c8433f6da3e5358d991d7d57cefcfd69905e2bbd8eab4ddc23d229355dabd1b6

Analysis

max time kernel
137s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.vbs
Size 255B
Sample240525-ts67hsac8t
SHA256 c8433f6da3e5358d991d7d57cefcfd69905e2bbd8eab4ddc23d229355dabd1b6
MD5 373e5f13ece02f97ff60cb6021dc0880
SHA1 574cf09f6fde0b709aa47845b6b092c3b3a4fe84
SHA512 3cfe04aa23d5900bd2f73c3e942047945770eae320eb6cfa4eaf83fdc976c5fd14dc3bb389fe5fd75d8a3c824b62e775f89eaa9d4b6ea5fde926204608acd846
MD5 SHA1 SHA512

Score

8^/10

discovery exploit

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\rteth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cdfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\filecrypt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fsdepends.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kdnic.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\monitor.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mouhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pacer.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\afd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mslldp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\netbios.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rdbss.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rdpbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Ndu.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\PEAuth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tcpipreg.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbhub.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\npsvctrig.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\afunix.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cldflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Diskdump.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dxgmms2.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\http.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\srv2.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vwififlt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dfsc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tdi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tdx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\amdppm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\condrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\csc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rspndr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\CPQSC9~1.SYS	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mmcss.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Rtnic64.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tbs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winhvr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\i8042prt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mpsdrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msquic.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storqosflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bindflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\gpuenergydrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\udfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\watchdog.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ahcache.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\beep.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nsiproxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wcifs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cimfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hdaudbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidparse.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ks.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\null.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbehci.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vhdmp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidusb.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ksthunk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\lltdio.sys	cmd.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2708	takeown.exe
1960	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe

Executes dropped EXE 6 IoCs

pid	Process
5260	Process not Found
2652	Process not Found
992	backgroundTaskHost.exe
4568	mousocoreworker.exe
5508	svchost.exe
3704	Process not Found

Loads dropped DLL 64 IoCs

pid	Process
2992	WScript.exe
2992	WScript.exe
2992	WScript.exe
2992	WScript.exe
2992	WScript.exe
2992	WScript.exe
2652	Process not Found
2652	Process not Found
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe
992	backgroundTaskHost.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2708	takeown.exe
1960	icacls.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	backgroundTaskHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	backgroundTaskHost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\notificationplatformcomponent.dll	cmd.exe
File opened for modification	C:\Windows\System32\DesktopShellExt.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\MSHDC~1.INF\storahci.sys	cmd.exe
File opened for modification	C:\Windows\System32\miutils.dll	cmd.exe
File opened for modification	C:\Windows\System32\NPSM.dll	cmd.exe
File opened for modification	C:\Windows\System32\WinMetadata\Windows.Web.winmd	cmd.exe
File opened for modification	C:\Windows\System32\catroot2\edbtmp.log	cmd.exe
File opened for modification	C:\Windows\System32\config\SYSTEM~1\AppData\Local\MICROS~1\Windows\WEBCAC~1.DAT	cmd.exe
File opened for modification	C:\Windows\System32\lmhsvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MIFAE7~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\wbem\wbemess.dll	cmd.exe
File opened for modification	C:\Windows\System32\lsass.exe	cmd.exe
File opened for modification	C:\Windows\System32\profsvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\MoUsoCoreWorker.exe	cmd.exe
File opened for modification	C:\Windows\System32\coml2.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\oleaccrc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\backgroundTaskHost.exe	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MI82F4~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\catroot2\{F750E~1\catdb	cmd.exe
File opened for modification	C:\Windows\System32\cloudAP.dll	cmd.exe
File opened for modification	C:\Windows\System32\Windows.CloudStore.Schema.Shell.dll	cmd.exe
File opened for modification	C:\Windows\System32\dlnashext.dll	cmd.exe
File opened for modification	C:\Windows\System32\ncobjapi.dll	cmd.exe
File opened for modification	C:\Windows\System32\config\TxR\{53B39~2.BLF	cmd.exe
File opened for modification	C:\Windows\System32\dhcpcsvc6.dll	cmd.exe
File opened for modification	C:\Windows\System32\nsisvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\security.dll	cmd.exe
File opened for modification	C:\Windows\System32\rsaenh.dll	cmd.exe
File opened for modification	C:\Windows\System32\BackgroundMediaPolicy.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\propsys.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\dmxmlhelputils.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\cmd.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MIFF83~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\wkssvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\ClipboardServer.dll	cmd.exe
File opened for modification	C:\Windows\System32\dbghelp.dll	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MI8607~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\WinTypes.dll	cmd.exe
File opened for modification	C:\Windows\System32\audiosrv.dll	cmd.exe
File opened for modification	C:\Windows\System32\cryptxml.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\windows.storage.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\win32kbase.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\TimeBrokerServer.dll	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MIDBEC~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\cryptbase.dll	cmd.exe
File opened for modification	C:\Windows\System32\cryptnet.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\dsreg.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\icuuc.dll	cmd.exe
File opened for modification	C:\Windows\System32\ntasn1.dll	cmd.exe
File opened for modification	C:\Windows\System32\config\SYSTEM~1\AppData\Local\MICROS~1\Office\OTele\OFFICE~1.DB	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\CDROM~1.INF\cdrom.sys	cmd.exe
File opened for modification	C:\Windows\System32\kerberos.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbehci.sys	cmd.exe
File opened for modification	C:\Windows\System32\en-US\spoolsv.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\thumbcache.dll	cmd.exe
File opened for modification	C:\Windows\System32\AppResolver.dll	cmd.exe
File opened for modification	C:\Windows\System32\InputLocaleManager.dll	cmd.exe
File opened for modification	C:\Windows\System32\uxtheme.dll	cmd.exe
File opened for modification	C:\Windows\System32\config\SAM.LOG1	cmd.exe
File opened for modification	C:\Windows\System32\en-US\combase.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\msprivs.dll	cmd.exe
File opened for modification	C:\Windows\System32\Windows.Storage.Search.dll	cmd.exe
File opened for modification	C:\Windows\System32\cryptsvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\globinputhost.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	backgroundTaskHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	backgroundTaskHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2708	takeown.exe
Token: SeShutdownPrivilege	4568	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4568	mousocoreworker.exe
Token: SeShutdownPrivilege	4568	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	4568	mousocoreworker.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 5356	2992	WScript.exe	82
PID 2992 wrote to memory of 5356	2992	WScript.exe	82
PID 5356 wrote to memory of 2708	5356	cmd.exe	84
PID 5356 wrote to memory of 2708	5356	cmd.exe	84
PID 5356 wrote to memory of 1960	5356	cmd.exe	101
PID 5356 wrote to memory of 1960	5356	cmd.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 /r /d y && icacls C:\Windows\System32 /grant administrators:F /t && rmdir /s /q C:\Windows\System32
  2⤵
  - Drops file in Drivers directory
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32 /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32 /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1960

