bda37b122adebba9b64e3b02eccf023fe832c3741bc64d59660245ff10992c11

Analysis

user interaction
yes
max time kernel
89s
max time network
227s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ByGoneSpoofer.exe
Size 10.0MB
Sample260801-e4a6wsxgjd
SHA256 bda37b122adebba9b64e3b02eccf023fe832c3741bc64d59660245ff10992c11
MD5 a9ab8f17de97b94a4a31fb4ad551f532
SHA1 146a8c5b7fc4768515bf8b7714ba9a94282c629e
SHA512 a774c404e1a0f8d6c2b9517aa056f3f7ba4e7b4aadea723da49856dca7b4e98eb28e910d9bed39c5bbc6f4b2b46582999ceb05d9c4fcbe8a9bda616b387436f0
SSDEEP 196608:YGWMNEe5urHm7ND9BKG+5fc2S/ErXKEtw+B/oy4iMsqgz+nOnUc:YMNpuCRDvV+53SM8+Bz4ND9c
TLSH
T1ECB633007FD00AF9F6A3E23FC551D825A37678036B52CE9B865456613F731E12E3A7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4284	wevtutil.exe
3968	wevtutil.exe
4436	wevtutil.exe
4928	wevtutil.exe
4888	wevtutil.exe
5856	wevtutil.exe

Loads dropped DLL 46 IoCs

pid	Process
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe
6028	ByGoneSpoofer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5284	powershell.exe
408	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
47	raw.githubusercontent.com
48	raw.githubusercontent.com
56	raw.githubusercontent.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4800	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3204	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4936	cmd.exe
3608	cmd.exe
3396	cmd.exe
3836	cmd.exe
1320	cmd.exe
4356	cmd.exe
3948	cmd.exe
4908	cmd.exe
3500	cmd.exe
4452	cmd.exe
3508	cmd.exe
4212	cmd.exe
5128	cmd.exe
4828	cmd.exe
3216	cmd.exe
4188	cmd.exe
816	cmd.exe
5792	cmd.exe
1076	cmd.exe
4884	cmd.exe
5484	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000483bb63a526d2ab10000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801483bb63a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101483bb63a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f483bb63a00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71483bb63a00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4944	ipconfig.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
5600	taskkill.exe
5796	taskkill.exe
5080	taskkill.exe
5952	taskkill.exe
3340	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3612	WMIC.exe
3612	WMIC.exe
3612	WMIC.exe
3612	WMIC.exe
5284	powershell.exe
5284	powershell.exe
408	powershell.exe
408	powershell.exe
1380	WMIC.exe
1380	WMIC.exe
1380	WMIC.exe
1380	WMIC.exe
3428	WMIC.exe
3428	WMIC.exe
3428	WMIC.exe
3428	WMIC.exe
4224	WMIC.exe
4224	WMIC.exe
4224	WMIC.exe
4224	WMIC.exe
1048	WMIC.exe
1048	WMIC.exe
1048	WMIC.exe
1048	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5116	WMIC.exe
5116	WMIC.exe
5116	WMIC.exe
5116	WMIC.exe
3612	WMIC.exe
3612	WMIC.exe
3612	WMIC.exe
3612	WMIC.exe
5284	powershell.exe
5284	powershell.exe
408	powershell.exe
408	powershell.exe
1380	WMIC.exe
1380	WMIC.exe
1380	WMIC.exe
1380	WMIC.exe
3428	WMIC.exe
3428	WMIC.exe
3428	WMIC.exe
3428	WMIC.exe
4224	WMIC.exe
4224	WMIC.exe
4224	WMIC.exe
4224	WMIC.exe
1048	WMIC.exe
1048	WMIC.exe
1048	WMIC.exe
1048	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5472	WMIC.exe
5116	WMIC.exe
5116	WMIC.exe
5116	WMIC.exe
5116	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3612	WMIC.exe
Token: SeSecurityPrivilege	3612	WMIC.exe
Token: SeTakeOwnershipPrivilege	3612	WMIC.exe
Token: SeLoadDriverPrivilege	3612	WMIC.exe
Token: SeSystemProfilePrivilege	3612	WMIC.exe
Token: SeSystemtimePrivilege	3612	WMIC.exe
Token: SeProfSingleProcessPrivilege	3612	WMIC.exe
Token: SeIncBasePriorityPrivilege	3612	WMIC.exe
Token: SeCreatePagefilePrivilege	3612	WMIC.exe
Token: SeBackupPrivilege	3612	WMIC.exe
Token: SeRestorePrivilege	3612	WMIC.exe
Token: SeShutdownPrivilege	3612	WMIC.exe
Token: SeDebugPrivilege	3612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3612	WMIC.exe
Token: SeRemoteShutdownPrivilege	3612	WMIC.exe
Token: SeUndockPrivilege	3612	WMIC.exe
Token: SeManageVolumePrivilege	3612	WMIC.exe
Token: 33	3612	WMIC.exe
Token: 34	3612	WMIC.exe
Token: 35	3612	WMIC.exe
Token: 36	3612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3612	WMIC.exe
Token: SeSecurityPrivilege	3612	WMIC.exe
Token: SeTakeOwnershipPrivilege	3612	WMIC.exe
Token: SeLoadDriverPrivilege	3612	WMIC.exe
Token: SeSystemProfilePrivilege	3612	WMIC.exe
Token: SeSystemtimePrivilege	3612	WMIC.exe
Token: SeProfSingleProcessPrivilege	3612	WMIC.exe
Token: SeIncBasePriorityPrivilege	3612	WMIC.exe
Token: SeCreatePagefilePrivilege	3612	WMIC.exe
Token: SeBackupPrivilege	3612	WMIC.exe
Token: SeRestorePrivilege	3612	WMIC.exe
Token: SeShutdownPrivilege	3612	WMIC.exe
Token: SeDebugPrivilege	3612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3612	WMIC.exe
Token: SeRemoteShutdownPrivilege	3612	WMIC.exe
