hxxps://github[.]com/nitaybl/ByGoneSpoofer/releases/download/4[.]4[.]0/ByGoneSpoofer[.]exe

Analysis

user interaction
yes
max time kernel
70s
max time network
331s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/nitaybl/ByGoneSpoofer/releases/download/4.4.0/ByGoneSpoofer.exe
Sample260804-ppcfhsen9s

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4904	wevtutil.exe
3676	wevtutil.exe
3496	wevtutil.exe
420	wevtutil.exe
4316	wevtutil.exe
556	wevtutil.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
36	3732	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
3396	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
3396	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe

Loads dropped DLL 46 IoCs

pid	Process
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4456	powershell.exe
4364	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
127	raw.githubusercontent.com
121	raw.githubusercontent.com
122	raw.githubusercontent.com
125	raw.githubusercontent.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2236	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2784	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3336	cmd.exe
3504	cmd.exe
2852	cmd.exe
2792	cmd.exe
4296	cmd.exe
4020	cmd.exe
4888	cmd.exe
4572	cmd.exe
3844	cmd.exe
4464	cmd.exe
1648	cmd.exe
2596	cmd.exe
3536	cmd.exe
3804	cmd.exe
1972	cmd.exe
2732	cmd.exe
4404	cmd.exe
2552	cmd.exe
4964	cmd.exe
4260	cmd.exe
2736	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3732	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
632	ipconfig.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3252	taskkill.exe
1868	taskkill.exe
3852	taskkill.exe
3960	taskkill.exe
3384	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303202250144426"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{777E6A83-031E-4892-8101-228001B062B7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4456	powershell.exe
4456	powershell.exe
4364	powershell.exe
4364	powershell.exe
4456	powershell.exe
4456	powershell.exe
4364	powershell.exe
4364	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4728	WMIC.exe
Token: SeSecurityPrivilege	4728	WMIC.exe
Token: SeTakeOwnershipPrivilege	4728	WMIC.exe
Token: SeLoadDriverPrivilege	4728	WMIC.exe
Token: SeSystemProfilePrivilege	4728	WMIC.exe
Token: SeSystemtimePrivilege	4728	WMIC.exe
Token: SeProfSingleProcessPrivilege	4728	WMIC.exe
Token: SeIncBasePriorityPrivilege	4728	WMIC.exe
Token: SeCreatePagefilePrivilege	4728	WMIC.exe
Token: SeBackupPrivilege	4728	WMIC.exe
Token: SeRestorePrivilege	4728	WMIC.exe
Token: SeShutdownPrivilege	4728	WMIC.exe
Token: SeDebugPrivilege	4728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4728	WMIC.exe
Token: SeRemoteShutdownPrivilege	4728	WMIC.exe
Token: SeUndockPrivilege	4728	WMIC.exe
Token: SeManageVolumePrivilege	4728	WMIC.exe
Token: 33	4728	WMIC.exe
Token: 34	4728	WMIC.exe
Token: 35	4728	WMIC.exe
Token: 36	4728	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4728	WMIC.exe
Token: SeSecurityPrivilege	4728	WMIC.exe
Token: SeTakeOwnershipPrivilege	4728	WMIC.exe
Token: SeLoadDriverPrivilege	4728	WMIC.exe
Token: SeSystemProfilePrivilege	4728	WMIC.exe
Token: SeSystemtimePrivilege	4728	WMIC.exe
Token: SeProfSingleProcessPrivilege	4728	WMIC.exe
Token: SeIncBasePriorityPrivilege	4728	WMIC.exe
Token: SeCreatePagefilePrivilege	4728	WMIC.exe
Token: SeBackupPrivilege	4728	WMIC.exe
Token: SeRestorePrivilege	4728	WMIC.exe
Token: SeShutdownPrivilege	4728	WMIC.exe
Token: SeDebugPrivilege	4728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4728	WMIC.exe
Token: SeRemoteShutdownPrivilege	4728	WMIC.exe
Token: SeUndockPrivilege	4728	WMIC.exe
Token: SeManageVolumePrivilege	4728	WMIC.exe
Token: 33	4728	WMIC.exe
Token: 34	4728	WMIC.exe
Token: 35	4728	WMIC.exe
Token: 36	4728	WMIC.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeBackupPrivilege	1612	vssvc.exe
Token: SeRestorePrivilege	1612	vssvc.exe
Token: SeAuditPrivilege	1612	vssvc.exe
Token: SeBackupPrivilege	3376	srtasks.exe
Token: SeRestorePrivilege	3376	srtasks.exe
Token: SeSecurityPrivilege	3376	srtasks.exe
Token: SeTakeOwnershipPrivilege	3376	srtasks.exe
Token: SeBackupPrivilege	3376	srtasks.exe
Token: SeRestorePrivilege	3376	srtasks.exe
Token: SeSecurityPrivilege	3376	srtasks.exe
Token: SeTakeOwnershipPrivilege	3376	srtasks.exe
Token: SeIncreaseQuotaPrivilege	2384	WMIC.exe
Token: SeSecurityPrivilege	2384	WMIC.exe
Token: SeTakeOwnershipPrivilege	2384	WMIC.exe
Token: SeLoadDriverPrivilege	2384	WMIC.exe
Token: SeSystemProfilePrivilege	2384	WMIC.exe
Token: SeSystemtimePrivilege	2384	WMIC.exe
Token: SeProfSingleProcessPrivilege	2384	WMIC.exe
Token: SeIncBasePriorityPrivilege	2384	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3396	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe
3396	ByGoneSpoofer.exe
4036	ByGoneSpoofer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 4368	896	msedge.exe	86
PID 896 wrote to memory of 3732	896	msedge.exe	87
PID 896 wrote to memory of 4084	896	msedge.exe	88
PID 896 wrote to memory of 4084	896	msedge.exe	88
PID 896 wrote to memory of 4084	896	msedge.exe	88
PID 896 wrote to memory of 2164	896	msedge.exe	89
PID 896 wrote to memory of 2164	896	msedge.exe	89
PID 896 wrote to memory of 660	896	msedge.exe	90
PID 896 wrote to memory of 3948	896	msedge.exe	91
PID 896 wrote to memory of 660	896	msedge.exe	90
PID 896 wrote to memory of 660	896	msedge.exe	90
PID 896 wrote to memory of 3948	896	msedge.exe	91
PID 896 wrote to memory of 3948	896	msedge.exe	91
PID 896 wrote to memory of 4364	896	msedge.exe	93
PID 896 wrote to memory of 4364	896	msedge.exe	93
PID 896 wrote to memory of 2548	896	msedge.exe	94
PID 896 wrote to memory of 4364	896	msedge.exe	93
PID 896 wrote to memory of 2548	896	msedge.exe	94
PID 896 wrote to memory of 2548	896	msedge.exe	94
PID 896 wrote to memory of 4716	896	msedge.exe	97
PID 896 wrote to memory of 4716	896	msedge.exe	97
PID 896 wrote to memory of 1236	896	msedge.exe	98
PID 896 wrote to memory of 1236	896	msedge.exe	98
PID 896 wrote to memory of 5084	896	msedge.exe	99
PID 896 wrote to memory of 1740	896	msedge.exe	100
PID 896 wrote to memory of 5084	896	msedge.exe	99
PID 896 wrote to memory of 1740	896	msedge.exe	100
PID 896 wrote to memory of 1740	896	msedge.exe	100
PID 896 wrote to memory of 64	896	msedge.exe	102
PID 896 wrote to memory of 3988	896	msedge.exe	104
PID 3396 wrote to memory of 4036	3396	ByGoneSpoofer.exe	109
PID 4036 wrote to memory of 2552	4036	ByGoneSpoofer.exe	110
PID 4036 wrote to memory of 4572	4036	ByGoneSpoofer.exe	113
PID 4572 wrote to memory of 2236	4572	cmd.exe	114
PID 4036 wrote to memory of 1648	4036	ByGoneSpoofer.exe	115
PID 1648 wrote to memory of 2784	1648	cmd.exe	116
PID 4036 wrote to memory of 3504	4036	ByGoneSpoofer.exe	117
PID 3504 wrote to memory of 4728	3504	cmd.exe	118
PID 4036 wrote to memory of 2852	4036	ByGoneSpoofer.exe	119
PID 2852 wrote to memory of 4456	2852	cmd.exe	120
PID 4036 wrote to memory of 4364	4036	ByGoneSpoofer.exe	122
PID 4036 wrote to memory of 2596	4036	ByGoneSpoofer.exe	134
PID 2596 wrote to memory of 2384	2596	cmd.exe	135
PID 4036 wrote to memory of 3536	4036	ByGoneSpoofer.exe	136
PID 3536 wrote to memory of 2164	3536	cmd.exe	137
PID 4036 wrote to memory of 4964	4036	ByGoneSpoofer.exe	139
PID 4964 wrote to memory of 4012	4964	cmd.exe	140
PID 4036 wrote to memory of 3804	4036	ByGoneSpoofer.exe	141
PID 4036 wrote to memory of 1972	4036	ByGoneSpoofer.exe	143
PID 1972 wrote to memory of 4284	1972	cmd.exe	144
PID 4036 wrote to memory of 2792	4036	ByGoneSpoofer.exe	145
PID 2792 wrote to memory of 3188	2792	cmd.exe	146
PID 4036 wrote to memory of 4464	4036	ByGoneSpoofer.exe	147
PID 4464 wrote to memory of 3844	4464	cmd.exe	148
PID 4036 wrote to memory of 4260	4036	ByGoneSpoofer.exe	149
PID 4260 wrote to memory of 420	4260	cmd.exe	150
PID 4036 wrote to memory of 3336	4036	ByGoneSpoofer.exe	151
PID 3336 wrote to memory of 4316	3336	cmd.exe	152
PID 4036 wrote to memory of 2732	4036	ByGoneSpoofer.exe	153
PID 2732 wrote to memory of 556	2732	cmd.exe	154
PID 4036 wrote to memory of 4296	4036	ByGoneSpoofer.exe	155
PID 4296 wrote to memory of 4904	4296	cmd.exe	156
PID 4036 wrote to memory of 4404	4036	ByGoneSpoofer.exe	157
PID 4404 wrote to memory of 3676	4404	cmd.exe	158

