Analysis
- user interaction
yes - max time kernel
42s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 17:24
Behavioral task
behavioral1
Sample
ByGoneSpoofer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ByGoneSpoofer.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target ByGoneSpoofer.exe
- Size 10.0MB
- Sample260629-vytztact2p
- SHA256 bda37b122adebba9b64e3b02eccf023fe832c3741bc64d59660245ff10992c11
- MD5 a9ab8f17de97b94a4a31fb4ad551f532
- SHA1 146a8c5b7fc4768515bf8b7714ba9a94282c629e
- SHA512 a774c404e1a0f8d6c2b9517aa056f3f7ba4e7b4aadea723da49856dca7b4e98eb28e910d9bed39c5bbc6f4b2b46582999ceb05d9c4fcbe8a9bda616b387436f0
- SSDEEP 196608:YGWMNEe5urHm7ND9BKG+5fc2S/ErXKEtw+B/oy4iMsqgz+nOnUc:YMNpuCRDvV+53SM8+Bz4ND9c
- TLSH T1ECB633007FD00AF9F6A3E23FC551D825A37678036B52CE9B865456613F731E12E3A7A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 6 IoCs
pid Process 5212 wevtutil.exe 5964 wevtutil.exe 4108 wevtutil.exe 4752 wevtutil.exe 4708 wevtutil.exe 3404 wevtutil.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Loads dropped DLL 46 IoCs
pid Process 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe 824 ByGoneSpoofer.exe -
pid Process 2496 powershell.exe 4320 powershell.exe - Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 11 raw.githubusercontent.com 13 raw.githubusercontent.com 16 raw.githubusercontent.com 18 raw.githubusercontent.com - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3948 tasklist.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4992 sc.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4388 ipconfig.exe - Kills process with taskkill 10 IoCs
pid Process 4560 taskkill.exe 5840 taskkill.exe 2940 taskkill.exe 4628 taskkill.exe 1444 taskkill.exe 5864 taskkill.exe 4736 taskkill.exe 5872 taskkill.exe 4616 taskkill.exe 1796 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{B0D916D2-01EB-4CEA-AE67-2A134D823A8D} explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{3C7D6ED1-DE33-463C-996A-D1BE17775892} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 476 WMIC.exe 476 WMIC.exe 476 WMIC.exe 476 WMIC.exe 2672 explorer.exe 2672 explorer.exe 476 WMIC.exe 476 WMIC.exe 476 WMIC.exe 476 WMIC.exe 2672 explorer.exe 2672 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1796 taskkill.exe Token: SeDebugPrivilege 1444 taskkill.exe Token: SeDebugPrivilege 4560 taskkill.exe Token: SeDebugPrivilege 5840 taskkill.exe Token: SeDebugPrivilege 5864 taskkill.exe Token: SeDebugPrivilege 3948 tasklist.exe Token: SeIncreaseQuotaPrivilege 476 WMIC.exe Token: SeSecurityPrivilege 476 WMIC.exe Token: SeTakeOwnershipPrivilege 476 WMIC.exe Token: SeLoadDriverPrivilege 476 WMIC.exe Token: SeSystemProfilePrivilege 476 WMIC.exe Token: SeSystemtimePrivilege 476 WMIC.exe Token: SeProfSingleProcessPrivilege 476 WMIC.exe Token: SeIncBasePriorityPrivilege 476 WMIC.exe Token: SeCreatePagefilePrivilege 476 WMIC.exe Token: SeBackupPrivilege 476 WMIC.exe Token: SeRestorePrivilege 476 WMIC.exe Token: SeShutdownPrivilege 476 WMIC.exe Token: SeDebugPrivilege 476 WMIC.exe Token: SeSystemEnvironmentPrivilege 476 WMIC.exe Token: SeRemoteShutdownPrivilege 476 WMIC.exe Token: SeUndockPrivilege 476 WMIC.exe Token: SeManageVolumePrivilege 476 WMIC.exe Token: 33 476 WMIC.exe Token: 34 476 WMIC.exe Token: 35 476 WMIC.exe Token: 36 476 WMIC.exe Token: SeIncreaseQuotaPrivilege 476 WMIC.exe Token: SeSecurityPrivilege 476 WMIC.exe Token: SeTakeOwnershipPrivilege 476 WMIC.exe Token: SeLoadDriverPrivilege 476 WMIC.exe Token: SeSystemProfilePrivilege 476 WMIC.exe Token: SeSystemtimePrivilege 476 WMIC.exe Token: SeProfSingleProcessPrivilege 476 WMIC.exe Token: SeIncBasePriorityPrivilege 476 WMIC.exe Token: SeCreatePagefilePrivilege 