Token: SeUndockPrivilege	3612	WMIC.exe
Token: SeManageVolumePrivilege	3612	WMIC.exe
Token: 33	3612	WMIC.exe
Token: 34	3612	WMIC.exe
Token: 35	3612	WMIC.exe
Token: 36	3612	WMIC.exe
Token: SeDebugPrivilege	5284	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeBackupPrivilege	5788	vssvc.exe
Token: SeRestorePrivilege	5788	vssvc.exe
Token: SeAuditPrivilege	5788	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1380	WMIC.exe
Token: SeSecurityPrivilege	1380	WMIC.exe
Token: SeTakeOwnershipPrivilege	1380	WMIC.exe
Token: SeLoadDriverPrivilege	1380	WMIC.exe
Token: SeSystemProfilePrivilege	1380	WMIC.exe
Token: SeSystemtimePrivilege	1380	WMIC.exe
Token: SeProfSingleProcessPrivilege	1380	WMIC.exe
Token: SeIncBasePriorityPrivilege	1380	WMIC.exe
Token: SeCreatePagefilePrivilege	1380	WMIC.exe
Token: SeBackupPrivilege	1380	WMIC.exe
Token: SeRestorePrivilege	1380	WMIC.exe
Token: SeShutdownPrivilege	1380	WMIC.exe
Token: SeDebugPrivilege	1380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1380	WMIC.exe
Token: SeRemoteShutdownPrivilege	1380	WMIC.exe
Token: SeUndockPrivilege	1380	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 6028	4012	ByGoneSpoofer.exe	83
PID 6028 wrote to memory of 4936	6028	ByGoneSpoofer.exe	84
PID 6028 wrote to memory of 3608	6028	ByGoneSpoofer.exe	93
PID 3608 wrote to memory of 4800	3608	cmd.exe	94
PID 6028 wrote to memory of 4452	6028	ByGoneSpoofer.exe	95
PID 4452 wrote to memory of 3204	4452	cmd.exe	96
PID 6028 wrote to memory of 3508	6028	ByGoneSpoofer.exe	97
PID 3508 wrote to memory of 3612	3508	cmd.exe	98
PID 6028 wrote to memory of 1320	6028	ByGoneSpoofer.exe	100
PID 1320 wrote to memory of 5284	1320	cmd.exe	101
PID 6028 wrote to memory of 408	6028	ByGoneSpoofer.exe	103
PID 6028 wrote to memory of 5792	6028	ByGoneSpoofer.exe	109
PID 5792 wrote to memory of 1380	5792	cmd.exe	110
PID 6028 wrote to memory of 4212	6028	ByGoneSpoofer.exe	111
PID 4212 wrote to memory of 4244	4212	cmd.exe	112
PID 6028 wrote to memory of 4356	6028	ByGoneSpoofer.exe	114
PID 4356 wrote to memory of 3428	4356	cmd.exe	115
PID 6028 wrote to memory of 5128	6028	ByGoneSpoofer.exe	116
PID 5128 wrote to memory of 4224	5128	cmd.exe	117
PID 6028 wrote to memory of 1076	6028	ByGoneSpoofer.exe	118
PID 1076 wrote to memory of 1048	1076	cmd.exe	119
PID 6028 wrote to memory of 3948	6028	ByGoneSpoofer.exe	120
PID 3948 wrote to memory of 5472	3948	cmd.exe	121
PID 6028 wrote to memory of 4828	6028	ByGoneSpoofer.exe	122
PID 4828 wrote to memory of 4736	4828	cmd.exe	123
PID 6028 wrote to memory of 3216	6028	ByGoneSpoofer.exe	124
PID 3216 wrote to memory of 4284	3216	cmd.exe	125
PID 6028 wrote to memory of 4188	6028	ByGoneSpoofer.exe	126
PID 4188 wrote to memory of 3968	4188	cmd.exe	127
PID 6028 wrote to memory of 3396	6028	ByGoneSpoofer.exe	128
PID 3396 wrote to memory of 4436	3396	cmd.exe	129
PID 6028 wrote to memory of 3836	6028	ByGoneSpoofer.exe	130
PID 3836 wrote to memory of 4928	3836	cmd.exe	131
PID 6028 wrote to memory of 4884	6028	ByGoneSpoofer.exe	132
PID 4884 wrote to memory of 4888	4884	cmd.exe	133
PID 6028 wrote to memory of 4908	6028	ByGoneSpoofer.exe	134
PID 4908 wrote to memory of 5856	4908	cmd.exe	135
PID 6028 wrote to memory of 3500	6028	ByGoneSpoofer.exe	136
PID 3500 wrote to memory of 4944	3500	cmd.exe	137
PID 6028 wrote to memory of 5080	6028	ByGoneSpoofer.exe	138
PID 6028 wrote to memory of 5952	6028	ByGoneSpoofer.exe	139
PID 6028 wrote to memory of 3340	6028	ByGoneSpoofer.exe	140
PID 6028 wrote to memory of 5600	6028	ByGoneSpoofer.exe	141
PID 6028 wrote to memory of 5796	6028	ByGoneSpoofer.exe	142
PID 6028 wrote to memory of 5904	6028	ByGoneSpoofer.exe	143
PID 6028 wrote to memory of 816	6028	ByGoneSpoofer.exe	144
PID 816 wrote to memory of 5116	816	cmd.exe	145
PID 6028 wrote to memory of 5484	6028	ByGoneSpoofer.exe	146
PID 5484 wrote to memory of 2100	5484	cmd.exe	147
PID 4012 wrote to memory of 6028	4012	ByGoneSpoofer.exe	83
PID 6028 wrote to memory of 4936	6028	ByGoneSpoofer.exe	84
PID 6028 wrote to memory of 3608	6028	ByGoneSpoofer.exe	93
PID 3608 wrote to memory of 4800	3608	cmd.exe	94
PID 6028 wrote to memory of 4452	6028	ByGoneSpoofer.exe	95
PID 4452 wrote to memory of 3204	4452	cmd.exe	96
PID 6028 wrote to memory of 3508	6028	ByGoneSpoofer.exe	97
PID 3508 wrote to memory of 3612	3508	cmd.exe	98
PID 6028 wrote to memory of 1320	6028	ByGoneSpoofer.exe	100
PID 1320 wrote to memory of 5284	1320	cmd.exe	101
PID 6028 wrote to memory of 408	6028	ByGoneSpoofer.exe	103
PID 6028 wrote to memory of 5792	6028	ByGoneSpoofer.exe	109
PID 5792 wrote to memory of 1380	5792	cmd.exe	110
PID 6028 wrote to memory of 4212	6028	ByGoneSpoofer.exe	111