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/nitaybl/ByGoneSpoofer/releases/download/4.4.0/ByGoneSpoofer.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x260,0x7ffa34f9c188,0x7ffa34f9c194,0x7ffa34f9c1a0
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,6069949259599415008,12789476295690848483,524288 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1239022478176858379,11584695942357297828,262144 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,11843889319287287232,11056242459731073799,524288 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,17808432243325979738,4773025322635056417,2097152 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,8908069738478636848,7513231112870906637,2097152 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,16051140683679470029,8244267631344754707,2097152 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,8844207039693370663,5440306825012981284,2097152 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,12015271030698213697,15377265895444099615,524288 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,12294940263591263656,8254726859242646697,524288 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,1507067340801192610,16025058697953201142,524288 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5696,i,4705609771234984509,12514164959592444955,2097152 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,4274890813155818192,1558179292537802090,524288 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,5471767004338245720,1102034572071718303,524288 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,5471767004338245720,1102034572071718303,524288 --field-trial-handle=2364,i,5459838378702895899,11799684617510943578,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4896

C:\Users\Admin\Downloads\ByGoneSpoofer.exe
"C:\Users\Admin\Downloads\ByGoneSpoofer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\Downloads\ByGoneSpoofer.exe
  "C:\Users\Admin\Downloads\ByGoneSpoofer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc query winmgmt"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\sc.exe
      sc query winmgmt
      4⤵
      Launches sc.exe
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Enable-ComputerRestore -Drive 'C:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Enable-ComputerRestore -Drive 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Checkpoint-Computer -Description \"ByGone Full Spoof Backup\" -RestorePointType \"MODIFY_SETTINGS\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac /v /fo csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\system32\getmac.exe
      getmac /v /fo csv
      4⤵
      PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber,manufacturer,version /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber,manufacturer,version /format:csv
      4⤵
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic baseboard get serialnumber,manufacturer,product /format:csv"
    3⤵
    - Executes a command shell one-liner
    PID:3804
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber,manufacturer,product /format:csv
      4⤵
      PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get uuid,manufacturer,model /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get uuid,manufacturer,model /format:csv
      4⤵
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get processorid,name /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get processorid,name /format:csv
      4⤵
      PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg export "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" "C:\Users\Admin\AppData\Roaming\ByGoneEDIDBackup.reg" /y"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\system32\reg.exe
      reg export "HKLM\SYSTEM\CurrentControlSet\Enum\DISPLAY" "C:\Users\Admin\AppData\Roaming\ByGoneEDIDBackup.reg" /y
      4⤵
      PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Application""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Application"
      4⤵
      Clears Windows event logs
      PID:420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "System""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "System"
      4⤵
      Clears Windows event logs
      PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Security""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Security"
      4⤵
      Clears Windows event logs
      PID:556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
      4⤵
      Clears Windows event logs
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
      4⤵
      Clears Windows event logs
      PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational""
    3⤵
    - Executes a command shell one-liner
    PID:2736
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational"
      4⤵
      Clears Windows event logs
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ipconfig /flushdns"
    3⤵
    - Executes a command shell one-liner
    PID:4020
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:632
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM RobloxPlayerBeta.exe
    3⤵
    - Kills process with taskkill
    PID:3252
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM RobloxPlayerLauncher.exe
    3⤵
    - Kills process with taskkill
    PID:1868
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM Roblox.exe
    3⤵
    - Kills process with taskkill
    PID:3852
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM RobloxStudio.exe
    3⤵
    - Kills process with taskkill
    PID:3960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM RobloxCrashHandler.exe
    3⤵
    - Kills process with taskkill
    PID:3384
- - C:\Windows\SYSTEM32\reg.exe
    reg delete "HKCU\Software\ROBLOX Corporation" /f
    3⤵
    PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv"
    3⤵
    - Executes a command shell one-liner