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies registry class
PID:992

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
- Executes dropped EXE
PID:5508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BCP47Langs.dll

Path C:\Windows\System32\BCP47Langs.dll
Size 357KB
SHA256 cbd179179f1d6e4c34c25abca5999cf5c2b468ba267b5c32663451991452afce
MD5 bfbd39131ba2666075d7c20ba46972fe
SHA1 66c3f540b52b101893d4ce046763817d44beed88
SHA512 111cbc28a4792b7a461fbf1dba0286c58e8aeeae80958e30827d475784eccbff670d424cb7cb610c44c2473b7df7d3ac61cdbda43ffe64d710a2795a6f4f9620
SSDEEP 6144:NCR8IJH+VRj5aI5WP0v93kqPNnerb5NbAi08spCpR7Hrn5gJjU:NCyjWPQRUrb5N0uNGU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CoreMessaging.dll

Path C:\Windows\System32\CoreMessaging.dll
Size 963KB
SHA256 c01c15c82a8568ba99bf193fbc4893d990102b0cbaafe04f4f02b9fe44ae6c76
MD5 724677d5055d40798db093c26cefd179
SHA1 af685e51f87375125126fd6eaa67ad46eb519859
SHA512 ffc56a4984c2eb7acd55531027c0559689305f4b5b9755e1c0338974bd4411f60a4bde16805e68005bbda96d491af8b70a4cdbfafc613978c72baacd3a3e56c6
SSDEEP 12288:o2VOdK2wDGo86RjgdPpVqCgDYKqQFaCx9/WdxivFqpOMcsxY0khtn:o2VoK2wDGr6RjypECQxBWduUfxYjh9
MD5 SHA1 SHA512 SSDEEP

Submit Download

CoreUIComponents.dll

Path C:\Windows\System32\CoreUIComponents.dll
Size 3.4MB
SHA256 27f6f85cce6be7a0127deca777e11f3adb4813b5182c287efdbdd74c0952a339
MD5 556f907cce760f3589c953b34d98caba
SHA1 973210ee7824101e08ab1e166e2195b764993bf7
SHA512 2d1dfc5cb6d98bc005845fce619d593525f5acab9699defae8391009fb9164d550502c713031f553c2546ba90690c90828fc9ff7881407f03644a2bbacc0ace4
SSDEEP 49152:9Yz20KfXMybMeDCacgFLpTod0srJPK1raPi8piq/IankgD1Uh1nsy:B7jd89m
MD5 SHA1 SHA512 SSDEEP

Submit Download

FWPUCLNT.DLL

Path C:\Windows\System32\FWPUCLNT.DLL
Size 488KB
SHA256 aaf5b3a2618636ad22724a37a56d325ef2b4c873e046dcb24cbfda8a34b15ad4
MD5 b776a9db3a6d407d1dbd5d7af94f2294
SHA1 82e2e70dda3c8890ec7ab94a391e886afddeee09
SHA512 ba002d9e7ab6634cb89ddb17d1edc0b7efd5f87a1200f313cb848ae777bb907952eaacb19b2889b0184d144e7ba8e07174b4677eac4b18bf2a0d2e9962193876
SSDEEP 6144:K+jSWRMihvWiFcANGv8LrndaV3WQy+6t89c1hjwpOKuqZb1Ip5G6xE3j:K+jkIY8ndM8O3j
MD5 SHA1 SHA512 SSDEEP

Submit Download

KernelBase.dll

Path C:\Windows\System32\KernelBase.dll
Size 2.8MB
SHA256 79eadbc61d0762e6931ee5e49007898596ece6bc2a61c080ada7a2c70992d6e6
MD5 957a7c72c0ad30d568e04fce3313082f
SHA1 1919c89186b1e3b4da4aea812ea43f02eac28cd6
SHA512 cbdf38944b7d7132e7c7448bc715e1e94b1a9a97a6108d90c44fd5637c19dbf39969ee69a170525a2c920b6cb67941f79e8ca818c3e4e2ffbbe3ea90fa0f7d7b
SSDEEP 49152:k9DXAGO5xztYAHzBO9Y66PZKJcbcLW0Zb:EXqU
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrmCoreR.dll