PID 4212 wrote to memory of 4244	4212	cmd.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ByGoneSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\ByGoneSpoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\ByGoneSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\ByGoneSpoofer.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc query winmgmt"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\system32\sc.exe
      sc query winmgmt
      4⤵
      Launches sc.exe
      PID:3204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Enable-ComputerRestore -Drive 'C:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Enable-ComputerRestore -Drive 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Checkpoint-Computer -Description \"ByGone Full Spoof Backup\" -RestorePointType \"MODIFY_SETTINGS\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac /v /fo csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\system32\getmac.exe
      getmac /v /fo csv
      4⤵
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber,manufacturer,version /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber,manufacturer,version /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic baseboard get serialnumber,manufacturer,product /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber,manufacturer,product /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get uuid,manufacturer,model /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get uuid,manufacturer,model /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get processorid,name /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get processorid,name /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg export "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" "C:\Users\Admin\AppData\Roaming\ByGoneEDIDBackup.reg" /y"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\system32\reg.exe
      reg export "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" "C:\Users\Admin\AppData\Roaming\ByGoneEDIDBackup.reg" /y
      4⤵
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Application""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Application"
      4⤵
      Clears Windows event logs
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "System""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "System"
      4⤵
      Clears Windows event logs
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Security""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Security"
      4⤵
      Clears Windows event logs
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
      4⤵
      Clears Windows event logs
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
      4⤵
      Clears Windows event logs
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational"
      4⤵
      Clears Windows event logs
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ipconfig /flushdns"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:4944
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM RobloxPlayerBeta.exe
    3⤵
    - Kills process with taskkill
    PID:5080
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM RobloxPlayerLauncher.exe
    3⤵
    - Kills process with taskkill
    PID:5952
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM Roblox.exe
    3⤵
    - Kills process with taskkill
    PID:3340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM RobloxStudio.exe
    3⤵
    - Kills process with taskkill
    PID:5600
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM RobloxCrashHandler.exe
    3⤵
    - Kills process with taskkill
    PID:5796
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKCU\Software\ROBLOX Corporation" /f
    3⤵
    PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh interface set interface name="Ethernet" admin=disable"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\system32\netsh.exe
      netsh interface set interface name="Ethernet" admin=disable
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5788

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_asyncio.pyd
Size 70KB
SHA256 adaaf0c703641f6dbed30d101a5e23c17cc9454c36303394b9e28a52ea457471
MD5 0693819137d5c98bfae7f06b0d76a8f9
SHA1 d9d92845f0f41a600e3967a1fd05ca69f2147a34
SHA512 ab08c8fc551d96c5f5cfa81b72f2ef8256c852c676cfb2c60a93f06dbfd07577679ddd0cc3356092ac91412e6442572f8af92cc467c4cde0475c4cbb918ae4d2
SSDEEP 1536:wCY0h2ZouTTuqsHQH79Iyvnuyrcz895fIiJ:wCD2rnuqsHG79IyvnKRy
TLSH
T1D3638E87A2A44247DA97B274C5736F56FBB0F6521902534F61E8C28E2F13791C3FE622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_decimal.pyd
Size 273KB
SHA256 90045140e45edcfe4f4859b3190184faff1249220011330a9d01319745766607
