA
TLSH
T1EFF2AE31ECB18EB749BA9210F28537D7EEF462A3D8990954C4DE5E0D0187ADE274BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bd61413-1c8f-4914-a6a4-b8fd52ef0083.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3bd61413-1c8f-4914-a6a4-b8fd52ef0083.tmp
Size 33KB
SHA256 f3cf1196c500814aa9f2849b9a08a7a94e356d74a2ff8dec3108bccf9e699bdf
MD5 3f4b79c501d86c0b84d5ee5441199af5
SHA1 9b25df656dc041620642a2e244872864a19e56e1
SHA512 710e1af201c7511043abed020c24e8680a16eb62a7bd02be4e6a78b61120843896c51c5e5f1cfd512e883bebdf71ffc404e6469c75754c57e6a153cc97f22805
SSDEEP 768:E+3EAtSFaju2EGnqMwQi5BgK5/CwYcZeE75EviLU:E+3EKLVmBg8/dokmiA
TLSH
T156F2AE31ECB18EB70DBA9210F28537D7AEF462A3D8990954C4DE5E0D0187ADE274BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fa31afe-a6a6-4fa8-87c1-a5400e1b38d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5fa31afe-a6a6-4fa8-87c1-a5400e1b38d6.tmp
Size 37KB
SHA256 435fa29ee5206698604c85555dc909f3bfdd5342132d967fa86629ea0bc66038
MD5 44f302c8bef2a28b2f8b50c9edde4bf3
SHA1 32933f8e5e06b7458aa51ed177966672164d1caf
SHA512 8382e116db8e647f7859421e82786ed2d1292a45951bd062b3c62483e885bf0556b72666b7cf8d3ed324f2b5f681d596c3721b19fad5d26dbc2348a96e3068a7
SSDEEP 768:O/UxvxjgC+Ft3SgPSFaju2wnqMwQi5BgK5/CwYclwA8Dea:DZj3+Ft3SAcVmBg8/deA8Sa
TLSH
T11F03C036ECB49E778CFA9254B74A638BEFF451A3C480099489ED1E0E07979AC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6194535e-13bf-48a9-8b83-2bfc8066b710.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6194535e-13bf-48a9-8b83-2bfc8066b710.tmp
Size 38KB
SHA256 7d09a2a6fa7357eb4d30f335f116dac26dd7fbc4b4f768d74b0840b7ef5d6365
MD5 bdb9d01636c0eea1e19cc3ad4e15b760
SHA1 8b6d5e3aa302c5e7268f83774422689b125435b1
SHA512 246e2b67631486e80e4061fb90ebcc6ded02cebd6fcdddefa7fc00eefbc9f84e948b22b358181b44b593c68cf0042267fd6c97064e17454f092d00ce45a1d5d3
SSDEEP 768:I/UxvxjgC+Ft3l5fSFaju2EWnqMwQi5BgK5/CwYcEeA8Dea:VZj3+Ft3lPVVmBg8/dXA8Sa
TLSH
T10603C035ECB59D774CFA9254B68A73CBEFF411A3C4810CA889E95E0D0687A9D170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