Path C:\Windows\System32\MrmCoreR.dll
Size 976KB
SHA256 50822375d13f39dfbb3528025d9faa98f22836f97d11f6e0e7b447ef9e4534df
MD5 dccfefcfc583aed573452b4168363620
SHA1 3422aeb088d5eaba6d616313d8c5fe0c8f58c376
SHA512 a3ea0279add3964f2166af0963e7edb5a298afef7b03006ee55433cef774f1fef82d0545c2bf04ea7ebf9d1d7fa17f845b73ecba483cac5ba2f891e6c54f0d6c
SSDEEP 12288:Adtvo3ykVvHu+opHPkWRxvny2PrLnzb7knVLQiw9ce5ucBBJSp9XNQf+Uik:AWykVsRMWRx/bzkJQhdXBJS5yR
MD5 SHA1 SHA512 SSDEEP

Submit Download

OnDemandConnRouteHelper.dll

Path C:\Windows\System32\OnDemandConnRouteHelper.dll
Size 72KB
SHA256 c897c345c3bcf3e96589a0feeea8b6d26cf33c091ac3ee2162dd27f8a79c3ff5
MD5 1f009de6a013a282d07436241512c056
SHA1 f0d37e1e76a199135e00c0a36b154b191a0950a9
SHA512 57971d5df5bd9fad066378b280898e1f6e074805cc765448b99409550f97d74bf5bbd11e48e28e53f22be69cd9cd0ff58caa1e92f94fed7cbb4cd45c8f0c4d37
SSDEEP 1536:NDDbTPHmlz7/C2hM35N4OLH9IkRkC8yMZFxj5:9DbD8/7MrKukCrafd
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneCoreUAPCommonProxyStub.dll

Path C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
Size 7.6MB
SHA256 503ef212dbb78c886aacd2ea956004bf213061761d0174e3711a626f9d774471
MD5 5af757db7d611890257f5066af309e9d
SHA1 d0d1371afd887a1646131c70964fb2d735904519
SHA512 13f3430bb5d331f879cbaeea3e2ebe67bdec53dafe35596c828063e98d137786149bcd09c16f4911b430ad7ce697ae2c40fdcf2f9e6cc9bede52adc1ce82bde0
SSDEEP 24576:MD2TCgf+5Iajhq4Qh5oHTPHNQ0fzgc3aDeyTw2/jbgPMSJ+7:FGrQh52PH20fsc3jYg0SI
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHCore.dll

Path C:\Windows\System32\SHCore.dll
Size 686KB
SHA256 79e0e627e4e8b0a34375db8c71592977538e9743cc67adf88c615157a0e86b00
MD5 ab4b87457d2b08b7c51b136c05bfed27
SHA1 3fab36a2f84c75232115d3f253c1a9e7f087e7b5
SHA512 37e8d142ecb1112b25e54cdd10a56b972a435397f2c6dfbb209331181eab68db997a3d2a781581d4b59a66d87ccd22e02300a4112a6223f29fe72e860cd2c4aa
SSDEEP 12288:BoMfjHRnqfLDRHJDCtIkHuxD3rF66PmGdLE:B7JqfLDRHJDQ1HuV7F66PmGxE
MD5 SHA1 SHA512 SSDEEP

Submit Download

TextInputFramework.dll

Path C:\Windows\System32\TextInputFramework.dll
Size 992KB
SHA256 344dcbf81e506ad32561bee96221a601c2e714d136c6d0d8a2e03db8e2dc0e9b
MD5 c311e8923432d9d69ad118e1ff6501ce
SHA1 692b75a57c033b45c65272247ae7dd2061092ef3
SHA512 b629453abe584cb69c79072eef6c59a8b20cecdeb4bfcf0a2a709f135eb16612f8eb81039adc82669fadc41240ef64d1c7fc4025d3a600ffd7a3a85ff05cdf01
SSDEEP 12288:DjkwRyg+lzKCJSmFQ0rw2QncUbbevulWb1vKBQqSogBHD:DjkwRNQvJ9FVQHbbBWb0B8BHD
MD5 SHA1 SHA512 SSDEEP

Submit Download

TextShaping.dll

Path C:\Windows\System32\TextShaping.dll
Size 689KB
SHA256 b51bbe4c3d01ed3ecb8947c7cce071022149496d713e65e5a30cacaa82b7681e
MD5 4c528ae5d512e3901bacaa5d75240381
SHA1 c0222e0ed87b618a16564dadd485ce3a80b762e2
SHA512 43dc844946160dd36cab13ee963b51a3af7d78fa07b46550cc7b4a6a68f1fc28efb9fc83729c5ddf4ef1c97b89e47a6735d8c13211e28c3a3d9a3fb895fa420a
SSDEEP 6144:NpP8otRLi+wn1hjmmls0u5iJ8cXcQjB1zaIzdcIGt1v63j1s+8:NpP8ot3aLsz5S91xaqE63jm+8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinTypes.dll

Path C:\Windows\System32\WinTypes.dll
Size 1.3MB
SHA256 62a4076211bae3db99472ceb1b0af23dfca8aacd618a3b72420182bb0c7ab2c2
MD5 67970fe93f3437104cded90945141539
SHA1 e2fbcbb3a26ffad184727275fe2753a8c1ca30e6
SHA512 43896a744ef8321ed3161bbf55117206eddbb0948e551d112ef028759ebc5b56b78012458dcb98a324bd6ba52c2ab5b063ddc7417bf2b92179e829898c724487
SSDEEP 12288:Cq7rk5965Ra6JQoxJ8S6VA6Kz2cuYkJ4ZJWrm8Oiy3KU:CqACa6JQoxOAvz2cfQmKm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows.Globalization.dll