MD5 90071379b9e53b2d1834d49f4fd804ec
SHA1 c4cde25cff9cbf90c55bf908bdaa8a14a82311ad
SHA512 a67feade76fda58faa8a9842f6a07d8b12eb477c5baaf51f323de90fdcc8c5f62f2a756f30e1ea494b95eaaededbbe95f2aaf6659175e6e141057af0aac6f514
SSDEEP 6144:nkzuKqPj7/lk9VLCLko0Xoy9qWM53pLW1AyH3V+METaei6g:nxLlk9VmLko0Y7ePXV
TLSH
T127546C97A2090CA4EA738474D95B9B47F7F278960321C78F43A48AA73F93393636D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_hashlib.pyd
Size 68KB
SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
MD5 9ec1021fa8a3c252e1f805ac7f172753
SHA1 773a3069dfb3711cb6f07c1c4dbfbab8b7c779d1
SHA512 0940c59f5c1c4afe5457d16aa5053aa7e27de1ac2748de5a0614ec01d630f76d75a86159260a6c53209d098da16d50fa0c4ee3427c04a38180fe9eccc4e6b034
SSDEEP 1536:R46Ee9w2oW/Sd9/LOJu0PuaY9IyvIWyrcz89RfIZRVjE:RdEIoRF0PuaY9IyvIS3ZjE
TLSH
T157637D95AA884091D92382B5C8E34F43FEB4F25217119BDFA3A8C18D2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_multiprocessing.pyd
Size 36KB
SHA256 7b21c5b0ebee82b0d85724f245857d65e23f82c6aaf392efcd4f800462025d92
MD5 25fc0102fdb08c54e6bd72c0b11b1a4c
SHA1 2dc0d9a3bbcfef184699c147ac2cfa2fcb40a7b8
SHA512 89640ff838030ca75309184bcf1ad58a8ad3a917564a4185675bc7494630bbfc5b821dfab53081b5a786553aae89958b057c369b4d56af12ccb0fcea983e3d03
SSDEEP 768:L+hu80ZnR2VcZ7Dz2dtIyntAXyrcEOJh2Ip4i6Cxf1mlY6Ce:Khu80Yu7Dz2dtIyntSyrcz89WfIie
TLSH
T122F28D4AA6684053E963A671C5A3DF8AF538F7831B21864F7195D2CD1E33381A36E34E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 87c8e57e1fc1bff7cf9dfff06af1bdd43a67652ba96d4c35d14e5f22bd17164f
MD5 8187af82ba3c262c0856509fc7e88992
SHA1 7f5461c80a71e24a56a9f15aef7762903bf58cb0
SHA512 5de09cbbacd169b271a51b81599d1e7ab3d2c32665afaa6ea28d759257a8b773a7f5fcecdfc2afcaf073fb2f707689d2a6e7c2493946c7da067810a58a7e6cc1
SSDEEP 192:7rO8hWOhWyyW1c31DSdVWQ4WWhD0LzxOhJNlOCgX01k9z3AW78QYd:7r1hWOhWh3IdXzxIPaR9z9Sd
TLSH
T1CBA24A928EF88502FD5A5D7042F8DA937C3DABD71950909726E8F25C18D33C6EB14B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 fdb29afc4ec3585586d8415de087d6c6993c5a1171f57dd5185389eca33ba948
MD5 4890901924f515b4b91613a4d95adcb4
SHA1 6d73c6fa1829f3b2fc4f30d48ace08cfd07c7340
SHA512 9b1353cac87275506b73f51bc4154bfcea35512776dd58b6ee277b71d7dfbc4be3a06a9135a28cb3145cdabc1bd7a4a93a70d8cbb7bfc773c4394ec692db7c02
SSDEEP 192:yAWOhWBWjKMaKVWQ4iWnNJnvM30LRLLX01k9z3AXeRUoC:jWOhWpK6NJkELRPR9za+C
TLSH
T152A22B82866C8043FDEB6E7042A8DA837D3C67D72910D07616E5F58818973D5FB20B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 4626ba7d6181906a130cb32a965c33d8f41940b23ab2946b51da3eda3f5a1d99
MD5 e4e3fae385155e2639f0962e0952b651
SHA1 e9c8dbdd8f3af958758d8ca4611af2cd97778c77
SHA512 cd51d830fd10327b0d4749d32d888f498a5c85364fe5a26595f7dca781a436151836980b62c26a409d6d483cf7a2c0ae7e0fbaaf3e05875406eac0fda9f17509
SSDEEP 192:DWOhWeWjKMaKVWQ46WYFZlXefqg7i1X01k9z3ARsIJOdxpn:DWOhW+K7wR7i1R9zlIu
TLSH
T13EA23C964BBC8043FDAB6D7082E8DD877C3C23C65A10D5A616E9F55814A3385EF3076E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 8289c551e17e2648bc5384e7ce4787ebea452c10e799e6da96cec930885c7584
MD5 a38b31502f49e8e38abfffab170179ae
SHA1 8892398ede2732854ed6fa09d85bee5c7c0a2a7a
SHA512 a85507558d869f5b1928ed5a5b7048b0add8a54f4e4f0be07e0fda13797982a2d4cc9bc9ca6d5b8690f4511eeb653dfab39df59ecf2da418ce6519b394619c05
SSDEEP 192:j3mxD3MQWOhW9WjKMaKVWQ4WWjdMStCYl6d3RX01k9z3AQXHdjs+j:j3PQWOhWNKJ/YlORR9zbL
TLSH
T135A22AC68BAC8543FDAB2D7053E8D9837C3D67C7091090A646D8F55928933C9EB25B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 acd898771c674e63b0f3e67d98826c93143b391ae8c58563c2da7b98475ced14
MD5 86c236eb806d74516e70741f15993958
SHA1 7a1efce9213df001d8dd76fcef3f308e7dd2a33f
SHA512 647f6064cc11784804e76d52da0529c3ee130de0ca8effefb53ef4bc542493523368a89c805faa6d9cbb6dfa036ce2239efe863fea23455da6f0206e34c551ad
SSDEEP 192:uWOhWnWjKMaKVWQ4WWIn0lXefqg7i1X01k9z3ARsAwHWR:uWOhWHKzR7i1R9zlAwHK
TLSH
T1E0A22B9256FC8043FDAA5D7042F8CA877C3C27C71E50D0AA56E5F5582897385EB30A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 22d8959cc8e03078e28b2140911803368993cf4750743cb5e4011fc469dc1dbd
MD5 f724db231d8cff54ce45d4b0f6ee5034
SHA1 e5ac09bcefde835248be068de5e2d1e359d83b90
SHA512 5a84c84be9b6bc5f58592acb29cba3abad0ede7fadf10fa16897eda51d27e3c54fab6332cc316e61ad9e80e7b84bfd4394399722756bf3c75ef9d0bf7f20b7de
SSDEEP 192:FwhDPvVr8rFTsK3WOhWUWjKMaKVWQ4WWseZYl6d3RX01k9z3AQXQ:GJPvVr8WOhW8KLWYlORR9zbQ
TLSH
T1E5C21A87D9A4E29BFC8F9E7151B6C9436C3943C6001080CA1BD4A75D3CE3387E3A899E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 3b114c3944cb6e0c4f43d4a90248f8bf0ee0230a2096b788f2a2b3f12b59c458
MD5 8d20de7a494edf18e8b00f403a3b9935
SHA1 4d40ef900b909a47734e5d996d2eb5df4eef1ba2
SHA512 2c491a04ae1baf81833f73190531235edc0731ade2923244ff9203eb57b4bda30b2a66ae154bc0f9f1bf2db70d6ec4647523b0ec227f2d1b8cd8a5779adb90e9