    PID:4888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nic where "NetConnectionID is not null" get NetConnectionID, Index /format:csv
      4⤵
      PID:2264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh interface set interface name="Ethernet" admin=disable"
    3⤵
    - Executes a command shell one-liner
    PID:3844
  - - C:\Windows\system32\netsh.exe
      netsh interface set interface name="Ethernet" admin=disable
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 aa0d78ec9cd90e7c6714bdce5235de1fc6b7c3088a6cd8f6e6d2c1cebea7d661
MD5 63134f635628c0af90baed8399868c70
SHA1 0a02b0ee6e4253e3534f292530612cd9f5f16106
SHA512 3c98f5f62643131db7887f04a33b0ca1c1c00b00c63332d61c392e6bf04039e1f5ce53adff3458c5b96f00e8454a916a07ab2c53d268c7a0bedbef781bef81f0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
TLSH
T123B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8fc0daac07f1cba5e2be811f2c7da605f08db262b2865fb00c09cca1533fed22
MD5 e7619e69fbf9c7d9fe17c1999fa8b04e
SHA1 575f392ad5a4f23b51afaaffbf2e0b1238e1f1b4
SHA512 1fda98c206a6952201f19fa3f6e5a870c6772631901131a611e7ac3372afd4e6c0c7455ffe8763964b5b3ecf7e6001df946800d571cba6fa8590a382591c5194
TLSH
T1EDD0A722291CF4C0E71802709212CF003B2A14A22553560AF315CC2D98B40C156D6BC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 43449500672de604185b783a8623cd862db4cb1a2f2215bdae5c70745dcccb2a
MD5 7ca7d19826c8130d618d22574ff22926
SHA1 e5e513aa261b88884d5579d71f5733973788da17
SHA512 f1e7f4df3514dff2e779a798ec36159dd6447029ffc233e75b75b8bc0710f5947c7f51bac76bcb93122d324e79b90d23fbd03f70d7080756cf537d4333991d21
TLSH
T1EC716E84CEB2C591F3233C32D2D37129353976B94D13AF260344EC3C6A2AB2E7EA1140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58365d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58365d.TMP
Size 3KB
SHA256 12666737d467b0d6f6b474c6999bc61aa94fa0d3dd0aa91f001a040b128c3e5b
MD5 99fc128d74726ffce850eb5400b102e6
SHA1 8c0ebfea73bb00f09fa7c52dbf291c455a3f48e9
SHA512 399ea6ac24cdb0afb53995d36ada866ca6b2c75f0efad3148da92117dc1cdf13a66c6aa9778ad206aac68ab61f55d602e33436eb8b4dce492f3978d2660cc91d
TLSH
T1B9714D94CEB2C591F3233C32D2D371297539BAB94D136F260344ED3C6A2AB2E7EA1144
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 df65e627f17e586e78970639baf6e1579cf1a41e751e73da9ce590c5e2ba3a42
MD5 8d0d5a90561ba8bf42e47d4936fe8f3b
SHA1 48fb6feddbba4a560c231a6544871892789f1040
SHA512 8a42c3c617e482ed6dfed3b6be40c8c2970db0ee3aaad707f22fbdfd28138996bbccc8b96ef4443d8a0be6c1b60ee70ad4e07d4fc5658be047c981d55406b92e
TLSH
T1D7116AF783A0956D8A0156F0AA18AE1BCE2C0511931C7C6A85E07E2793F3471F04199B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c2b108a6a96d50541cd155618c7a4a4d4fb08bd373273ee9db27a76bde12e82f
MD5 e9bdf1e3ccbda0363e650a176e2100f3
SHA1 a0ea3d5bd8e856d0ec44519cad7287248cff9f79
SHA512 f78598c03efb5c936b9d08daf25e23e1c45c533086e7dccadb3304162f513016d818b16abc82e87432e4d99f698e41da4da4c30831fb5d1613048c9dee8577b9
SSDEEP 192:sxZ5RayM/jK1Ml8C9R/fXsXWpVdCyCEdpJHW6+WNGYLrz6IgFJ:sxZ5AJR/fXsXWvdZVJHbGBv
TLSH
T1E6520A116A34697BCCCBD20CFA55BF53D6F91423A2900E94A9FCCA1C05E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cb672636c6d59199cb352c3545d3d32e8d7cdf3e46f7f8290dfc3bad817ca1dc
MD5 5cad0cc2a9befedb3e4a3cc13008e355
SHA1 5b96c9b3992ebc1b61d5ed132b08155ab9193fae
SHA512 98c2ff2b8206baf89c139150a971fb5b67700e26fe9af7489b89d04a41416ad4faa4b470f7161cfc07b278b01fc01ed2f67ee14dbe2ca4134b591a87808ade41
SSDEEP 768:rPs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNgrocV:rPs6pD1WvxzWju1jahILIsNrcV
TLSH
T1B5D2FA3B680CCB7E4F841E5CEC2AAF966DD801CBAB58895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 055a79da75931d0192bb8ac524d79ab5b663c857677f9cacb436bce61842e2bb
MD5 e7978e2da19f40976e79f4279aa2216a
SHA1 a40075f3146ed7f9e55fee4a5ca783d182ea7dda
SHA512 c82426805199334f3c6d356deacfe7b62ad6035dabced8e9bdc8297a1490097f04d9ac6ae592c38fa7b1fdcd512ff5aba6ccb8811a86d9566e790402eb79bc6a
SSDEEP 96:KUAAKtePuV2Ku8SKy0K3KE3SKAUeqooK522d:iixdf+Zjf
TLSH
T19BE1161272BB03433C3E684CA2658B274B86B1633118F42B7BA905B15E67E355DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bc5232417b49beb262456d6ab02121f11ed99b955a1a2dd85b97eaa9c1575374
MD5 dfb219a2605f30881d5ea57e376739fd
SHA1 893a8474663355438da352c75ed4f7281cefebef
SHA512 d350ec6562175f5b3e8c3136d8f4daf997d810233a092076329a67bce6faaceb8861a9fb1c6f8a4b2b34ffbd05d4729f1444e9ecb22b131994d5f4cc7a9ee5a5
SSDEEP 192:qONc6O7+3hQmiUyaD4Gttb0X+FA42YlgGoQAU6:qONc61eGt91AlQoFU6
TLSH
T12D02D8356C786CB78AF2AD46F58B7B135FA5103BA9A52F80DAE81F0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b47cc5ae2f727b762ef1e869c130076ff02be3098f5cc60f6a969ea3cfa04fb
MD5 189d53d877a4966abafdd415fc0c9fd2
SHA1 771ecd759b8e679ddfe5056303381f94f1392247
SHA512 9d8c109ef4523aa2432e6b98951dbde889124f23c45f344349cacbcafcc466678d08512308299a9e5c09c997a37b203c22cdaacca3f5020d718b4eb351c7c24c
SSDEEP 192:6ONe6O7+3GQmiUyWD4Zttb0X+FA42YyuNacNogqKSrU6:6ONe68kZt91AlWDoNU6
TLSH
T15B120B356C687CAB5EE3A541F48735138EA5413BDE8A3F81E5EC5E1C01EF66C234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 d8370761972720c10a0dd03836c2658c7bf6db473cd19de6f357bbb6fe9ab4bc
MD5 3bca24bcd6a402318fef915deffe48be
SHA1 68143687a85fa23f64ed1699266c512856f2f3f2
SHA512 9a9b8f5263b4926e688985d9857f506d1557e4780bf6d58bb2b3aa1ce9a16c64abe9c554183d42fff030e5fde9449edf2b0d0a94ca5a4db9afcaae2b95d5b975
SSDEEP 384:EsN7FK0A7a91AlW1pCvFA8Bva1orqKkBeBeRs9JKgqijUreF:Ete7v+68jrqteTjKgqmUqF
TLSH
T1A3A26C70D4682DE781A2F9C6A18AF6175EB4103BC9991D5CF2F87A3D304F5F86352826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 acea6545558aff8b84565d23c259ffe10ce91a3055ff3e64f1b59af7949fa887
MD5 11cdfbfdacfadaf9648e3b54c486ecc1
SHA1 1f09768d4301ad1945f98945b0dd74e6da0435c4
SHA512 ef7f362e24754df329f370c4db4e5582fbf3625de668332332ada5db1d172c690b477dcc2cb0e3a863cc15fd9c887b83a40a92faf500f3a92a3c9693771f4e2a
TLSH
T1E4412A58B6F91148B3B77E5A9BF6A96D447BB9772E07C46E00110E4F0662A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