424ed37d-a0b1-49e0-9fd1-0906bcab69a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\424ed37d-a0b1-49e0-9fd1-0906bcab69a9.tmp
Size 29KB
SHA256 018ca91ddc23feff47efad9e1805e32bddf6740ce8ed686529f79679a268ef2d
MD5 4c20c821821f3a8afc4b2e8f8552d47b
SHA1 ffca6eab17cde267a3a0169ed4475c1933ce0ef1
SHA512 d9765bdaa79dec0e9879bcfaaca90d0399892519a0df9f3cc0c7fc52f794a80b30eb7e9d6f2db6dbf8a8ec1a1079bef77bd2bbb05a23713dc8c19982fb82e71a
SSDEEP 768:ksRdpG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqb+2+gYroe2hin:ksRdpmEb0JWgSwffTu1jadb+rgje2YHH
TLSH
T113D2C97B680CCB7F4F804ADD9C197A9F6DAC02CB9698CD8047FE941D02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f87efee-b9ae-49a2-85f8-e3948f1ffd86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f87efee-b9ae-49a2-85f8-e3948f1ffd86.tmp
Size 12KB
SHA256 b73d716a7947fc7099728d8991e605f74269e7621b4bdb47585e1c30657225c8
MD5 9e1d5b9a42ccaf89d2aae3ff5604a576
SHA1 7e1ebcf523ec0941e87f25867a401122099e0b53
SHA512 a87b645faf24fba58eed4d2f6dbf659a77353306be28ec004e6a486baa4602ead16792ff9a60fcd447a5f4941bb28279de93080957172087a707cbec16594797
SSDEEP 192:sxRQRGCK/f/sU1DaZ5AzzoA8pY1/g6+WNl21/PFnlacP2UGQIgDFsJ:sxRQ3K/f/sU1DMuis/5O/lW
TLSH
T1C242CB19AD38A93B5CDBE31DBA65BF13D2F91032A0D05E48E6FC8A1C15E76DD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ed1a2fb-cc9e-4d54-90f5-5e6c5bf65c4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ed1a2fb-cc9e-4d54-90f5-5e6c5bf65c4d.tmp
Size 12KB
SHA256 7f2aceb4e07bdb48244c03160d07b0ab0d47c8cbb23affc6c8ea522c2d1b6526
MD5 079b429acfdaa9580302c91028276cc9
SHA1 f2b39a321180824afa83cad8366f63a5e83a1d02
SHA512 c4b062f1ce3aaa9000d5a11f9b96eeb03a421e9254bf5a1bdcad34dd5206b51c08eb7a8672c5721fcf778ca72dacd42be60130d08710dd72a5fa2f3a53940bc4
SSDEEP 192:sxRQRGCK/f/sU1KaZ5AzzoA8pY1/g6+WNl21/PFnlacJsUGQIgDfsJ:sxRQ3K/f/sU1KMuis/5O/lk
TLSH
T16442CB59AD286D7B5CDBE21DBA55BF13E2F91032A0D01F48E6FC8A1C15E7ADD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9940b6a5-2d77-42f8-9c95-0666a4fff0e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9940b6a5-2d77-42f8-9c95-0666a4fff0e7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7212cfc98db3bfb57e6c437bd0d0533e2bc0c69690109660e221500dd459b04a
MD5 f6ffc6ba681bb6ec7d5dd355e3d09192
SHA1 cb20c48a0f805dc6f72ad575ce8129686b7789ca
SHA512 b329dd4a25df959a1c9819de88f17b6ac2eca1e3e2ce2b2d1407b7d3773183ffb742481cfa95a4dfd022b3cee3d1078cd67507ddfd1f8961dfc01761832d7bfb
TLSH
T183619585617C84A4DFA85672EBF216AB3A30FB7D54C31E720F90DC7687E67CB0104054
MD5 SHA1 SHA512 TLSH

Submit Download

d3a2cd9d-ff63-464e-820f-6379807eb4c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d3a2cd9d-ff63-464e-820f-6379807eb4c5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b458e78-0aa7-4a4a-9cbd-57b7f27a64ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b458e78-0aa7-4a4a-9cbd-57b7f27a64ad.tmp
Size 3KB
SHA256 a98ec9f886452d17abb36794cb9d5848bf1edb8bbb070993285091cf929926c5
MD5 b80add866841fc47f7860c63cb1168f8
SHA1 4df75a3dcb4bb563ccffbecaf25e6f420102275d
SHA512 b002f38da9995681143ef732d2bbd938f1da483a66798bf590ab4bcb394952ea985ad9c7afe2f195b47b2f5dbf5ebbf51af44987faf56ed8e4e2b63989a2371c
TLSH
T16D71BCF3C7F4856D8D1146F0AB156E1BCE5D0A24532C3C9A89E4AF2B93E3461E241A5F
MD5 SHA1 SHA512 TLSH

Submit Download

a3f2165a-5db3-4831-b3f6-3dab86fd824d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3f2165a-5db3-4831-b3f6-3dab86fd824d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a973e5f2-2a95-42b0-bac0-73a492f44459.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a973e5f2-2a95-42b0-bac0-73a492f44459.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ae0f821bdfff4359a9f7bb6e6908b01ebb1e6043953f64a58642a8b013907745
MD5 365e9428baa2fcebc807955fae9710d8
SHA1 80e9013d1ed6fcea0d09e4486f15fdb2afe6ffdb
SHA512 62d84aa716536942d9ae791a56751678e8d3c34426eee993a668ef8537b189ac42216a053aa84f1a941b7b9fcbe6d9be936739fc0378f6d85e3c5d5546c00533
SSDEEP 192:sxRjRGCK/f/s5DaZ5AzzoA8pY1/g6+WNl21/PFnlacP2UGQIgVsJ:sxRj3K/f/s5DMuis/5O/lK
TLSH
T12642CB15AD28A93B5CDBE31DBA65BF13D2F91032A0D45E48E6FC8A1C14E7ADD620340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a06169c030d3ede9449ac6a0657eaed6dc19778b848a69bab7ffd1156f5dcffb
MD5 15f63d1d666ffa2ff9e67aafee86acaa
SHA1 79d9e3318932cb2902ca45009c520a9c514712e4
SHA512 f489960234ce3fba3397dd09933d3096b9d9a536b4228382d6a824a9fb0dea0c0a5cd17db4093cacb0df2dca6f135f66ae3eb7750b51a599f236dddfbcfb5bf3
SSDEEP 96:KMGEKLa2KmoKHKNi7+C8c86OklJAS6K4PAQ6MCatIyzjkZAU2qj:STXEi7+C8c8JklCSqPAQ1CatIyzjkZAc
TLSH
T1A0915251B0AA06407AFE25485078871A125232F73069F9AF7FBD90764F6BE140DFD8DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4470d34-a3f9-4ce3-a435-2ebad1181094.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c4470d34-a3f9-4ce3-a435-2ebad1181094.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