SSDEEP 192:NbohWOhWrWjKMaKVWQ4iWbSbp81BHX01k9z3AD93Zv:N8hWOhWzKQSbpIBHR9z03Z
TLSH
T1D0A23C9586BCD143FC5F6E7043F8CA877C3D67C61A4090A616E9F58818A33D5EB20A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 950a9c745e331fa77a46696cc85cdc6556597428392e65689acaca3177104e3e
MD5 49c87d73955e1742818384e2be3166d4
SHA1 6d411645df35feb2618f53ac874c5c30f7b61ecf
SHA512 a05f3ae68cb539d4a9117a3519ff5da090a5671372da44e98e4bc6e9d6f1979d8e01038186e1ec2eec626f5f768e96d066799f38ce20a588f8eef375985e9150
SSDEEP 192:bOtWOhW/NyW1c31DSdVWQ4fGWhDNPIo81BHX01k9z3AD93ZqTz:b8WOhW/83Id+TwoIBHR9z03kTz
TLSH
T19CA229D2CBAC8107F86E6D7043E4DB837D3D6BDA194090A616D5F9882C933D5E72472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 8c0df823dc018907436f1bc964b1073f41241fb1fad633f75997b9324d311f65
MD5 0ea049d5d45e8a39102515ae8a9d4adb
SHA1 a2ae08ced173dc6f114a2f6af4b58652576a1104
SHA512 4eb99d91b2f4d4f16b6640cf0c14c8d71dca83a3ac30bb4453890291ca2b4f9c93598a329baf059e539e21bbad4ce12b3bfa1144f34d9a2a481d5c06eaed258f
SSDEEP 192:MTxlu7WOhWCWjKMaKVWQ4WW7UvpGX01k9z3ASMRcwfgs:MTxlQWOhWqK88pGR9zu+s
TLSH
T17EA24CCDC6B89003FDAE5D7043E9C9833C3DA7C61A50906616D9F19828A33D1EB34B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 c0188b846ca54fd398650af690b55d713c06b0c2570c3d2304539ec15d4667cf
MD5 2e828a71e81695288f792904e77e993b
SHA1 56c053fe9fe2bd59eea3e8b17d085dfd4855efde
SHA512 76690f6145ab2e6ea933fcb381788d7b64be13d3f10cd6cf82adfb77633e99b9f8a2249b7d85a309e61ebec7b8a8e8cd8cf79374a24afbcefa5bc2cded292eab
SSDEEP 192:RbrWOhWwyW1c31DSdVWQ4WWhg4CizxOhJNlOCgX01k9z3AW78Mnscy:RXWOhWL3IdL4CizxIPaR9z93nsb
TLSH
T146A2399187B88143F9AE6E7053F8DA937C3D57D71A50906647E4F18828C73C5FB20A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 7c66dee567ba583d242f87d442caf38c0ce95bb1d36cd2bd74825c44e54d9078
MD5 652a4cfb048a238be32b27e500f58db4
SHA1 2e45f70f3655a5b876df913e0a00debd54e96196
SHA512 70edef5a456b12efc2b336e3b8abebf812e0a04c10214ccb91616d7edd9574a3168a399ee2d6620595ff631ed499af402407637d8b9503fd86522e958d76d664
SSDEEP 192:9TvuBL3BBL2WOhWYWjKMaKVWQ4fGWb7nvM30LRLLX01k9z3AXjHlQ:9TvuBL3BgWOhWYK+7kELRPR9zapQ
TLSH
T117A22BD6866C9143F8EE6D7042B8CA437C3D67C74920D47A45E9F68C28A33C5E720B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 4ea560dbe8a2970388fb0d738b47e65caa417a2f187e3a9827b696ce01ab41eb
MD5 95305b43167781bcd0a09e0cdd0c460e
SHA1 d1f6c0fdcb562250f23f5e083d68bd5a4d1e3531
SHA512 a6b10fd2d377cd164400c295f3d02e4e93822d0f3d0ab1cf1c9e65620ee702a6055d537f374a967efa5b4db934d843be53422aff3e2555ce808a04c3e05c82a5
SSDEEP 384:InaOMw3zdp3bwjGzue9/0jCRrndbT1WOhWV3IdWejUK9WR9zPR6s:ZOMwBprwjGzue9/0jCRrndb3sJb9zB
TLSH
T16CA23AC2C6A8D307F84DD971706BE9433C39678A4422D5A617E1FB2838E3399E76472D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 68bc19911007ab92d263cb40277a6afc084ca413178ad40b919302b7bbb14b38
MD5 2e2173e37391aa5a4ab87b7a3368b8ef
SHA1 579ca7e47099fa41f32694bb6c37accf56e3e528
SHA512 2ac89f1b1224f2dbc027b901f9f5ae447c45f63e21541be576c9f5a9dfd2f9943009a31c7a8c70f1d349f4f3d5ee4461f9736c02945d762684396c67267383cf
SSDEEP 192:KrWOhWmWjKMaKVWQ4iWu8NunZMiuyCksX01k9z3AkT1sUhYT6:KrWOhWWKQNviCksR9zRTKUhYT6
TLSH
T1BDA22A858ABC8443FC9A9D7143E8DA83BC3E67C65950846653E4F54818D33C5E720B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 045bd4b41c0568fc916a21cc366da93597768d8ead45411c244cf98d605dbaaf
MD5 97cabc27a07f91f2b2227bef71e9aec9
SHA1 d2f42e05c753bdd0e247cef064b78c6a22cb74f9
SHA512 5c58479922c39afebeb316183a1f53b46c291b3e27ff7a46f7ab7dbc2bf3f209edde278ae9b98d70cdecba708aadf6c82a17070aab7ae1f709ffda66b7d7383e
SSDEEP 192:utWOhWnWjKMaKVWQ4WW4/Yl6d3RX01k9z3AQXZ/:utWOhWHKRYlORR9zbx
TLSH
T1C1A23BD6CAA88183FD9E2D7043F8D9833C3D67CA1510D46696E9F95828533D1E73472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 86c8c545c8f358cbe9b822c58c6af3fe00078af0422af0e391d32270cc6d8921
MD5 17ae06f09d6f8e8472284d3b200a9255
SHA1 f7f34f2b508706019d4a0d43253c4c52d97a063a
SHA512 cdd99a8be58a207fab4102512728c7b4dcc0808450b8883157039b8ff2cb862bebc52a1c57f09e3b6086cdc7d70e4edc31789799d88bfd9901f30645c83ff175
SSDEEP 192:HgFzVWOhW5yW1c31DSdVWQ4WWhuAYl6d3RX01k9z3AQXnqwj6k3:AFJWOhWo3Id4YlORR9zbqe3
TLSH
T16DA22AC68AF85103FA5A2E7042EDE5773C3857E71D00C46A46A8FB592893392FB14B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 ae2b8199066cb22395180d86bdc955dc2d33a6bd8d64b61ba77573d1e78b8d70
MD5 2ba1a2fb698e9ab8e8bea55d0a27484c
SHA1 c907e403ca235a827b4a9ab09904a6553350489a
SHA512 ff2377ad6f781b5aacc70e50d58e9ecd6b6139ab67458861bcdc1a0544286e77f2be9d78db6c48fc23d07501a307151153d5c4a46759682b5c14f71802325b1d
SSDEEP 384:0vgTfNck1JzNcKSIWWOhWUKS3u0R9zqx8YySsJ:0vgTfhcKSbFu49zW8y0
TLSH