REGF26A.tmp

Path C:\Users\Admin\AppData\Local\Temp\REGF26A.tmp
Size 2KB
SHA256 10629244045807abc1591716b59ee23268cbb52724cb6fd35ea15374808f931c
MD5 736220bc3620ab2e988b911238fc64a2
SHA1 7c6688dcba4d31c6d687c0a0d80c7aa63a8ea1a2
SHA512 23760220c9617cba1c611524d26140934b4724a0d55c0e2294092a6839208ec3d3359652b4b1523e9dbee976423d7a1f6d556b054267947133f6e44b96d4b687
TLSH
T15C510D27D7E9201AF6B39EA4CFF95553872B7C52311DC84E10D20B8D09E2E41A8017BF
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 87c8e57e1fc1bff7cf9dfff06af1bdd43a67652ba96d4c35d14e5f22bd17164f
MD5 8187af82ba3c262c0856509fc7e88992
SHA1 7f5461c80a71e24a56a9f15aef7762903bf58cb0
SHA512 5de09cbbacd169b271a51b81599d1e7ab3d2c32665afaa6ea28d759257a8b773a7f5fcecdfc2afcaf073fb2f707689d2a6e7c2493946c7da067810a58a7e6cc1
SSDEEP 192:7rO8hWOhWyyW1c31DSdVWQ4WWhD0LzxOhJNlOCgX01k9z3AW78QYd:7r1hWOhWh3IdXzxIPaR9z9Sd
TLSH
T1CBA24A928EF88502FD5A5D7042F8DA937C3DABD71950909726E8F25C18D33C6EB14B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 fdb29afc4ec3585586d8415de087d6c6993c5a1171f57dd5185389eca33ba948
MD5 4890901924f515b4b91613a4d95adcb4
SHA1 6d73c6fa1829f3b2fc4f30d48ace08cfd07c7340
SHA512 9b1353cac87275506b73f51bc4154bfcea35512776dd58b6ee277b71d7dfbc4be3a06a9135a28cb3145cdabc1bd7a4a93a70d8cbb7bfc773c4394ec692db7c02
SSDEEP 192:yAWOhWBWjKMaKVWQ4iWnNJnvM30LRLLX01k9z3AXeRUoC:jWOhWpK6NJkELRPR9za+C
TLSH
T152A22B82866C8043FDEB6E7042A8DA837D3C67D72910D07616E5F58818973D5FB20B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 4626ba7d6181906a130cb32a965c33d8f41940b23ab2946b51da3eda3f5a1d99
MD5 e4e3fae385155e2639f0962e0952b651
SHA1 e9c8dbdd8f3af958758d8ca4611af2cd97778c77
SHA512 cd51d830fd10327b0d4749d32d888f498a5c85364fe5a26595f7dca781a436151836980b62c26a409d6d483cf7a2c0ae7e0fbaaf3e05875406eac0fda9f17509
SSDEEP 192:DWOhWeWjKMaKVWQ46WYFZlXefqg7i1X01k9z3ARsIJOdxpn:DWOhW+K7wR7i1R9zlIu
TLSH
T13EA23C964BBC8043FDAB6D7082E8DD877C3C23C65A10D5A616E9F55814A3385EF3076E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 8289c551e17e2648bc5384e7ce4787ebea452c10e799e6da96cec930885c7584
MD5 a38b31502f49e8e38abfffab170179ae
SHA1 8892398ede2732854ed6fa09d85bee5c7c0a2a7a
SHA512 a85507558d869f5b1928ed5a5b7048b0add8a54f4e4f0be07e0fda13797982a2d4cc9bc9ca6d5b8690f4511eeb653dfab39df59ecf2da418ce6519b394619c05
SSDEEP 192:j3mxD3MQWOhW9WjKMaKVWQ4WWjdMStCYl6d3RX01k9z3AQXHdjs+j:j3PQWOhWNKJ/YlORR9zbL
TLSH
T135A22AC68BAC8543FDAB2D7053E8D9837C3D67C7091090A646D8F55928933C9EB25B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 acd898771c674e63b0f3e67d98826c93143b391ae8c58563c2da7b98475ced14
MD5 86c236eb806d74516e70741f15993958
SHA1 7a1efce9213df001d8dd76fcef3f308e7dd2a33f
SHA512 647f6064cc11784804e76d52da0529c3ee130de0ca8effefb53ef4bc542493523368a89c805faa6d9cbb6dfa036ce2239efe863fea23455da6f0206e34c551ad
SSDEEP 192:uWOhWnWjKMaKVWQ4WWIn0lXefqg7i1X01k9z3ARsAwHWR:uWOhWHKzR7i1R9zlAwHK
TLSH
T1E0A22B9256FC8043FDAA5D7042F8CA877C3C27C71E50D0AA56E5F5582897385EB30A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 22d8959cc8e03078e28b2140911803368993cf4750743cb5e4011fc469dc1dbd
MD5 f724db231d8cff54ce45d4b0f6ee5034
SHA1 e5ac09bcefde835248be068de5e2d1e359d83b90
SHA512 5a84c84be9b6bc5f58592acb29cba3abad0ede7fadf10fa16897eda51d27e3c54fab6332cc316e61ad9e80e7b84bfd4394399722756bf3c75ef9d0bf7f20b7de
SSDEEP 192:FwhDPvVr8rFTsK3WOhWUWjKMaKVWQ4WWseZYl6d3RX01k9z3AQXQ:GJPvVr8WOhW8KLWYlORR9zbQ
TLSH
T1E5C21A87D9A4E29BFC8F9E7151B6C9436C3943C6001080CA1BD4A75D3CE3387E3A899E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 3b114c3944cb6e0c4f43d4a90248f8bf0ee0230a2096b788f2a2b3f12b59c458
MD5 8d20de7a494edf18e8b00f403a3b9935
SHA1 4d40ef900b909a47734e5d996d2eb5df4eef1ba2
SHA512 2c491a04ae1baf81833f73190531235edc0731ade2923244ff9203eb57b4bda30b2a66ae154bc0f9f1bf2db70d6ec4647523b0ec227f2d1b8cd8a5779adb90e9
SSDEEP 192:NbohWOhWrWjKMaKVWQ4iWbSbp81BHX01k9z3AD93Zv:N8hWOhWzKQSbpIBHR9z03Z
TLSH
T1D0A23C9586BCD143FC5F6E7043F8CA877C3D67C61A4090A616E9F58818A33D5EB20A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 950a9c745e331fa77a46696cc85cdc6556597428392e65689acaca3177104e3e
MD5 49c87d73955e1742818384e2be3166d4
SHA1 6d411645df35feb2618f53ac874c5c30f7b61ecf
SHA512 a05f3ae68cb539d4a9117a3519ff5da090a5671372da44e98e4bc6e9d6f1979d8e01038186e1ec2eec626f5f768e96d066799f38ce20a588f8eef375985e9150
SSDEEP 192:bOtWOhW/NyW1c31DSdVWQ4fGWhDNPIo81BHX01k9z3AD93ZqTz:b8WOhW/83Id+TwoIBHR9z03kTz
TLSH