6e67586c-e719-453e-851d-3636bdef02cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6e67586c-e719-453e-851d-3636bdef02cd.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ba2a1797-6937-42e6-bf64-f4b53f552a4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ba2a1797-6937-42e6-bf64-f4b53f552a4b.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d589e204-1b3c-49d2-ba84-fa5db2dd0847.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d589e204-1b3c-49d2-ba84-fa5db2dd0847.tmp
Size 42KB
SHA256 129fbd18591aa0d8e2d73043ccd8ce435e2c2b964bd87ef12c4cb4b1fbaa73d3
MD5 7db48ba4e4f576aae283e8da6fbed363
SHA1 16a7387fa3a5e119fe2b5ebb911acf8dd36b5fc3
SHA512 208a58d7b80715ac0f88620ca531d87175ae5e14f971eb0bde11c7d7b3972bcfe123a725cfa774b9a5dc4a06de3ec0b885ef72aa97ebb82b90defa28f4cf5d23
SSDEEP 768:IFpb3wwgiStglaju2E27nqMwQi5BgK5/CwYcZeE75EviLU:ib3BGF7VmBg8/dokmiA
TLSH
T1871317F598E38A77D9AE4743A37D2E869DBCD153B8984894F7894D0CCC825BFD30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8289f966-ffbf-496a-8bc9-bee958097237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8289f966-ffbf-496a-8bc9-bee958097237.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

86266e83-7b8f-4bde-ad2b-ad1941d6930f.tmp

Path C:\Users\Admin\AppData\Local\Temp\86266e83-7b8f-4bde-ad2b-ad1941d6930f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

32b7aa3d-a100-4deb-973c-919a017d86dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1976_1840548210\32b7aa3d-a100-4deb-973c-919a017d86dc.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1976_1840548210\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uttEF2D.tmp

Path C:\Users\Admin\AppData\Local\Temp\uttEF2D.tmp
Size 231B
SHA256 ffe5bcba6dac90958524e5b4ba06e0a03707a46cbf7d92af505ca77a61dc8967
MD5 1cda5503e74f672c3affe109b6bde393
SHA1 514283a5b5cf53c218ce4d53b1a8d38d4f2a9667
SHA512 fa5f127bfb79564a4f37dbf4fdf4a044b916d12caebbcce1347901467dfd89bc06c07a754fcc4354db5fd0c2246c313b30a9542fb2aadebcc3cd2d8d4ef67066
TLSH
T1BED09730EBF143B45B02B8B9B1CA805F6D202404202FB4F948C0F55AA8F838C43D0050
MD5 SHA1 SHA512 TLSH