T16CA21AD685AC91C3F88DAC706295E9537C3E87C61929C47206E8E5AC3DFB3C1D23466E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 c27e4c79489c6be0eaaf7b082792c95ff7bf8adc4f67cf65f7a1a66d03c9bb87
MD5 53721c327963921562591ee955ea37f3
SHA1 c74f8ebcef008c757912432f9eb780c2fc060e92
SHA512 9f12ddb066952bac264e536724e8ad7f3ae9f36dc61490bff7b4e7f11abdd8b54f0f5e136860be466b413dc5119ddde4f1276c144d7fef2ac629d034b889e5a1
SSDEEP 192:e4DfIepWOhWayW1c31DSdVWQ4WWhOCjlXefqg7i1X01k9z3ARsaD1nsi:e4DfIepWOhWZ3IdIsR7i1R9zlMnsi
TLSH
T1FDA24C9186BC9043FDEA5E7092F9DE473C3D67CB1A2091761295F25C2CD7385E71062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 0a422b5f26d89e799f0e80065c5738829ac476765613198f8b142b62753b3be7
MD5 c5d1422c998198f97ad43202da30cb9a
SHA1 26bc3407e92ddbc06ebe29eb7e264457787e8f19
SHA512 4b7f097d3d50ab0ad9283a3ffe140a5e43890cb4b6edb998b88a74be7ceed101235a379e805c008bcb2f12b3ee9fe4a93b3e8160581fe15608f7b6a74a3fb8fd
SSDEEP 192:LFWOhW5+1yW1c31DSdVWQ4WWhHAZ4WXYz1X01k9z3As7R4IHW:LFWOhW5d3Id8AZboJR9zv7Z2
TLSH
T192A23CC5D7A88003F9AA2D7092E8DA837C3D77C75950907A56D4F18C1CA33C5EB2471E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 e7e3f289510fcb895b22b756f64e596a4a736bf3e7cae8e71e393680dbb80f02
MD5 f96fdc9c9419dc0921431d902aa6fe44
SHA1 760b337a40534163f4531e53131b228de48744bd
SHA512 f5e18a6519b417d13d4b8fb28c8779f782e90c147c2aa42792e0104e415a19ac408fa70218f7e872f57e1fd3002296c03783071513892c900f465ff524298c44
SSDEEP 192:NGeVrWOhWjWjKMaKVWQ4WWUiWXYz1X01k9z3As7R4I+G8D:NGeVrWOhWbKFhoJR9zv7Zg
TLSH
T158A23CDA96788043F9AA6E7043E8DA977D3D6BC31954907619E5F1881CE33D0FB30A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 96d361bad0f010b1c815cb536cebdbc9cfd1034fbabbd43b612827b2d464de60
MD5 db1c0d370bfa86a2485b52bd353131eb
SHA1 c4cea93c2c699639083d76d699458ba85c6d86c3
SHA512 1a1f85856dba81d1f8ee6a71d001f33d5b9b56f4147dc65744dfd08de64c12ff972b82f3380183cc8b741189ef5c3f4febd587578a40b4539a88defd1308da2a
SSDEEP 192:vGyMvrRWOhWHWjKMaKVWQ4WWQX9qLrRGhFKeX01k9z3A1x8Y3ISn+3PDfK:vGyMvNWOhWnK/tu0R9zqx8YYSnUbK
TLSH
T1D3A22B9796AC8043F8AB6E7003A8E6937C3C57C7592094BA56D8F5981C933C1EB20B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 e03d483fba05a5a50ef3ac414b904b2ff24ffbed08908b1e7f6a9416f9711856
MD5 c895035f3edc0b27d9d09c8ed07b4c25
SHA1 739306373e9b0984d47f454a48d4960606213d45
SHA512 718daa70997b1e504cdc3e113ef76873ab68908ae97c645c3edcd31ab1dd2482aaf3b0843df9c2e636aa6505294f31795536bdfabe9b0d69bd10cc36a6ff8cd9
SSDEEP 384:j2widv3V0dfpkXc0vVaseWOhW+Kko7R9znGmAvZ:aHdv3VqpkXc0vVaHK9zQ
TLSH
T1AEA22896E2E8A583F8AFDDB046D9C5436C3827C60A10D47759E5F6583DE33C0EB24A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-synch-l1-2-0.dll
Size 21KB
SHA256 e67f6f15acae34dc5ef98de01d89466136232ded7305da22d2f0a454327ad079
MD5 f76d64415e9dbba0e1b4cd2616fdd260
SHA1 dea3b85c77201e55925bbd94ea4bf386d4d1847b
SHA512 947a8ea7fb87b3dfa13e4efeadaeca29995d0d1cd4814e9c6c955f705e0726cd4dfa04fe23438b9bebc9fdae0ec5fb9cd62261b410854c87c3b6bc4b6acb6290
SSDEEP 192:2tZ31WOhW1DWjKMaKVWQ46WX7S9qLrRGhFKeX01k9z3A1x8Y9S5VHA:2tZ31WOhWlKJu0R9zqx8Y9S5Vg
TLSH
T101A24B9B8BA88583F89A9D7047E9D5933C3D17C60A50986A12D9F15D2CE33C1E720F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-sysinfo-l1-1-0.dll
Size 21KB
SHA256 af3f19f3ae063e4fb687242391df2eda6535c7c490b38b0a6870e07c6ddace99
MD5 a4018a4d18e2673a96e07ec9dacea376
SHA1 377c99fed890237e4101eeef1e22e4078732d407
SHA512 b670a37fba1613a704e1bab54b30e536ad3bd03ca5db43b5f3d0e7ef85f7e18be795aee6579a45846754bea5525fa589d5fa09cfbceae30a5241fdd98e433ef7
SSDEEP 192:7gdKIMFgAma4WOhWRyW1c31DSdVWQ4iWhe0DtagQ5X01k9z3ASuGtT/nU7g:IvA74WOhWQ3IdX0DtdQ5R9z1uGx/5
TLSH
T153A22BA2D6FCA103F95E5E3052D9DB433C386BC65914C46A02D8F65C6DE3389EB2463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-timezone-l1-1-0.dll
Size 21KB
SHA256 10b56211a2de348342c0cf4bcd2c91c53a0656f9476b6c0f02af88c29f392841
MD5 32f08d809d0dc16e2bfd2b728c22bd71
SHA1 3adde0e757cbb46c72687c414ffdd06d922249e5
SHA512 71c94c0b3e08b1a1a92a2b866aae59d81806ba3bf8a8384576fa1acc9ef1d42a81856dc872277fb7f9b09cb15da1061fa80f0b0085f649dd10806afe115adcfc
SSDEEP 192:yFg/rLWWOhWRyW1c31DSdVWQ4WWhhCFXYl6d3RX01k9z3AQXpHb:yFg/rLWWOhWQ3IdwCFXYlORR9zb5b
TLSH
T1B3A22AD7CBA84402FD9E2F7083F9DA537C3C67EA4910D05A55D6F94928833C5EB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-core-util-l1-1-0.dll
Size 21KB
SHA256 a46b6708fb8e5ee9183037a479b0896552785c598d99a8339e2a05e32ea23d0f
MD5 1078e979f95d90d8b2c0168a65980cf1
SHA1 a4e3266efa2638dbdcf3f640b361e7655f6afd3b
SHA512 681399347c4bfa809f42f30218612a1a3d10a736ca7433d926a3c84b4bb72ee023286b1603533405e8f870f9b76f5926d20cb5509c20c7a59219d6d1964863bb
SSDEEP 192:4WOhW3jyW1c31DSdVWQ4iWhGRINFPKBWX01k9z3A/o0KE+9HrR:4WOhW3+3IdrR8KER9zGo0DeF
TLSH