476 WMIC.exe Token: SeBackupPrivilege 476 WMIC.exe Token: SeRestorePrivilege 476 WMIC.exe Token: SeShutdownPrivilege 476 WMIC.exe Token: SeDebugPrivilege 476 WMIC.exe Token: SeSystemEnvironmentPrivilege 476 WMIC.exe Token: SeRemoteShutdownPrivilege 476 WMIC.exe Token: SeUndockPrivilege 476 WMIC.exe Token: SeManageVolumePrivilege 476 WMIC.exe Token: 33 476 WMIC.exe Token: 34 476 WMIC.exe Token: 35 476 WMIC.exe Token: 36 476 WMIC.exe Token: SeShutdownPrivilege 2672 explorer.exe Token: SeCreatePagefilePrivilege 2672 explorer.exe Token: SeShutdownPrivilege 2672 explorer.exe Token: SeCreatePagefilePrivilege 2672 explorer.exe Token: SeShutdownPrivilege 2672 explorer.exe Token: SeCreatePagefilePrivilege 2672 explorer.exe Token: SeShutdownPrivilege 2672 explorer.exe Token: SeCreatePagefilePrivilege 2672 explorer.exe Token: SeShutdownPrivilege 2672 explorer.exe Token: SeCreatePagefilePrivilege 2672 explorer.exe Token: SeDebugPrivilege 1796 taskkill.exe Token: SeDebugPrivilege 1444 taskkill.exe Token: SeDebugPrivilege 4560 taskkill.exe Token: SeDebugPrivilege 5840 taskkill.exe Token: SeDebugPrivilege 5864 taskkill.exe Token: SeDebugPrivilege 3948 tasklist.exe - Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 2928 sihost.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2928 sihost.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1660 wrote to memory of 824 1660 ByGoneSpoofer.exe 88 PID 824 wrote to memory of 3184 824 ByGoneSpoofer.exe 89 PID 824 wrote to memory of 1796 824 ByGoneSpoofer.exe 90 PID 824 wrote to memory of 1444 824 ByGoneSpoofer.exe 92 PID 824 wrote to memory of 4560 824 ByGoneSpoofer.exe 93 PID 824 wrote to memory of 5840 824 ByGoneSpoofer.exe 94 PID 824 wrote to memory of 5864 824 ByGoneSpoofer.exe 95 PID 824 wrote to memory of 5084 824 ByGoneSpoofer.exe 99 PID 5084 wrote to memory of 3948 5084 cmd.exe 100 PID 824 wrote to memory of 1312 824 ByGoneSpoofer.exe 102 PID 1312 wrote to memory of 4992 1312 cmd.exe 103 PID 824 wrote to memory of 5072 824 ByGoneSpoofer.exe 104 PID 5072 wrote to memory of 476 5072 cmd.exe 105 PID 2928 wrote to memory of 2672 2928 sihost.exe 106 PID 1660 wrote to memory of 824 1660 ByGoneSpoofer.exe 88 PID 824 wrote to memory of 3184 824 ByGoneSpoofer.exe 89 PID 824 wrote to memory of 1796 824 ByGoneSpoofer.exe 90 PID 824 wrote to memory of 1444 824 ByGoneSpoofer.exe 92 PID 824 wrote to memory of 4560 824 ByGoneSpoofer.exe 93 PID 824 wrote to memory of 5840 824 ByGoneSpoofer.exe 94 PID 824 wrote to memory of 5864 824 ByGoneSpoofer.exe 95 PID 824 wrote to memory of 5084 824 ByGoneSpoofer.exe 99 PID 5084 wrote to memory of 3948 5084 cmd.exe 100 PID 824 wrote to memory of 1312 824 ByGoneSpoofer.exe 102 PID 1312 wrote to memory of 4992 1312 cmd.exe 103 PID 824 wrote to memory of 5072 824 ByGoneSpoofer.exe 104 PID 5072 wrote to memory of 476 5072 cmd.exe 105 PID 2928 wrote to memory of 2672 2928 sihost.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ByGoneSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\ByGoneSpoofer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\ByGoneSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\ByGoneSpoofer.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3184
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM RobloxPlayerBeta.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM RobloxPlayerLauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM Roblox.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM RobloxStudio.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5840
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM RobloxCrashHandler.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc query winmgmt"3⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\sc.exesc query winmgmt4⤵