Path C:\Windows\System32\Windows.Globalization.dll
Size 1.6MB
SHA256 48ed1080edea0f01223ef21cbf3b29c96352b649d8995d19722c59d5ad713301
MD5 c4380ccd6a91a93a8e80bf89776f8851
SHA1 4e97fa0e4a7cb6839bc0a36f0201715be3f2571b
SHA512 217d2d288e10635335fee5f13cb0c1703672bc0ac5f08cfb2f5e3f285ec8529e91e4776c7094a40268495ab044e61b85c14ea5f235a847d7b9ab2b9234353f3a
SSDEEP 24576:NDFmXyn7kR0wTYRtRXOU06xmynSbD9MF6FJgihNDyG3cPZwFLVQ0qHv5cx/:NDNLygtRXOr6NnI6eqORYZWLp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows.Services.TargetedContent.dll

Path C:\Windows\System32\Windows.Services.TargetedContent.dll
Size 1.2MB
SHA256 073703495bf52dbd3e5b174bb5a2ab02f36b8b73ff387fd7c5d2879a829fec00
MD5 f9a5fbcf0af5f280e5e66bb76961cd2f
SHA1 78a7b1ceb6cbd72e06d48a0bef9d3facf028d8bf
SHA512 3e8cde5ea4883a47f6ed0f08c8e093859896cef776eee552acbc17e4b34395c007e3be875f67eda1cc4aa9ccd12d286a417a9aa4fdf4629a212c983ea5e29a72
SSDEEP 24576:yq8ABthKyYLLQEz6tULjuqZon1M4Sb3sJs9Ad7+:/7s6XnFaAd7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows.StateRepositoryCore.dll

Path C:\Windows\System32\Windows.StateRepositoryCore.dll
Size 57KB
SHA256 25970a13ecb42814709f5a17c3e41f389dc27f33e0e7a46300e47f5af2fa0f5c
MD5 33ec12ec93e56828f391399b70c313cc
SHA1 d3517663c67a63872da7ddcd93c13909d7a8d384
SHA512 4b1314c365f92c5e9881afe27f49b8ec9251c3810aaf34202ef6839bd74a31d8c20545ad414f9eae239a43bbd0d1f3a9deadcf08f83e45ecce54455885b62758
SSDEEP 1536:cD/oZeeT0Rq/0mrd3IBt+5TPRpc1id5OXPQ1:cAhfc655Tppc1SOX41
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows.Storage.ApplicationData.dll

Path C:\Windows\System32\Windows.Storage.ApplicationData.dll
Size 381KB
SHA256 febb8ae767b2e5d305f4af6a15ea54aedbf0901dac925382b387eda187cf596d
MD5 7bc1a26dd9bd33c8849559fd0d2f7239
SHA1 42e6793f073211ab3921756358df719c104516cd
SHA512 43ad5a310a73651581faad312cf83909ea1e9b43b4cb0f8a9a787b3791433c980133ad68e04be029991eaaf8803a6ef3f3f00c9a512ca54168692a336d995f1e
SSDEEP 6144:n2vGZlfNv7I8LtT0soGjq3X07L93dBi1salnKZszDX:vZlfNDLtT0skqB/qicT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows.Web.dll

Path C:\Windows\System32\Windows.Web.dll
Size 756KB
SHA256 c5dbbfa0ff7d1c08ec9698e3e2d59634168c497dbda63a3734fb68973b999ac8
MD5 0e96fbf3f55bb988eda407e868c17ed3
SHA1 cd9ecc3a8b2984eb543cd1f7e10c9578b61619f4
SHA512 493eec4a6da4678eb145beca6b9d6f78a3a9068ff20c428428331c635a1c25a2d21f204718a029f33a01c4a2bb702b29210acaab8dcb73b1d477749fdd35e6c7
SSDEEP 12288:YSIF9Mz6kOYJ9kCipF9KQe4LiVj0asok:YSI8FOYfVipFMQ3iVjPsok
MD5 SHA1 SHA512 SSDEEP

Submit Download

advapi32.dll

Path C:\Windows\System32\advapi32.dll
Size 673KB
SHA256 e92f9f71ba5a405c5d1a51bd03d6f830f004aca05b80b5bcf525514eca4480ef
MD5 e70a1568a400e71a8e644652fca4c925
SHA1 6cc13f29c70b41326832b2145e134568e5d9a3a7
SHA512 55863e94e2215b3016df306915bfdbf85486948cd6b1f08e924b7f14539f1ad8fe9a8bd88226fb73f2ce2811196bf48cbff05ecdb8fb3e6ca7cf22f28451fa67
SSDEEP 12288:Sr0imLVILaIn79vpONQ9r4S+3Rcc7/X4Q2ltOVHffCYOQwkJ6XiPDZAm:FimLPIn79Em9cVh/X4Q2ltOxfAQwkJ64
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe

Path C:\Windows\System32\backgroundTaskHost.exe
Size 19KB
SHA256 20330d3ca71d58f4aeb432676cb6a3d5b97005954e45132fb083e90782efdd50
MD5 da7063b17dbb8bbb3015351016868006
SHA1 c6e63c7aae9c4e07e15c1717872c0c73f3d4fb09
SHA512 16a8e5aad8900cb2da6d2e06258563eff56b4022092a750c16da50496ec490d1b761d630135cdf313c0ef96d6f30cce09df9ebca0de96e854f2f901b34fd9d1f
SSDEEP 384:s5daovOa6xo3rHy7WqGWl8hDBRJykqQ3klGs6mJJc9:semHbHypmh1PJGDc9
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcrypt.dll