T19CA229D2CBAC8107F86E6D7043E4DB837D3D6BDA194090A616D5F9882C933D5E72472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 8c0df823dc018907436f1bc964b1073f41241fb1fad633f75997b9324d311f65
MD5 0ea049d5d45e8a39102515ae8a9d4adb
SHA1 a2ae08ced173dc6f114a2f6af4b58652576a1104
SHA512 4eb99d91b2f4d4f16b6640cf0c14c8d71dca83a3ac30bb4453890291ca2b4f9c93598a329baf059e539e21bbad4ce12b3bfa1144f34d9a2a481d5c06eaed258f
SSDEEP 192:MTxlu7WOhWCWjKMaKVWQ4WW7UvpGX01k9z3ASMRcwfgs:MTxlQWOhWqK88pGR9zu+s
TLSH
T17EA24CCDC6B89003FDAE5D7043E9C9833C3DA7C61A50906616D9F19828A33D1EB34B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 c0188b846ca54fd398650af690b55d713c06b0c2570c3d2304539ec15d4667cf
MD5 2e828a71e81695288f792904e77e993b
SHA1 56c053fe9fe2bd59eea3e8b17d085dfd4855efde
SHA512 76690f6145ab2e6ea933fcb381788d7b64be13d3f10cd6cf82adfb77633e99b9f8a2249b7d85a309e61ebec7b8a8e8cd8cf79374a24afbcefa5bc2cded292eab
SSDEEP 192:RbrWOhWwyW1c31DSdVWQ4WWhg4CizxOhJNlOCgX01k9z3AW78Mnscy:RXWOhWL3IdL4CizxIPaR9z93nsb
TLSH
T146A2399187B88143F9AE6E7053F8DA937C3D57D71A50906647E4F18828C73C5FB20A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 7c66dee567ba583d242f87d442caf38c0ce95bb1d36cd2bd74825c44e54d9078
MD5 652a4cfb048a238be32b27e500f58db4
SHA1 2e45f70f3655a5b876df913e0a00debd54e96196
SHA512 70edef5a456b12efc2b336e3b8abebf812e0a04c10214ccb91616d7edd9574a3168a399ee2d6620595ff631ed499af402407637d8b9503fd86522e958d76d664
SSDEEP 192:9TvuBL3BBL2WOhWYWjKMaKVWQ4fGWb7nvM30LRLLX01k9z3AXjHlQ:9TvuBL3BgWOhWYK+7kELRPR9zapQ
TLSH
T117A22BD6866C9143F8EE6D7042B8CA437C3D67C74920D47A45E9F68C28A33C5E720B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 4ea560dbe8a2970388fb0d738b47e65caa417a2f187e3a9827b696ce01ab41eb
MD5 95305b43167781bcd0a09e0cdd0c460e
SHA1 d1f6c0fdcb562250f23f5e083d68bd5a4d1e3531
SHA512 a6b10fd2d377cd164400c295f3d02e4e93822d0f3d0ab1cf1c9e65620ee702a6055d537f374a967efa5b4db934d843be53422aff3e2555ce808a04c3e05c82a5
SSDEEP 384:InaOMw3zdp3bwjGzue9/0jCRrndbT1WOhWV3IdWejUK9WR9zPR6s:ZOMwBprwjGzue9/0jCRrndb3sJb9zB
TLSH
T16CA23AC2C6A8D307F84DD971706BE9433C39678A4422D5A617E1FB2838E3399E76472D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 68bc19911007ab92d263cb40277a6afc084ca413178ad40b919302b7bbb14b38
MD5 2e2173e37391aa5a4ab87b7a3368b8ef
SHA1 579ca7e47099fa41f32694bb6c37accf56e3e528
SHA512 2ac89f1b1224f2dbc027b901f9f5ae447c45f63e21541be576c9f5a9dfd2f9943009a31c7a8c70f1d349f4f3d5ee4461f9736c02945d762684396c67267383cf
SSDEEP 192:KrWOhWmWjKMaKVWQ4iWu8NunZMiuyCksX01k9z3AkT1sUhYT6:KrWOhWWKQNviCksR9zRTKUhYT6
TLSH
T1BDA22A858ABC8443FC9A9D7143E8DA83BC3E67C65950846653E4F54818D33C5E720B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 045bd4b41c0568fc916a21cc366da93597768d8ead45411c244cf98d605dbaaf
MD5 97cabc27a07f91f2b2227bef71e9aec9
SHA1 d2f42e05c753bdd0e247cef064b78c6a22cb74f9
SHA512 5c58479922c39afebeb316183a1f53b46c291b3e27ff7a46f7ab7dbc2bf3f209edde278ae9b98d70cdecba708aadf6c82a17070aab7ae1f709ffda66b7d7383e
SSDEEP 192:utWOhWnWjKMaKVWQ4WW4/Yl6d3RX01k9z3AQXZ/:utWOhWHKRYlORR9zbx
TLSH
T1C1A23BD6CAA88183FD9E2D7043F8D9833C3D67CA1510D46696E9F95828533D1E73472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 86c8c545c8f358cbe9b822c58c6af3fe00078af0422af0e391d32270cc6d8921
MD5 17ae06f09d6f8e8472284d3b200a9255
SHA1 f7f34f2b508706019d4a0d43253c4c52d97a063a
SHA512 cdd99a8be58a207fab4102512728c7b4dcc0808450b8883157039b8ff2cb862bebc52a1c57f09e3b6086cdc7d70e4edc31789799d88bfd9901f30645c83ff175
SSDEEP 192:HgFzVWOhW5yW1c31DSdVWQ4WWhuAYl6d3RX01k9z3AQXnqwj6k3:AFJWOhWo3Id4YlORR9zbqe3
TLSH
T16DA22AC68AF85103FA5A2E7042EDE5773C3857E71D00C46A46A8FB592893392FB14B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 ae2b8199066cb22395180d86bdc955dc2d33a6bd8d64b61ba77573d1e78b8d70
MD5 2ba1a2fb698e9ab8e8bea55d0a27484c
SHA1 c907e403ca235a827b4a9ab09904a6553350489a
SHA512 ff2377ad6f781b5aacc70e50d58e9ecd6b6139ab67458861bcdc1a0544286e77f2be9d78db6c48fc23d07501a307151153d5c4a46759682b5c14f71802325b1d
SSDEEP 384:0vgTfNck1JzNcKSIWWOhWUKS3u0R9zqx8YySsJ:0vgTfhcKSbFu49zW8y0
TLSH
T16CA21AD685AC91C3F88DAC706295E9537C3E87C61929C47206E8E5AC3DFB3C1D23466E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 c27e4c79489c6be0eaaf7b082792c95ff7bf8adc4f67cf65f7a1a66d03c9bb87
MD5 53721c327963921562591ee955ea37f3
SHA1 c74f8ebcef008c757912432f9eb780c2fc060e92
SHA512 9f12ddb066952bac264e536724e8ad7f3ae9f36dc61490bff7b4e7f11abdd8b54f0f5e136860be466b413dc5119ddde4f1276c144d7fef2ac629d034b889e5a1
SSDEEP 192:e4DfIepWOhWayW1c31DSdVWQ4WWhOCjlXefqg7i1X01k9z3ARsaD1nsi:e4DfIepWOhWZ3IdIsR7i1R9zlMnsi