- Launches sc.exe
PID:4992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"3⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Enable-ComputerRestore -Drive 'C:\'""3⤵PID:2976
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Enable-ComputerRestore -Drive 'C:\'"4⤵
- Command and Scripting Interpreter: PowerShell
PID:4320
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Checkpoint-Computer -Description \"ByGone Full Spoof Backup\" -RestorePointType \"MODIFY_SETTINGS\""3⤵
- Command and Scripting Interpreter: PowerShell
PID:2496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"3⤵PID:2604
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv4⤵PID:2460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac /v /fo csv"3⤵PID:1496
-
C:\Windows\system32\getmac.exegetmac /v /fo csv4⤵PID:4716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic bios get serialnumber,manufacturer,version /format:csv"3⤵PID:2084
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber,manufacturer,version /format:csv4⤵PID:4296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic baseboard get serialnumber,manufacturer,product /format:csv"3⤵PID:4360
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber,manufacturer,product /format:csv4⤵PID:1840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get uuid,manufacturer,model /format:csv"3⤵PID:1808
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get uuid,manufacturer,model /format:csv4⤵PID:2164
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic cpu get processorid,name /format:csv"3⤵PID:6012
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get processorid,name /format:csv4⤵PID:5520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg export "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" "C:\Users\Admin\AppData\Roaming\ByGoneEDIDBackup.reg" /y"3⤵PID:3796
-
C:\Windows\system32\reg.exereg export "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" "C:\Users\Admin\AppData\Roaming\ByGoneEDIDBackup.reg" /y4⤵PID:5204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Application""3⤵PID:5592
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Application"4⤵
- Clears Windows event logs
PID:3404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wevtutil.exe cl "System""3⤵PID:4700
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "System"4⤵
- Clears Windows event logs
PID:5212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Security""3⤵PID:5832
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Security"4⤵
- Clears Windows event logs
PID:5964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL""3⤵PID:3712
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"4⤵
- Clears Windows event logs
PID:4108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script""3⤵PID:4940
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"4⤵
- Clears Windows event logs
PID:4752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational""3⤵PID:5760
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational"4⤵
- Clears Windows event logs
PID:4708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /flushdns"3⤵PID:4776
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns4⤵
- Gathers network information
PID:4388
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM RobloxPlayerBeta.exe3⤵
- Kills process with taskkill
PID:2940
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM RobloxPlayerLauncher.exe3⤵
- Kills process with taskkill
PID:4736
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM Roblox.exe3⤵
- Kills process with taskkill
PID:5872
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM RobloxStudio.exe3⤵