Path C:\Windows\System32\bcrypt.dll
Size 142KB
SHA256 0f14bb6286686143d6192376c2f965d7e71a0c3fae73773da56a7fcd5e355f4d
MD5 a4be5153c4441ffeda74aa99d4b2e830
SHA1 fb5de507fc8cc3622d225cb3f5e551c98dc10b51
SHA512 a2e1bee101cf045875654be42366ac02dd06a3aa4d85495290b99bb60c5b3a7aaaa39dc17e7823a07d08bbc4757b49062a2682573325dd9315dae6c393b07aad
SSDEEP 3072:Nn9anK4OmTCpsHPOKaQYRdeJa5KPHjotZkVv:Nn9annO0CpE9afXtKPHjdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcryptprimitives.dll

Path C:\Windows\System32\bcryptprimitives.dll
Size 517KB
SHA256 cfbfc6e742fbba525b49fc1d650003ca4fea1ae632c3d265ea008f3d6eae5d0d
MD5 5204c0caa08dfe32b8423136f5f5668b
SHA1 ab5211d347e77cbbc1e732106f32de3de8307bef
SHA512 943d0406ed16b0cf4b34d47188988d7c8235e431a4cf17e1f5fa11c032f66ea575e54c404fb944f7edc595ead9487934333e5db8c10a494437356820d2c24dbd
SSDEEP 12288:Vojm7KfBDjHy2mby170h0z4AS0aDD/CepnF87oqrioIqk3Y12+n:VojmG5C2G0aXKexFgoVoIx3Y1dn
MD5 SHA1 SHA512 SSDEEP

Submit Download

biwinrt.dll

Path C:\Windows\System32\biwinrt.dll
Size 338KB
SHA256 3b7c5fd6920f53c0aabf31e990c4274a98f094ab2d304a0a46329e2fcca16b43
MD5 7c2e41da3cebbce1706bf883c1a55a0b
SHA1 16b3fd17ee2ad8d3abe161735e972babdd76fdb5
SHA512 e6a0f16a8e555dad01c5424de8617211acacfd1673660bc9004dff06e674f28ba88e3fe0a7ee8ddccee0eb713de16beea820fe066a894c648d6c82fa933a6609
SSDEEP 6144:6HFu1xIPVlt9gTU19iFrlw8/zE3inmqQJH5/HmTo59:MFu1xItlt9mNlw8/zExWTon
MD5 SHA1 SHA512 SSDEEP

Submit Download

cdp.dll

Path C:\Windows\System32\cdp.dll
Size 4.6MB
SHA256 e88d8f8c3a4d1e836e1b8bc802dae6acd04c655f371ae9976e1ca7e45faf5921
MD5 6517f92fb018d4ad823ac6f468129ebd
SHA1 6975e2a549127ac9016ec4697213fddfff518db2
SHA512 47458c9d20218c21a841ae32d418a3a038cad355a3fc779e1ec950c618acaa68b13cb3c2d79d5f34bd1c46eff5aa3494fac0eadb1faf8b9730fba0edaee38f56
SSDEEP 49152:H8kalXfBJVZNqQbZMSkrHiVoie1XqPDiQ4wi80wOHZ5HL3p8FGKdj26TO46SGEbB:IfPHNqIonIpjBO46SGEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfgmgr32.dll

Path C:\Windows\System32\cfgmgr32.dll
Size 298KB
SHA256 cb82c3b7c8734e891ddcb08c7890599e563498bcb645bb15cbf819fe8a88e3d4
MD5 1aeb3524cc1162f97a87ee77810d0c1f
SHA1 bae55961b55a36ff0b74edced581219c1d0d9c0b
SHA512 8afeb136712197a3285c96caccb0e6aff53fc7bb25e82f3cc31911b6d14e4fe5f72418d69ae88c3b3da36759a1c00c54afc6c01b7536f5033dfbea76ea7bcbf0
SSDEEP 3072:nyeGr2L/Qk247f5ZAr9H6A0ObeMRJ02ufVaOBPrTd0zQDP3ALmcdcTc6M2WhnR5V:noa4kB2H6Ob3bu9DBjT7Mi2IfWhC1w7
MD5 SHA1 SHA512 SSDEEP

Submit Download

combase.dll

Path C:\Windows\System32\combase.dll
Size 3.3MB
SHA256 4d4f893a1e260c4e9e286eb9ab4ac3e9b356495da05b691fc40e65056767a7ab
MD5 b1e221f0f19f7a1e56cddc254e8ca5c7
SHA1 490c54ab441f11b64dda968bba5523b9cf87176e
SHA512 58134ac9cffbb08b24efea681138d53489f7d511ec4098d33bb7b003968e851b5bf17b84f85b83b56407682ca0bc2354a8e388f05da1a9a24435490fda5b3977
SSDEEP 49152:o+ccYQyMFVoXM1avFZq9TUfHYKkjhGdJSYDpiLO:o9tHd
MD5 SHA1 SHA512 SSDEEP

Submit Download

crypt32.dll

Path C:\Windows\System32\crypt32.dll
Size 1.3MB
SHA256 751b8a2acedbc7c735146272e985d121e17936383c5ca1f326cca3bd64113b01
MD5 b7c42e5bcdc5bf82b294171a22654473
SHA1 3b0075817ac0a6c38b403d5b19ddf919f96a19f2
SHA512 263337d0d3b4d2fb58b91ea3563d06b322a4c369f0c0500e2a19c370a9dc0463d67d57857a28dc0e15f81635af17503285aa4fb08a5d8b40199610e4eae5f503
SSDEEP 24576:1kYdyWA0HFBOe2vVBkR3vpU8rdv0zYZS/8ZxQwVtH:vdy/0lBOesE/Xr50Yq85VtH
MD5 SHA1 SHA512 SSDEEP