TLSH
T1FDA24C9186BC9043FDEA5E7092F9DE473C3D67CB1A2091761295F25C2CD7385E71062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 0a422b5f26d89e799f0e80065c5738829ac476765613198f8b142b62753b3be7
MD5 c5d1422c998198f97ad43202da30cb9a
SHA1 26bc3407e92ddbc06ebe29eb7e264457787e8f19
SHA512 4b7f097d3d50ab0ad9283a3ffe140a5e43890cb4b6edb998b88a74be7ceed101235a379e805c008bcb2f12b3ee9fe4a93b3e8160581fe15608f7b6a74a3fb8fd
SSDEEP 192:LFWOhW5+1yW1c31DSdVWQ4WWhHAZ4WXYz1X01k9z3As7R4IHW:LFWOhW5d3Id8AZboJR9zv7Z2
TLSH
T192A23CC5D7A88003F9AA2D7092E8DA837C3D77C75950907A56D4F18C1CA33C5EB2471E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 e7e3f289510fcb895b22b756f64e596a4a736bf3e7cae8e71e393680dbb80f02
MD5 f96fdc9c9419dc0921431d902aa6fe44
SHA1 760b337a40534163f4531e53131b228de48744bd
SHA512 f5e18a6519b417d13d4b8fb28c8779f782e90c147c2aa42792e0104e415a19ac408fa70218f7e872f57e1fd3002296c03783071513892c900f465ff524298c44
SSDEEP 192:NGeVrWOhWjWjKMaKVWQ4WWUiWXYz1X01k9z3As7R4I+G8D:NGeVrWOhWbKFhoJR9zv7Zg
TLSH
T158A23CDA96788043F9AA6E7043E8DA977D3D6BC31954907619E5F1881CE33D0FB30A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 96d361bad0f010b1c815cb536cebdbc9cfd1034fbabbd43b612827b2d464de60
MD5 db1c0d370bfa86a2485b52bd353131eb
SHA1 c4cea93c2c699639083d76d699458ba85c6d86c3
SHA512 1a1f85856dba81d1f8ee6a71d001f33d5b9b56f4147dc65744dfd08de64c12ff972b82f3380183cc8b741189ef5c3f4febd587578a40b4539a88defd1308da2a
SSDEEP 192:vGyMvrRWOhWHWjKMaKVWQ4WWQX9qLrRGhFKeX01k9z3A1x8Y3ISn+3PDfK:vGyMvNWOhWnK/tu0R9zqx8YYSnUbK
TLSH
T1D3A22B9796AC8043F8AB6E7003A8E6937C3C57C7592094BA56D8F5981C933C1EB20B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 e03d483fba05a5a50ef3ac414b904b2ff24ffbed08908b1e7f6a9416f9711856
MD5 c895035f3edc0b27d9d09c8ed07b4c25
SHA1 739306373e9b0984d47f454a48d4960606213d45
SHA512 718daa70997b1e504cdc3e113ef76873ab68908ae97c645c3edcd31ab1dd2482aaf3b0843df9c2e636aa6505294f31795536bdfabe9b0d69bd10cc36a6ff8cd9
SSDEEP 384:j2widv3V0dfpkXc0vVaseWOhW+Kko7R9znGmAvZ:aHdv3VqpkXc0vVaHK9zQ
TLSH
T1AEA22896E2E8A583F8AFDDB046D9C5436C3827C60A10D47759E5F6583DE33C0EB24A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-synch-l1-2-0.dll
Size 21KB
SHA256 e67f6f15acae34dc5ef98de01d89466136232ded7305da22d2f0a454327ad079
MD5 f76d64415e9dbba0e1b4cd2616fdd260
SHA1 dea3b85c77201e55925bbd94ea4bf386d4d1847b
SHA512 947a8ea7fb87b3dfa13e4efeadaeca29995d0d1cd4814e9c6c955f705e0726cd4dfa04fe23438b9bebc9fdae0ec5fb9cd62261b410854c87c3b6bc4b6acb6290
SSDEEP 192:2tZ31WOhW1DWjKMaKVWQ46WX7S9qLrRGhFKeX01k9z3A1x8Y9S5VHA:2tZ31WOhWlKJu0R9zqx8Y9S5Vg
TLSH
T101A24B9B8BA88583F89A9D7047E9D5933C3D17C60A50986A12D9F15D2CE33C1E720F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-sysinfo-l1-1-0.dll
Size 21KB
SHA256 af3f19f3ae063e4fb687242391df2eda6535c7c490b38b0a6870e07c6ddace99
MD5 a4018a4d18e2673a96e07ec9dacea376
SHA1 377c99fed890237e4101eeef1e22e4078732d407
SHA512 b670a37fba1613a704e1bab54b30e536ad3bd03ca5db43b5f3d0e7ef85f7e18be795aee6579a45846754bea5525fa589d5fa09cfbceae30a5241fdd98e433ef7
SSDEEP 192:7gdKIMFgAma4WOhWRyW1c31DSdVWQ4iWhe0DtagQ5X01k9z3ASuGtT/nU7g:IvA74WOhWQ3IdX0DtdQ5R9z1uGx/5
TLSH
T153A22BA2D6FCA103F95E5E3052D9DB433C386BC65914C46A02D8F65C6DE3389EB2463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-timezone-l1-1-0.dll
Size 21KB
SHA256 10b56211a2de348342c0cf4bcd2c91c53a0656f9476b6c0f02af88c29f392841
MD5 32f08d809d0dc16e2bfd2b728c22bd71
SHA1 3adde0e757cbb46c72687c414ffdd06d922249e5
SHA512 71c94c0b3e08b1a1a92a2b866aae59d81806ba3bf8a8384576fa1acc9ef1d42a81856dc872277fb7f9b09cb15da1061fa80f0b0085f649dd10806afe115adcfc
SSDEEP 192:yFg/rLWWOhWRyW1c31DSdVWQ4WWhhCFXYl6d3RX01k9z3AQXpHb:yFg/rLWWOhWQ3IdwCFXYlORR9zb5b
TLSH
T1B3A22AD7CBA84402FD9E2F7083F9DA537C3C67EA4910D05A55D6F94928833C5EB21A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-core-util-l1-1-0.dll
Size 21KB
SHA256 a46b6708fb8e5ee9183037a479b0896552785c598d99a8339e2a05e32ea23d0f
MD5 1078e979f95d90d8b2c0168a65980cf1
SHA1 a4e3266efa2638dbdcf3f640b361e7655f6afd3b
SHA512 681399347c4bfa809f42f30218612a1a3d10a736ca7433d926a3c84b4bb72ee023286b1603533405e8f870f9b76f5926d20cb5509c20c7a59219d6d1964863bb
SSDEEP 192:4WOhW3jyW1c31DSdVWQ4iWhGRINFPKBWX01k9z3A/o0KE+9HrR:4WOhW3+3IdrR8KER9zGo0DeF
TLSH
T126A239C64BE88003EC9B5D7042A8DA437C3C6BCB6950A0A615E5F59C2C933D5FB24B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-crt-conio-l1-1-0.dll
Size 21KB
SHA256 ee81ab5e33d73561172c2effc57272daa2b8e9297d30e20884177dd964fd3137