- Kills process with taskkill
PID:4616
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM RobloxCrashHandler.exe3⤵
- Kills process with taskkill
PID:4628
-
-
C:\Windows\SYSTEM32\reg.exereg delete "HKCU\Software\ROBLOX Corporation" /f3⤵PID:5500
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"3⤵PID:3028
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv4⤵PID:4348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh interface set interface name="Ethernet" admin=disable"3⤵PID:1036
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" admin=disable4⤵PID:3924
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2672
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2368
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:5312
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:696
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:5524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
- MD5 9db254dd0cf5e2b1153ff5cde0ed8885
- SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
- SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
- TLSH T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 591B
- SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
- MD5 03c08670d283322f0e61ee3d5dcb7bad
- SHA1 c82040e59df0159f5cc0fd8cc795d4b73c1bf5e2
- SHA512 173493c828071e601a1d823c4c0f325c638aec3166c071a8b39dbb7ce57d84903415b051a5effc6bdd5ea4d2f9dcf8471bcb380a37133ede15ab2017cb2b1986
- TLSH T19BF09707E7A55221C0222638888116F02B25D5D68ECB227381016B5E7EB33002B008B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_bz2.pyd
- Size 83KB
- SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
- MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
- SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
- SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
- SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
- TLSH T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_ctypes.pyd
- Size 129KB
- SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
- MD5 ab19e3dd4731ed075589abadcde68991
- SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
- SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
- SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
- TLSH T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_hashlib.pyd
- Size 68KB
- SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
- MD5 9ec1021fa8a3c252e1f805ac7f172753
- SHA1 773a3069dfb3711cb6f07c1c4dbfbab8b7c779d1
- SHA512 0940c59f5c1c4afe5457d16aa5053aa7e27de1ac2748de5a0614ec01d630f76d75a86159260a6c53209d098da16d50fa0c4ee3427c04a38180fe9eccc4e6b034
- SSDEEP 1536:R46Ee9w2oW/Sd9/LOJu0PuaY9IyvIWyrcz89RfIZRVjE:RdEIoRF0PuaY9IyvIS3ZjE
- TLSH T157637D95AA884091D92382B5C8E34F43FEB4F25217119BDFA3A8C18D2F237C39776756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_lzma.pyd
- Size 156KB
- SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
- MD5 d165b7b9a127f66704ceaa196be319e5
- SHA1 ee3de55b32d1357599cef86df35e307477038a15
- SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
- SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
- TLSH T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_queue.pyd
- Size 33KB
- SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
- MD5 8fc4810cff733e6f17a7530d3fb67d58
- SHA1 20163031892c87a67169f4ae25115e4e33845626
- SHA512 c45ebdb450f30d034ba113729ada2a006baa2ad8c7a83cc59ee55e6fd10511d6f663b1d7f24fbcd493884a84cbedd1368e3a2136ff7da58fb47394147b021f45
- SSDEEP 768:BFJpl1r6rWcgds5Iy9UxLXyrcEOJh2Ip48XlCxf1ml0ZMz7:BDr8Wcgds5Iy9Uxyrcz89ayfIbz7
- TLSH T10AF28ECAAA684047D663C671C1E7EF42F974F7D34A11879F2169828E1F23381F726329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_socket.pyd
- Size 84KB
- SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
- MD5 c2938dbdcdaba1ccbefee37f6a06cd0c
- SHA1 944cb024144f327ba517ccf72af9bb9a79b8b23e
- SHA512 79e9f40665b7049c9feb04742a91c8c88749c1998794f1a51ac7b47a5f5ac3c1a2b441dcb9cd126e395581d9553305c24356b54d81d0a9fbecb41a4341af776f
- SSDEEP 1536:axl/h+6SDo3OkB+ecI4xyJwoQlyJ+9+nzpjTOKxtS44O05IyywFyrcz89jfIW44a:axko35X4yJwoQlyJs+nzlqKxBw5IyywZ
- TLSH T154836B10A69041FAEB63D1B5C2639E63FBB4B5C11391A35F0066C55A1F333C2BF7AA85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_ssl.pyd
- Size 177KB
- SHA256 11572f6eb63e43cdc2908812506ffcdab21be2be5931f1e38d856c15f5a79e6c
- MD5 893ee1e905ec5a1f74b10d73a8b94e6a
- SHA1 23d6eb756eb48c1632b02a24f53aacf71bdfa409
- SHA512 237c9b37f4b44ae37726f3fef750f6eda65b9d8a540f386c5a43e1bcef400dfed0f9f37f2dc4042fe0c4fec0ed9aeb700797396bae2e5f052525851760288b61
- SSDEEP 3072:/TzN6X1nguzjfD6C3xPsMn6osf87vOifHZHmzislIyL7rXH:/TzgX5gID6C3mMn+2s/
- TLSH T12B047C47B5842AF7D813E4B9C2234903EBB1F155331257DE48D6EA490F03746AEAAB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_uuid.pyd
- Size 27KB
- SHA256 6a3e6d89e71a803609e6e765a592011427a5b6e7a4766bbca7790b601bb66dbe
- MD5 8cdd2cc12be9491bf150e366e81217be
- SHA1 6567dba49c9bac718a1badb504fe83b1d3755c66
- SHA512 c573f46295699a7314dde633b04e331f292aeafb36f813055144c95f24bc386ce23704980e3cb6a491d4a05e207cf2517526fd0c602b53cf514a7c2b8d27a338
- SSDEEP 768:sty+WlIy0wvXyrcEOJh2Ip4B3Cxf1mlPr50BP:sty+WlIy0w/yrcz89BofIT5+P
- TLSH T1FAC25B899A648043FA539B70D1A2DE83FE7DBBD35A90869B316991850E133C2F31736D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\base_library.zip
- Size 1.3MB
- SHA256 4726f618b8da9a1dc3f4f708384ebfdd1e4301627ea4ef0fe833b247f2f70bae
- MD5 f3f487e255e8a1cb880507510f7c79cf
- SHA1 21cbae103cf710d5b15ada914eee998ef9a297e3
- SHA512 3979c1abefd178c5cbebc42275e946eeda772da969800d7f419c2790efc56ebc74e8add5694479d368757715a724d6ecfa01b78381242ea5887c67125257c7f5
- SSDEEP 12288:F8imqhTmtYzGNcT1QDwtydjdTji2cPPdxhYrL+DX5UW7Wp+PuOBa80201jwCVRDP:6qBSeT1OfdZj5cPPdxhYo7WpKzyIu7
- TLSH T102551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\certifi\cacert.pem
- Size 280KB
- SHA256 9102e6a3644a071ba6cdbd4a53698f291c4a64b18450a08bc046548b6db5cc8b
- MD5 64c9f8888c14aa49beb3f82634193c7a
- SHA1 fec7b8c0a17c1c555fd33baee53678f31b7645ee
- SHA512 60d1043f7c1205d3efe03a00d68451cd075cc6abb19f2186a081206bd01a83ee6da521070bc655606f9df18e6208ac94ab41902610f2cb24f3b33d28c523b209
- SSDEEP 6144:3nB8fRRiplkXURrVADwYCuCCgT/QRSRqNb7d84u5Nahry:XiRiLWURrIdRWavdX08M
- TLSH T182546D964F2A9C052C9FE1C1CA9B1357DD3A027B99FEF0F139462448D24622A17FCD9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\charset_normalizer\md.cp313-win_amd64.pyd
- Size 10KB
- SHA256 4e66da1baef3b663ab8f48feed4ed1d72e977b4209240595d2c440071bc632c8
- MD5 9d06b4fe0c2b5b3b386a99ef80f0e968
- SHA1 76b9db0ee7332db4b0011c85edbd03dd805eeeb0
- SHA512 9e4efd89536641531037427e04e800bf3c71dc277e07861460a963f62a519ee181c89d7f89297d17179d24487519f3b6f280c452cebf71b55d5ef048dbeab347
- SSDEEP 192:6xGrmoX+sMl/++Ch9p8VBdisuOL58A0JH6:6x4m446mDZuI8Ae
- TLSH T1F622F75CFA6458EAE9168134C9374E4AB132BB2217027BCF8370D16E2FA37E66534785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
- Size 125KB
- SHA256 a26b6459a25f1e9b600ac3df6b2c4f30d7f9d643292546b85ccb763d49fdea90
- MD5 0fadfd9e08e576839fa4875cad8727d6
- SHA1 e3df4fed3cfaa8554068b1ecda97aa4aa7b421d5
- SHA512 946934dd023b612974be3335fd323e0657ef4125338fc0257bf877691c08f98f19c2bcdbadae9a90b2c4b56abe74cc7ee76998b9f164e70596848330e11c6cfa
- SSDEEP 3072:gd2ptVk3J/37NxXtng+ByrhuJud3YYAbpYk8:ZpiO+BzJazAbek8
- TLSH T12EC32A1762950073DA634278CCB76916DBE1B951173253CF04E4C75A2F07BEABEBEA02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\libcrypto-3.dll