T126A239C64BE88003EC9B5D7042A8DA437C3C6BCB6950A0A615E5F59C2C933D5FB24B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-conio-l1-1-0.dll
Size 21KB
SHA256 ee81ab5e33d73561172c2effc57272daa2b8e9297d30e20884177dd964fd3137
MD5 e07fc132dc931df3c80d305c108639bc
SHA1 70c1f4b936987677215e138a8aa7fb9fd3290baa
SHA512 ac5af4abe9079b3da2e606b4d7a6389e28fa74995b0232a43ac128a1d31799c3b3c4ba75df21006f3d9fd0a1db8a08b91a28843b5996d71fb3c42fa67e22577d
SSDEEP 192:lGAWOhWIyW1c31DSdVWQ4iWhI3PTINFPKBWX01k9z3A/oScX1:zWOhWT3Idh3PT8KER9zGo/l
TLSH
T1DAA2288712EC5A03E85B5B7092F9DBC37D3867972950B06645E5F86828C33D9FE2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-convert-l1-1-0.dll
Size 25KB
SHA256 69e6ae713da2e6dd587aee3f5192d72ea2a37b352b123f8462c6d60f7a1e0fac
MD5 185000e4e14e154d795eaf6dc50fe01a
SHA1 51b75d791d5590436a0274cc88518e43dc335ca9
SHA512 9291b2e2a309ca90a3c45d7a510bd2a01fe39306b41a33ce953fb86276e08b45985ff37a47d05b0cb339a880fb1ab4ed1457d317e098f024ccd108a393e6ac9f
SSDEEP 192:X9cy9WOhWjyW1c31DSdVWQ4WWhJD/zxOhJNlOCgX01k9z3AW78RS0:qy9WOhW+3Idq7zxIPaR9z9i1
TLSH
T1A3C2B44366E46F66E99F177221FEC7E32A381B82259043B5C243E54C3882782BD67C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-environment-l1-1-0.dll
Size 21KB
SHA256 6a951c49959f820c55b0884fe74723aaaa302a13d93ec9c6c5db21a703af34de
MD5 9a6b5084d1bf25f21e8bcc8bc1c530c9
SHA1 f4a226309cbd98b730110b43818f0b066dbd547e
SHA512 fd036693601e536fc24d5c6d259dcc747d5becc13d84e960e885c0368af576ba3b9e57dbddf8bbd76e11bbb7528adfd4ef366e910528aaa8642ac2bf093cf2de
SSDEEP 192:8WOhWUfWjKMaKVWQ4iWXGINFPKBWX01k9z3A/orUnqlJI:8WOhWYKH8KER9zGoAH
TLSH
T1D0A21B864AA84543F9DB5D7082F8DA537C3CA7CB690090B656F9F54828933C5FF31A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-filesystem-l1-1-0.dll
Size 21KB
SHA256 90d420f9193daddc9a577ce5f37d043de87ccd25967e2a9a57492394e62bb5ae
MD5 b48053ec7f47c651ab8d966b08706fd0
SHA1 d765c5a2bcf33cc6752ff21a2150070b196f4888
SHA512 880b64d2520eb7fb7cf278098b1f809258ab8f2a55285faa37464bd207e6b51c3c2f517136c2c51aedeb238c4588bd36a7405838b88118fcdf477ca88d9aa2be
SSDEEP 192:YEpnWlC0i5CFWOhW9yW1c31DSdVWQ4OWhN2rCtwZNU6nq9bFs0X01k9z3A/Fcm:JnWm5CFWOhWM3Id8FyA9bFs0R9zk
TLSH
T13DA2188356D46E13EDAB0B7242FDDBD73F3D2B82058292A29056F41839E3381BF1596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-heap-l1-1-0.dll
Size 21KB
SHA256 3bd8121250a67f5422b2ac2a3af070016ea0bd26e56ba36a81ff6665b936fdd2
MD5 b9042ef21ca01b7f75df56fcb1968f5b
SHA1 77aaa20229b8d835ffbbbf6088d7cfeb4ba14ac8
SHA512 f146b7ba4d9875e821dbea30c95148c2a8b61bf75fb6d2a6dd0dbe21b5fe14a5af60a8f362cf1e4befccb35d1732a55fbe932b38c587499993f89f442cfb1f59
SSDEEP 192:xAh8Y17aFBRgWOhWtWjKMaKVWQ4KWKVzlgnKug8X01k9z3AIhz9nKab:WL9WOhWdKxl8BR9zlpv
TLSH
T1ECA23A9299FC9943E9ABAF7062F4DB973C3A57C76A00907341E6F5581843380BB3162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-locale-l1-1-0.dll
Size 21KB
SHA256 cd557478f332ab196f81d274ae433c83ddf95cc9ef7579077fc31af4dc761f58
MD5 d9735a15d348498c924619ae4fb9dd26
SHA1 ff7be58540ca929a479998acad19f74386060893
SHA512 88585b07ae35be4b78896d7222d66fef7280ee2f5304d19c55377011538f9bc4129f0f67d070bb76feffb725a3e92d5cd653330f144397fae0207365fdddcf9f
SSDEEP 192:cwzWOhWxyW1c31DSdVWQ4iWhtkpCj9BtaFFX01k9z3ACR6rA:caWOhWw3Id5K9WR9zPR68
TLSH
T19BA22B878AAC9003E99E5EB046B8EB877C3D3BD71501547A12D6F55C2C533DCBB28A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-math-l1-1-0.dll
Size 29KB
SHA256 1a5092b4e489c89b5455258169ff25f31d5ccde589989fce64092b8d7cd9d45b
MD5 19cd6354ac6752ac3f94ee0787677d61
SHA1 f2002bd93b3736fe980560a9e77a41d6410a83ba
SHA512 886e74e5438919323cede30b47c9e5cbdd81b1025d0997b702535d87ada920dcb97efc886e6059e25e4ad00e5dd6255e8aff7bc03b90f6899a871ba46ee3b871
SSDEEP 384:Y7yaFM4Oe59Ckb1hgmLJWOhW63IdbDtdQ5R9z1uG6Xi:WFMq59Bb1jf9Eds9z19yi
TLSH
T1E3D206474ADCFF53D68F0BB701F08BCE69381EA294D1B6B4D94BA08834623D47E53A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-process-l1-1-0.dll
Size 21KB
SHA256 21a538ef083b282739fe98f078ca1ce141b0f81554fe624d363c8b4a297d158b
MD5 cfe90a8d005498d50d87804ffb6e00ca
SHA1 f7dbb6433ae62261a60cd12ae9289cb91a087450
SHA512 0a964c83f580869efbc6ee12b6408feb13cffc7154d9c39055628cb43b9618a82adff608da3e1aa08632a68fdc3d10a8d21395af366d38271f801d31639873c9
SSDEEP 192:NeXrqjd7dWOhWTdyW1c31DSdVWQ4WWhG5eWXYz1X01k9z3As7R4IW:N4rEWOhWo3IddoJR9zv7ZW
TLSH
T1AAA2098B96B89842E66B1E3082F8D7C77F3AA7C359409175D596F14C3853385BA3062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-runtime-l1-1-0.dll
Size 25KB
SHA256 7300fbff1c371d248ab748a9b20484ee8204c82041e80b691abe9734353dd47d
MD5 65b9d906310823286abd3d89f2624de7
SHA1 b25090c36e0a9d829b75494636ccac804bf4e4b1
SHA512 59f5e960cfac9f2f0d17b4cd4b17ffd6fed2a5ac9314bcae1599e57fec1b4c40d5aff3498ac68f1a35dc8e8ac9635dfb6b0ba17f92119cc7c8279df0d5ce5c98