MD5 e07fc132dc931df3c80d305c108639bc
SHA1 70c1f4b936987677215e138a8aa7fb9fd3290baa
SHA512 ac5af4abe9079b3da2e606b4d7a6389e28fa74995b0232a43ac128a1d31799c3b3c4ba75df21006f3d9fd0a1db8a08b91a28843b5996d71fb3c42fa67e22577d
SSDEEP 192:lGAWOhWIyW1c31DSdVWQ4iWhI3PTINFPKBWX01k9z3A/oScX1:zWOhWT3Idh3PT8KER9zGo/l
TLSH
T1DAA2288712EC5A03E85B5B7092F9DBC37D3867972950B06645E5F86828C33D9FE2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-crt-convert-l1-1-0.dll
Size 25KB
SHA256 69e6ae713da2e6dd587aee3f5192d72ea2a37b352b123f8462c6d60f7a1e0fac
MD5 185000e4e14e154d795eaf6dc50fe01a
SHA1 51b75d791d5590436a0274cc88518e43dc335ca9
SHA512 9291b2e2a309ca90a3c45d7a510bd2a01fe39306b41a33ce953fb86276e08b45985ff37a47d05b0cb339a880fb1ab4ed1457d317e098f024ccd108a393e6ac9f
SSDEEP 192:X9cy9WOhWjyW1c31DSdVWQ4WWhJD/zxOhJNlOCgX01k9z3AW78RS0:qy9WOhW+3Idq7zxIPaR9z9i1
TLSH
T1A3C2B44366E46F66E99F177221FEC7E32A381B82259043B5C243E54C3882782BD67C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-crt-environment-l1-1-0.dll
Size 21KB
SHA256 6a951c49959f820c55b0884fe74723aaaa302a13d93ec9c6c5db21a703af34de
MD5 9a6b5084d1bf25f21e8bcc8bc1c530c9
SHA1 f4a226309cbd98b730110b43818f0b066dbd547e
SHA512 fd036693601e536fc24d5c6d259dcc747d5becc13d84e960e885c0368af576ba3b9e57dbddf8bbd76e11bbb7528adfd4ef366e910528aaa8642ac2bf093cf2de
SSDEEP 192:8WOhWUfWjKMaKVWQ4iWXGINFPKBWX01k9z3A/orUnqlJI:8WOhWYKH8KER9zGoAH
TLSH
T1D0A21B864AA84543F9DB5D7082F8DA537C3CA7CB690090B656F9F54828933C5FF31A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-crt-filesystem-l1-1-0.dll
Size 21KB
SHA256 90d420f9193daddc9a577ce5f37d043de87ccd25967e2a9a57492394e62bb5ae
MD5 b48053ec7f47c651ab8d966b08706fd0
SHA1 d765c5a2bcf33cc6752ff21a2150070b196f4888
SHA512 880b64d2520eb7fb7cf278098b1f809258ab8f2a55285faa37464bd207e6b51c3c2f517136c2c51aedeb238c4588bd36a7405838b88118fcdf477ca88d9aa2be
SSDEEP 192:YEpnWlC0i5CFWOhW9yW1c31DSdVWQ4OWhN2rCtwZNU6nq9bFs0X01k9z3A/Fcm:JnWm5CFWOhWM3Id8FyA9bFs0R9zk
TLSH
T13DA2188356D46E13EDAB0B7242FDDBD73F3D2B82058292A29056F41839E3381BF1596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-crt-heap-l1-1-0.dll
Size 21KB
SHA256 3bd8121250a67f5422b2ac2a3af070016ea0bd26e56ba36a81ff6665b936fdd2
MD5 b9042ef21ca01b7f75df56fcb1968f5b
SHA1 77aaa20229b8d835ffbbbf6088d7cfeb4ba14ac8
SHA512 f146b7ba4d9875e821dbea30c95148c2a8b61bf75fb6d2a6dd0dbe21b5fe14a5af60a8f362cf1e4befccb35d1732a55fbe932b38c587499993f89f442cfb1f59
SSDEEP 192:xAh8Y17aFBRgWOhWtWjKMaKVWQ4KWKVzlgnKug8X01k9z3AIhz9nKab:WL9WOhWdKxl8BR9zlpv
TLSH
T1ECA23A9299FC9943E9ABAF7062F4DB973C3A57C76A00907341E6F5581843380BB3162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-crt-locale-l1-1-0.dll
Size 21KB
SHA256 cd557478f332ab196f81d274ae433c83ddf95cc9ef7579077fc31af4dc761f58
MD5 d9735a15d348498c924619ae4fb9dd26
SHA1 ff7be58540ca929a479998acad19f74386060893
SHA512 88585b07ae35be4b78896d7222d66fef7280ee2f5304d19c55377011538f9bc4129f0f67d070bb76feffb725a3e92d5cd653330f144397fae0207365fdddcf9f
SSDEEP 192:cwzWOhWxyW1c31DSdVWQ4iWhtkpCj9BtaFFX01k9z3ACR6rA:caWOhWw3Id5K9WR9zPR68
TLSH
T19BA22B878AAC9003E99E5EB046B8EB877C3D3BD71501547A12D6F55C2C533DCBB28A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\api-ms-win-crt-math-l1-1-0.dll
Size 29KB
SHA256 1a5092b4e489c89b5455258169ff25f31d5ccde589989fce64092b8d7cd9d45b
MD5 19cd6354ac6752ac3f94ee0787677d61
SHA1 f2002bd93b3736fe980560a9e77a41d6410a83ba
SHA512 886e74e5438919323cede30b47c9e5cbdd81b1025d0997b702535d87ada920dcb97efc886e6059e25e4ad00e5dd6255e8aff7bc03b90f6899a871ba46ee3b871
SSDEEP 384:Y7yaFM4Oe59Ckb1hgmLJWOhW63IdbDtdQ5R9z1uG6Xi:WFMq59Bb1jf9Eds9z19yi
TLSH
T1E3D206474ADCFF53D68F0BB701F08BCE69381EA294D1B6B4D94BA08834623D47E53A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\base_library.zip
Size 1.3MB
SHA256 4726f618b8da9a1dc3f4f708384ebfdd1e4301627ea4ef0fe833b247f2f70bae
MD5 f3f487e255e8a1cb880507510f7c79cf
SHA1 21cbae103cf710d5b15ada914eee998ef9a297e3
SHA512 3979c1abefd178c5cbebc42275e946eeda772da969800d7f419c2790efc56ebc74e8add5694479d368757715a724d6ecfa01b78381242ea5887c67125257c7f5
SSDEEP 12288:F8imqhTmtYzGNcT1QDwtydjdTji2cPPdxhYrL+DX5UW7Wp+PuOBa80201jwCVRDP:6qBSeT1OfdZj5cPPdxhYo7WpKzyIu7
TLSH
T102551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33962\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w30qsabi.jmi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w30qsabi.jmi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ByGoneSpoofer.exe.crdownload