Submit Download

1f91d2d17ea675d4c2c3192e241743f9_ed0fb950-6233-4e5d-8f42-b3f23c7e8483

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2251218687-1689653882-3767565116-1000\1f91d2d17ea675d4c2c3192e241743f9_ed0fb950-6233-4e5d-8f42-b3f23c7e8483
Size 1KB
SHA256 8fc99c079f8a024701f58349661004d7d2fdb30312ad9e4beeb34121df8cf556
MD5 b9cdfd09eb2b8f78cf99e8899e994d5a
SHA1 1ef0f8602553bc468030b78441ebbd704e277f35
SHA512 533c01f3baa8316fca48a3f7cb4c143c68e79b1ca7e7580534651d599e4f4f3d828c998e90618b869aa2322f6d040a6e86ecb81f06975382cacf99f92303954c
TLSH
T1E731A744F3951DE0C5E653342F47442C09EE969CA7379E345909A9BA293238009027B3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 b30e7c7929c0181305b207a396fee1c2fe6971922aa92d45fee65cca21d039fe
MD5 1aa5d123052aed774cd3068fcb712af1
SHA1 96ab6a923fcab506f5fc6f88054c28047bc93855
SHA512 a4025f4044fb243a514fdad7fce4dac20701d06e00af5be2074d0871a1c945d18003d95736da326a0c380aa821ff6e3826e3307f8145bce36bd01f9f45fac685
SSDEEP 96:zDQCgT09JhlflTlt8Aa0L0RTTSnyaUB+50eilhdZG/J:zgT097vENHMidch
TLSH
T12302EA329CFBC9A4E4BA85364BB9500BB23A1FC1D6B2F611D0AD45F4351161F08EFB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 044a2afeb92be94586d3f59af35b715aba305ae44fb5f8ffa09473fc066e8f11
MD5 9b61a285d28834acdc08873f45a7f63f
SHA1 a8134ab8bf3e029cadd17d115d5b30cd9914a585
SHA512 015cb27bbe96cf9cc439d986bb262fa379e2967e04db6dadf0bf038c2292d9f9ecca223d8ad9f91720941a7f2c4ac252da2541c6256bfc42b67a1f69e1d62153
SSDEEP 96:jTDQCvT09JhlflTlt8AapL0RTTSnyaUB+50eilhdZG/J:jTvT097vENaMidch
TLSH
T13902EA329CFBC9A4E8BA95365BB9500AB13A1FC1D6B1F611D0AD49F4350161F08EFB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 8KB
SHA256 3ede021b35277268dc8d73f23a881a2f74ea9bd1a9381d49330c7cbfc69fb327
MD5 11b4bcbaf512d87b5d1f83f1d8f3c81a
SHA1 a285d811554d14c6681f8c709f23d0e31897dcb0
SHA512 58d778ae04eb8358c3baf209928a892d6fb8dd187e155fa450a2d57d5fa57159129d8138bd2916ecccd43a7fe7f4358e7bf36da95232c023616236a7873b003a
SSDEEP 96:ajDQCKT09JmlflTlt8Aa0L0RTTSnyaUB+50eilhdZGsJ:OKT09QvENHMidcK
TLSH
T1BD02FA325CFBC9A0E4BE85365AB9500BB1361F81DAF6F621D0AD49F4350161F08EFB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
Size 7KB
SHA256 b2c9b35857ab42d4e530d7382dfe31a2e9d7db3594a4308afc1d0ca8162f02f4
MD5 b32ba9e71268648ceb4f43830d95d6c1
SHA1 1dc80906e99df6521123836b42a60e63b571c5d4
SHA512 aec8aaa79b9956a1e7e7323e758efab2182b5740550afb9029685da540a813dbe70c1e6de3e7470490141c22906d783fe8db8f6fbe816f97de6cbde928425e1a
SSDEEP 96:YgDQCKT09JmlflTlt8Aa0L0RTTSnyaUB+50eilhdZGyJ:tKT09QvENHMidc0
TLSH
T1E1F1E9325CFBD5B0E8AA85365BB8500BB1761F81D6B2FA21D0AD49F4351161F08EFB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uTorrent.exe

Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
Size 4.5MB
SHA256 37f9f893b593006bc2bbe7fd7ab21f402c5098717ccb18298b2f3f62b5e0614c
MD5 6e8052e5c57488c6621c64abd55563d6
SHA1 dc07bca319d935cf083bde396549222f07cf0510
SHA512 2f818ffe40ce33bef6c66054c9d7f72cdd3075ebcae02e4db515e0afd85837c55f54d940d3976243590004130cf646dafadb9857db5e341a08cd2b00d662763b
SSDEEP 49152:zx03rTNg/OqfwR87Vox/3SuTRbT9PYOwcYFhaLG+NdAM8rHbLXv3aDKduRmWJgK1:zxsgGGwR87Of/gOsvSDsomWHQXRMgg
TLSH
T1BC26BF127AC0C075D7D204314C2B776852F7EEB0197186B77399BA2D3A346D2A93EB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updates.dat

Path C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat
Size 344B
SHA256 a853453c0f74a9c1d9786ea28a9d4202f9a7d232fec56566f7f7f93c0f2de3aa
MD5 17ca1d4aa296dc696ce9f1ce3476fcd6
SHA1 5d680b3d1d2ea8f3181b3299a26deacad115f11d
SHA512 7c08eff2600f955ca35e3847b340f9e424c1bfa7c2a68dd82694b0c17c0aed73b2b78a007dc833c753371602fbef695b1ea8b9ebd09fadfe21d6814a959050d1
TLSH
T150E0C06410F4C12E792197ADD5B130E89376A89155405375908B0A4C9CC25340AD6CA5
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_1489069016\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3264-37-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3264-40-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3264-43-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3264-58-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3264-0-0x0000000000400000-0x00000000008B2000-memory.dmp

Download

memory/3264-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5128-66-0x00000000025C0000-0x00000000025F0000-memory.dmp

Download

memory/5128-381-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5128-371-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5128-322-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5128-464-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5128-59-0x0000000000400000-0x00000000008B2000-memory.dmp

Download

memory/5128-65-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5128-67-0x00000000025C0000-0x00000000025F0000-memory.dmp

Download

memory/5544-210-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5544-79-0x0000000010000000-0x0000000010030000-memory.dmp

Download