SSDEEP 192:JmGqX8mPrpJhhf4AN5/Ki5WOhWWyW1c31DSdVWQ4iWhW8NunZMiuyCksX01k9z3G:Jysyr7XWOhWl3IdSNviCksR9zRTKFS5E
TLSH
T16BC2E7838AE86F13E98B6B7312F9D7C71A36638626109575D993F08C35C3784FD1720A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-stdio-l1-1-0.dll
Size 25KB
SHA256 01a2fa8bfd1bad090c0ecc227663c21b343ee843f617cd0c039da930493be901
MD5 6e0d93bd30f3902c389c75f8272ec2b9
SHA1 2adac500586deea740544717327d142d1df7d53f
SHA512 feefe380a1ca31e05f0de5de209da7836f29724f35059dbd7ca603aded03fb0c5630c47ac48a2c2a296682c9ab2abcf0cff6ce4046ddc72414afd252ac9419d6
SSDEEP 192:gDV2OlkuWYFxEpahLWOhW2yW1c31DSdVWQ4OWhtkQp59xHLy2j/X01k9z3AkmOP:oV2oFVhLWOhWF3Id2tpOE/R9z/xYP
TLSH
T1A5C2E68391EC6F02E68B47335AFAEBDA1B3257833404B179C547E9943AC6389BE13159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-string-l1-1-0.dll
Size 25KB
SHA256 34837d23079efd40377722266c69c9159710b4f2805ee57968c75025e9f9b1c8
MD5 1143ef4b630f424d659e71492cc4c4b4
SHA1 41d4b7182bace3fc34cb9985ac2b4c8348b1fc87
SHA512 2ef55bd31dd38cdf424ccb8c3700bfc7f6fc9ab1800636f7558c9f625633f36951ecf3da2698bcca539ddb102126dd8028ca1df47f700edb3be5cbc323b6667b
SSDEEP 384:7CLx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWOhW9KUYMTR9zucBW:7CV5yguNvZ5VQgx3SbwA71IkFuvg9zNQ
TLSH
T1E4C2E74346F83F42D98F57B345FACBC62A384F8615419375D4B7A08C3842796BE6BA0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-time-l1-1-0.dll
Size 21KB
SHA256 b4df98e42f93fbf94a58d1924850d58f4dc6f280207c1e2b7911cf11692f65c8
MD5 f03a05a55369ede7562af20658a18b14
SHA1 8af0c8c27003ab2f54fba02f0a20366320c2e48b
SHA512 f6a90577ab2537600bee6e74916cd490c37c68022f5a0a06e0f6bdd77b34c80af32347012643ebb13eb5035ada799b949e5109fa0cdf4f5db7206f35c743b34c
SSDEEP 192:nGhwDSWOhW//yW1c31DSdVWQ4fGWhiEd8NunZMiuyCksX01k9z3AkT1sjYCRXSMk:cWOhW/63Id+8EKNviCksR9zRTKPSM
TLSH
T182A20A4396D4AA0BFD9B5B7102FDDBDB7B3417C21AC07076824698483687384FE2696E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\api-ms-win-crt-utility-l1-1-0.dll
Size 21KB
SHA256 30eab6b13258b545642972d2a1bd1916cd3d1ee109f6c0706bfa0d1752e2e6af
MD5 52e974bfb8b4fa7e152414f1bb10fbf0
SHA1 eba15aa9cd128883743ba0ce96e2c378acd9440d
SHA512 0789af2638b1097ebc8301f7daf01b2c6517ba87a09897e023bd68dc129149f410fa57d714ba8a87bf02294845137f1be2d546c8b97399c9b9528333b1a7bf7a
SSDEEP 192:WpI/fHQdu/WOhW8yW1c31DSdVWQ4WWhtUZWXYz1X01k9z3As7R4I5bKK8TKG:KI/fhWOhW33IdwUMoJR9zv7ZoKgKG
TLSH
T11FA22C974AA8D503F6AE2F7082E8D7C33D396BC6551092724596F54C2893790FB3161E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\base_library.zip
Size 1.3MB
SHA256 4726f618b8da9a1dc3f4f708384ebfdd1e4301627ea4ef0fe833b247f2f70bae
MD5 f3f487e255e8a1cb880507510f7c79cf
SHA1 21cbae103cf710d5b15ada914eee998ef9a297e3
SHA512 3979c1abefd178c5cbebc42275e946eeda772da969800d7f419c2790efc56ebc74e8add5694479d368757715a724d6ecfa01b78381242ea5887c67125257c7f5
SSDEEP 12288:F8imqhTmtYzGNcT1QDwtydjdTji2cPPdxhYrL+DX5UW7Wp+PuOBa80201jwCVRDP:6qBSeT1OfdZj5cPPdxhYo7WpKzyIu7
TLSH
T102551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\pyexpat.pyd
Size 199KB
SHA256 567f19a92479e66b652ffaadbddba26b7c5dda43d5e97c67a4a76a076021b736
MD5 feb79984518146b9703d3913d54f2106
SHA1 6a4eb8d7e593f008308f05bf26f7caf7d76a1716
SHA512 4b5a67c38aa149cde71ccc1171cd55af8a12a66d514f63fb543005d9ee8f19226f839d28782187a0e46e0f205e3307e4e0739e1b2bd64c0e99e0af794c1836e8
SSDEEP 6144:xS4jcle1bq6XFdTW4yxB+LjrKHP1XcPump:Fclaq6wT1Xaump
TLSH
T143145C4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\select.pyd
Size 32KB
SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
MD5 e5728d041bfb1841fc460db4027a2952
SHA1 71e6aaa90e905a72ac83450796af4fb2bb3503d7
SHA512 a53efe3872b035445b7d66a71dffb690cfd00ff6296af25d0dbdfe92c904a8d06442c91e9638b2d5e54420f6998220d65f39b35ef3c1a87e812e9deea1967ab9
SSDEEP 768:hCOFHfRme5Iy9GKXyrcEOJh2Ip4SBITxf1mlDeI6QKF:hCOF/Rme5Iy9GEyrcz89+0fIUQ+
TLSH
T191E27D8AAB245047F9A2C97185B6DF43F939B7A34B11829F30A5D2990F137C1F73A394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\unicodedata.pyd
Size 695KB
SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
MD5 0a3be15d03e1c55c4df0c7e4fa4005bd
SHA1 a8b30adb77dccd9b7bdc1ec3b1800127e586e3f6
SHA512 2a408d178dd0261dfeccfb791fe05a40caedc64b7ad6cd543fafd31d1e676721240020ad43f26cd8adf94a8c3e68522fc96ebb0f987fe0ba15b9287aac1242b2
SSDEEP 12288:aYgdLI/X77mvfldCKGihH32W3cnPSqrUgu+f:aYgW7qNxr3cnPXu+f
TLSH
T11FE4F6D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_omjbsdyl.rkb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_omjbsdyl.rkb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5284-141-0x000001FA32170000-0x000001FA32192000-memory.dmp

Download

memory/5284-141-0x000001FA32170000-0x000001FA32192000-memory.dmp

Download