Path C:\Users\Admin\Downloads\ByGoneSpoofer.exe.crdownload
Size 10.0MB
SHA256 bda37b122adebba9b64e3b02eccf023fe832c3741bc64d59660245ff10992c11
MD5 a9ab8f17de97b94a4a31fb4ad551f532
SHA1 146a8c5b7fc4768515bf8b7714ba9a94282c629e
SHA512 a774c404e1a0f8d6c2b9517aa056f3f7ba4e7b4aadea723da49856dca7b4e98eb28e910d9bed39c5bbc6f4b2b46582999ceb05d9c4fcbe8a9bda616b387436f0
SSDEEP 196608:YGWMNEe5urHm7ND9BKG+5fc2S/ErXKEtw+B/oy4iMsqgz+nOnUc:YMNpuCRDvV+53SM8+Bz4ND9c
TLSH
T1ECB633007FD00AF9F6A3E23FC551D825A37678036B52CE9B865456613F731E12E3A7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4364-410-0x000001DC5DFF0000-0x000001DC5E020000-memory.dmp

Download

memory/4364-407-0x000001DC5DFF0000-0x000001DC5E020000-memory.dmp

Download

memory/4364-407-0x000001DC5DFF0000-0x000001DC5E020000-memory.dmp

Download

memory/4364-406-0x000001DC5EC00000-0x000001DC5EE1C000-memory.dmp

Download

memory/4364-409-0x000001DC5EC00000-0x000001DC5EE1C000-memory.dmp

Download

memory/4364-409-0x000001DC5EC00000-0x000001DC5EE1C000-memory.dmp

Download

memory/4364-410-0x000001DC5DFF0000-0x000001DC5E020000-memory.dmp

Download

memory/4364-406-0x000001DC5EC00000-0x000001DC5EE1C000-memory.dmp

Download

memory/4456-398-0x000001CC212A0000-0x000001CC212D0000-memory.dmp

Download

memory/4456-397-0x000001CC20D60000-0x000001CC20F7C000-memory.dmp

Download

memory/4456-398-0x000001CC212A0000-0x000001CC212D0000-memory.dmp

Download

memory/4456-387-0x000001CC20D20000-0x000001CC20D42000-memory.dmp

Download

memory/4456-387-0x000001CC20D20000-0x000001CC20D42000-memory.dmp

Download

memory/4456-397-0x000001CC20D60000-0x000001CC20F7C000-memory.dmp

Download