Submit Download

cryptsp.dll

Path C:\Windows\System32\cryptsp.dll
Size 81KB
SHA256 82027b8c6ce412f9c9731af5e904291dae944c3845ebfef2af86c8543c8ad5a7
MD5 a26d9bd5fe9f31f2d47f81ef95876749
SHA1 03aaa61cfdd8c9830383dee534fc984ef0b815f7
SHA512 8fbe40e851826646bef6e3becc5a5a8ad64bf0e1f3c4c77c133a76491401fc0906d442f41a0c609b7f6c5ffb8cd2a8c9eddd63c135ed38de7d6b81b7d288b2c5
SSDEEP 1536:DsF7RqXLzjrQQ5YTtNZHr8+hhgf0j3hApiCxbTqxtAjfP8y:DsF7iXcP8+XgcThIztqx0fp
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsreg.dll

Path C:\Windows\System32\dsreg.dll
Size 1.2MB
SHA256 7fdba9b0590474274895252dc78675b7f8eacda80baf211f45a7d9ab9801b42e
MD5 820b56add74a9ed99409a93f36796f3f
SHA1 04de71d9696c72d559c7203bda715aed223e9a31
SHA512 63417d78ca32b2e94973ce97d2d9ca08f192411be758823c7a2cac4980dfdffa0150c94b442d484f3c5d65eb5937cd0b5d60a14dbea84248da1e973e1fc7292b
SSDEEP 24576:ivO2+4Y4Xme8MBGhKnzdfcyLzzDFGH/Mle1CiUvI:ivO2+H49dBGsnzeyLzFGH/Mle1Cib
MD5 SHA1 SHA512 SSDEEP

Submit Download

gdi32.dll

Path C:\Windows\System32\gdi32.dll
Size 162KB
SHA256 de75aea74bf6453f42f02b949a6a3dc00ecef4ae16310fc4a0acb6d869e1fd2a
MD5 f1590bdb1c95293cd3b487ffc97353e0
SHA1 9b3c7713828bda35bb3e4f30a56d61a2c19811dc
SHA512 5be29ebe010ee79508f806680fb60851d90262877c3f9c24ab56aea3e3d5e0428764f364b0ec592fd7c3daabdf82976ee4f6530902c99eacef4a3c396952fbab
SSDEEP 3072:gRNHGRdqaLZIPTRgN808TemEaCLrrBteHMzMDLQAoCpC4chIPwRTKeOBw2LEf+cs:HaCLrWiGlLc+cI6Tx+b
MD5 SHA1 SHA512 SSDEEP

Submit Download

gdi32full.dll

Path C:\Windows\System32\gdi32full.dll
Size 1.0MB
SHA256 f2f28c7195557af1e6d50016b41839514ea2dcd4716c5c5bb87dd2c200e5499e
MD5 35e1a13f6a0902b4c89f59c89b355c86
SHA1 0375b9e121f10c2d201c2f49c1c014723ccfcacd
SHA512 de155aceace2ebd4a4421eca43a4787faef8371ff0349a3861c480ab7ee56ae43169e34600ad1d52d0342c71dd247d0a589f6ee96cf93c77394c92e88f58cc78
SSDEEP 24576:8a3fx7BzK0+p+A0rvduXCmNvt9KIllb13ywlzGe:lPx7BO0+p+3Uvt9KIV3plr
MD5 SHA1 SHA512 SSDEEP

Submit Download

iertutil.dll

Path C:\Windows\System32\iertutil.dll
Size 2.7MB
SHA256 a40de7fda4a60b9315d1a50453eb2eac2e3e720490239510e213b0e9959db76c
MD5 41f1fc3ccd219c58d2ed91a0213f6693
SHA1 72bb4bbf5dbe64993cd005407c565264a7388879
SHA512 cdede15a88103a4922c932b0a0208b32da88b51fcb2a1cb87db237b413cc42821705ed29f253827af7e4cb435ca8886b8bbec2b97240ffa100cba880a584b56d
SSDEEP 24576:4pAC4Ua4UZjyQIRGIfFNuEly6ILnHX7x9xKvecpxoCKV/Y:TCLUR4Hli7ZanpxoCKO
MD5 SHA1 SHA512 SSDEEP

Submit Download

imm32.dll

Path C:\Windows\System32\imm32.dll
Size 181KB
SHA256 00053aa7be3825828ad7c8c1c9f9ad29df07f5538107479886d8427df86bb4f0
MD5 669d9741e74156425354ddab8bcc581e
SHA1 3384654e76559fc6900e58296967ed89757ba8c9
SHA512 b520fdae3489202e532e11c73309f5b2a960f202a5872d25377ee2622846066eaff54fca61930426250787e55f243e30430dd6d3ffad004e318c6e6ed597921e
SSDEEP 3072:W8GBTTrjijAoUsxGuXo3wITZaDclJSalfI1X+6mh2m5sHYQ:W8/ATuXo3NTZaDSoawXbmh2m5sH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kernel.appcore.dll