- Size 5.0MB
- SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
- MD5 ae5b2e9a3410839b31938f24b6fc5cd8
- SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
- SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
- SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
- TLSH T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\libssl-3.dll
- Size 776KB
- SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
- MD5 8d4805f0651186046c48d3e2356623db
- SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
- SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
- SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
- TLSH T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\python313.dll
- Size 5.8MB
- SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
- MD5 5acd4d4f35e13ef79c883ace05c4eaf5
- SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
- SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
- SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
- TLSH T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\pywin32_system32\pywintypes313.dll
- Size 132KB
- SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
- MD5 f7fa93a0bc20b155e9b141b6705870f0
- SHA1 72c6bf418a55806e86cf67b3d363a385ae9cfca6
- SHA512 3d8b7ae0303020e6fed0066f08eb30ae437541de0918528561e50f923cd42654a6453f59e610f11c4676022552ce09fa63a8fc8b1e13b5a3a8de0378d54c5b2e
- SSDEEP 3072:F54SfEA3X4IiyNHpFBiuQdY/r06YrfNaQQDElr4ohgmF+M90X3:j9TH4IiyNH7BodY/rk7NaY4wgs+M90H
- TLSH T19FD34A47374644DAE966E37D8C771E02D3A2B0100711E3CF06A5C2AB6F63BD66D3B646
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\select.pyd
- Size 32KB
- SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
- MD5 e5728d041bfb1841fc460db4027a2952
- SHA1 71e6aaa90e905a72ac83450796af4fb2bb3503d7
- SHA512 a53efe3872b035445b7d66a71dffb690cfd00ff6296af25d0dbdfe92c904a8d06442c91e9638b2d5e54420f6998220d65f39b35ef3c1a87e812e9deea1967ab9
- SSDEEP 768:hCOFHfRme5Iy9GKXyrcEOJh2Ip4SBITxf1mlDeI6QKF:hCOF/Rme5Iy9GEyrcz89+0fIUQ+
- TLSH T191E27D8AAB245047F9A2C97185B6DF43F939B7A34B11829F30A5D2990F137C1F73A394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\unicodedata.pyd
- Size 695KB
- SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
- MD5 0a3be15d03e1c55c4df0c7e4fa4005bd
- SHA1 a8b30adb77dccd9b7bdc1ec3b1800127e586e3f6
- SHA512 2a408d178dd0261dfeccfb791fe05a40caedc64b7ad6cd543fafd31d1e676721240020ad43f26cd8adf94a8c3e68522fc96ebb0f987fe0ba15b9287aac1242b2
- SSDEEP 12288:aYgdLI/X77mvfldCKGihH32W3cnPSqrUgu+f:aYgW7qNxr3cnPXu+f
- TLSH T11FE4F6D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\win32\win32api.pyd
- Size 132KB
- SHA256 b80722e54741563e72e264ca33e1900ee49c927c475e54ef8f94c3eac9032465
- MD5 d42a79a170c86721f723fe960eb5d923
- SHA1 eaf8519e229409e634b5fabc42b90202739f2d9a
- SHA512 bb9a1c302226bf67c11ac062e04f7cb927e776903101526b625cf7cb778c1c524f57793827cd0e549c7b2d48b162947f2e9e1a70d8aeb49fe14577b6e96bd250
- SSDEEP 3072:9QmxBqwukucyF9S18lRVFhLaNzvV5697NUbmArvfA1fAx4:7LqwnBiS6lRVgvIU3vfafS
- TLSH T1BFD30783B39410C6D86AA6BCC5775B23D772B8240B61A7CF0A60C18A1F237E97D7D794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\win32\win32security.pyd
- Size 134KB
- SHA256 99b4fd9f47602371380c8579489b0c6fdc88d7776224062ba6c39b185c4e9001
- MD5 064d95a90297b7933e6a32b94dce5efb
- SHA1 215a63968abd303f2b1a9f5d4940929ea16a3bb0
- SHA512 017a16a7961959de86580c0b728a14cf556201001f11de6d513dd09ba9d93126498e1e6dde1b54def4c6df5d21b516ef42ae5033ff89e8863b1293fa782c5d68
- SSDEEP 1536:UMwjnPk+/0UcVgVdsf5NGSW3RcQVj7dCM+xDatGN8ZYWtgSLjRAe2KDlEI:J4Pk+cUcVgVd3RN4XN85/jRAe2KD
- TLSH T1B0D34A5373C480D5E91AA2BDC8725A13E3B2B4444BC0E7CF05A5CA9A9F132D67E39F91
- MD5 SHA1 SHA512 SSDEEP TLSH