Path C:\Windows\System32\kernel.appcore.dll
Size 59KB
SHA256 7d6c60195dfb05eec27377ae25d9ad259d7fdf85fa71d2aa855fd4129c2aadc2
MD5 af68fddb20df61ece812b542176949e4
SHA1 cdba1cc8fd390b4f8101b5a22b0aa0ba5605c7db
SHA512 dbc0b91ac07a640f2c8e6bbb76d95b29199970d282be1aaf9d31e965a3d071440da55862d5f949349a92f86cd3e7a69d9b3cc346fae7fb67089af99f3b038bee
SSDEEP 768:DUuelt7oci5gWol5xOVyFA8Y6ua9KWr6wD1PuEvzrO:DbGt035gDl5YIhY6t91PuizrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

kernel32.dll

Path C:\Windows\System32\kernel32.dll
Size 752KB
SHA256 e5988a4597838f07fff021dd6c1653a8a459ed6caf2a63da95ec42ab49d37e0d
MD5 1b6d9bd5677f3fe825a7c393ec60dc64
SHA1 095de4ddb7bb0b3a20918ce78083382ca2eef872
SHA512 9f1869acd9437f74f1b581e5256a2186b9e24c4e68984e58493224c0e575865d48175f14ec2255948d1dc0c79212c272b9ad514466f21bdcfe98b1d7d5f25798
SSDEEP 12288:tQnWOb1WA37aVPo8kpKp0Gd8LH6ZG6HF4W7tRcQrHYjsX/Sa4jb:t8WOxVuZPk8f8L2BPpnrHY4X/Sa4jb
MD5 SHA1 SHA512 SSDEEP

Submit Download

logoncli.dll

Path C:\Windows\System32\logoncli.dll
Size 254KB
SHA256 b84469293584b8ff2c0340f48535227d4c383d558bcc30d6e16a292d26f51cb5
MD5 5bb04a7a8c4035ec97eb0acc36e6fee4
SHA1 16cb991a12c1a1d93eb5ff5293b6048c2350e04a
SHA512 b8d6f3baa6d7694d4c730f36e236c5ee5606479116e86177d36ab22bae460a85e26239a4619c0f1622b2bb6ebe2918f3a85844a043dd868709918c19e871d0b5
SSDEEP 3072:FT7SOOEyNj+ZOAhswcxYpITG/qYkMOwgzAM9we1gjGP3qN:FT7SaZP6wuvrwNuC
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp110_win.dll

Path C:\Windows\System32\msvcp110_win.dll
Size 547KB
SHA256 625cf50cd7fcd0e16d0e28514e92919b6ebfb9cb07cd1803110fdb0f5368aca4
MD5 f084efcd67d2deee55137ee8fdfce0a9
SHA1 b6313cbcf5a220efae747eb19ecc5f116cdeeeda
SHA512 11dc12e31838a05dfab4bd0f8e3a07e5ab6a1950ff780049ea7cefdceb14df92b6de2c9e8c8153f036b7bb19ff96a3da343a7ae9d97c5479ff3e07d47ff022d0
SSDEEP 12288:SAW0kBNm7VriePh0CRTp6Qwv7vNEKZm+rWodEE7fv:c0kTm7VriePh0CRTp69DNEKZm+rWodE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp_win.dll

Path C:\Windows\System32\msvcp_win.dll
Size 619KB
SHA256 fd1d0cc8a5ac8bf20af9e1a7ec360dd76dc022dfe992556948df1c17f7a714d2
MD5 34692d0bde33641b576c32165fbaaf6d
SHA1 09c6a238c7b2936207f261562079a327aa9ff34e
SHA512 7d65519f50fd61b08fe7f676ff98a526c469dfc045c15a92c13d2e2227d41cf2c5fd4bbff4d15a6da22840be4bd7ed02fc03bf96905787e7356eaa0066bbbe47
SSDEEP 12288:UXTCudddboDSf8I+YQtAww7ZQEKZm+jWodEEVM6LZW+V:UXTC/Sf8IdQKQEKZm+jWodEEq6LZWq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcrt.dll

Path C:\Windows\System32\msvcrt.dll
Size 622KB
SHA256 dd7c8bc34cdbe30ef921395e874909bbf6be53803822164f75f7207e9f085650
MD5 a4f2d5942fb447cd48a5cee414983e85
SHA1 5aff4cfdee689f127df3c555281dc629d4d62318
SHA512 c464ddc6aee00721fac488256f4ad643634c439558b9ab5f974be9633961a69c99830a308aabeb91e930ddf0d527cd0d328a9aebf1fc2e807dfa2cf02abec3bd
SSDEEP 12288:TuL6kDcQeKOuNCg7E6NnQCTNv58/PnHzntBiyopdQNwTmVy61Obo:SLTelNoE6NQCTjWnHzntBiyopK0mVy6c
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntdll.dll

Path C:\Windows\System32\ntdll.dll
Size 1.9MB
SHA256 12d1bac765448db638adc8327de1101e5e2eb5829b8da7edd5b216a45c717eec
MD5 47ccb0e28d73f695c5d5266ffbb300ec
SHA1 63e6167944df951ad2d279d0b64e37bf2f604c07
SHA512 8219f5cfd7a6bf28b8880529240e0b49a2fd78c0c5227cf6471cbf153fd32b2664ae31396d4b6897c2686e5b7826b9f9dad434e82e7032c7a5aa3ee9b2771145
SSDEEP 24576:+jDIKW2lX/rJ9cHcqmfvYbk7FKX1LkS5KvAAcHzzd+2/40tDsNx7b+fU:ID7DEpmfvYbknSPBTzddg6DsLm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntmarta.dll

Path C:\Windows\System32\ntmarta.dll
Size 187KB
SHA256 b2eb064f3d70f08152e1845fbeef64be204fa44fa56d2e58a645e15db5505011
MD5 3847505289cb4d4454f8dc5a866338a8
SHA1 5a5db0243ff6c10865b1301712647bbb416d2b07
SHA512 776307a08c3d76216d69253c11b18ffffebbe872baa7574d96f79597370ead896d6e5ce3325a0f396bd5741c5afe90c60bf1aa3088146a439410043ab06f432f
SSDEEP 3072:Ezfddsov5P541i/yKXRyOHFdy/cSfxwFAU5m09FOveNuAe3RMUolUHQDNhJSHDV:JC5xdHFdIyVs09FOmkqlIQDNh
MD5 SHA1 SHA512 SSDEEP

Submit Download

oleaut32.dll

Path C:\Windows\System32\oleaut32.dll
Size 812KB
SHA256 bbe70836e44ba71555906d37011ec2aa3f86bd1314f5431406bba8f305dfb570
MD5 eab5aded2242feaee371ed5cab6ea919
SHA1 d9d46f3be08dd8b988b873c4e034c622bc0fb119
SHA512 44debfc49043003a3e95af09e6687783c55f31009fa4d156218f70fc4ec41f1f086aa1eaa2a5b044f8d1982554a3be525625c28ca617b9db19f0558b27559c7c
SSDEEP 12288:DVxBGt9lCED1GHQpo+4gM0yDQdD7HDfoRKv0:DVzylHYwo+4pZQdD7cR
MD5 SHA1 SHA512 SSDEEP

Submit Download

policymanager.dll

Path C:\Windows\System32\policymanager.dll
Size 633KB
SHA256 52fa7c1da3158a75ead78d2e011cdf98031e25521b5b369d23b2c3a53365264b
MD5 1500d26519d73ae1b997421081459a38
SHA1 5d1dead9ef60c8b47ffbace82794a8d6a2be29ee
SHA512 4cb99bbbdc8b3ecf200aff69e4dd8a82b590848da238d37c2e44e30366a821275c43e567043eb2dd068d494da464dcb7b3816d04f044743718ec6b5f353e8eef
SSDEEP 12288:MUFtkDKo2c0c9I29h+UaNtvQlWJ0B/7IYAGv9DC1icwl8+Igs5UuDxOOh9z/ztc:MCtk2rc0c9V9h+UarvQwh9zhc
MD5 SHA1 SHA512 SSDEEP

Submit Download

profapi.dll

Path C:\Windows\System32\profapi.dll
Size 113KB
SHA256 313cb7c9a69d5d84308a1c4b78c8ff257854071cac7918bc31d1b893feb95ec2
MD5 4a7468ff74f0114626b2f7d1dd5d9fc7
SHA1 0094c51ce445d9986ad3a74959c47c7ec4e25504
SHA512 f9ee2bdb3158ea7920e241b192a62c5bc3ef612b171bc75e085019e3a2139a5987b2c280cbccc49900695cb667887ac5229506d314d492e4039a9d28027d89f0
SSDEEP 3072:A2FdiUfTRNfOdV16f2oQyqOYMG3efrseplXL:nFd7nfC1cCoYMG3eIer
MD5 SHA1 SHA512 SSDEEP

Submit Download

profext.dll

Path C:\Windows\System32\profext.dll
Size 153KB
SHA256 43fd290cbb3b4507e6eaac48c4fd13975252c6b388c9affa7808b1d23c212b04
MD5 a5a2db4e33eba0b1387aefb0a6cd0574
SHA1 bc4916d5a5c053fa0ee01e341d4962cd7049e6bf
SHA512 52195b797ea4e27c26e709b90b4fb70ea83745774607aedf23a0fd0e79a7ff8ea7423f7884675b6008fe1195d6fb5f7349b78297e4e3030f720256ef8a38fab8
SSDEEP 3072:4bbhSuqy8bmCJHYqqmgzVyVg2vALbJpOU+uOOOOVOOOvtIc3zqOPGgV7:4BSuqzfSnvzVR24/4Nz/GI
MD5 SHA1 SHA512 SSDEEP

Submit Download

propsys.dll

Path C:\Windows\System32\propsys.dll
Size 979KB
SHA256 bf1a5b4b8178c8092347e0c977e0b1bc11a287f703d5ecf68575589ddc6655f8
MD5 b5b4006acf4d06112dec1d2d3e86c431
SHA1 0fe3f7f5ad40e9b902f4438f55cdcfd9fcdb5cb0
SHA512 0249f9fff40a135356120e9a7eb8ae3db0904ba0554bda125b20c264c1e93f4960fd713b7ca8d7c02202034ef0d0bd623bdf558834ed21ad5630f36036b38f45
SSDEEP 12288:8r7Jy9btTJpeUw1ybBSVdJ7nC++6tIW9cPJPuGVmPN4S:5tTJpel1bVdJbko9cPJPPVmV4S
MD5 SHA1 SHA512 SSDEEP

Submit Download

rpcrt4.dll

Path C:\Windows\System32\rpcrt4.dll
Size 1.2MB
SHA256 c84bbd6d2e4f0334d75d6199133515fce3d44439062095f0dcfd1f8df0f5183b
MD5 dc0b01c678d532758d2b1fac1566f89b
SHA1 b35fdb8d452e39cdf4393c09530837eff01d33c7
SHA512 7a898d3ef8ade5047ebe59ba1aa3a82ccd6ac0d12ec0828726dc49ee2791c2c12188052893e208374040c64f26c905fa08363740327735becf9b2fd79e3792f0
SSDEEP 24576:jJgvgB/03A6KKb1EjNvJ1ET7ZaQdePt6KEzQrAdMl2UTS6:ExKBjNvI74Q4tgz4AdMlDu6
MD5 SHA1 SHA512 SSDEEP

Submit Download

sechost.dll

Path C:\Windows\System32\sechost.dll
Size 610KB
SHA256 f900de6143d808a03584075417940c5d42bcf612811a19129059a696be8645d7
MD5 e127fce942c28931ded1442a1f2e84bb
SHA1 2afe30f581351040cf0f6c721fcd33cc285158e9
SHA512 c6eea30c104cf775a2732492226570bd9cecd65efbfc8f33ac9fae1c2584f8bc0a3121b5dc3566049a8f12aa1260ed002ce39d8b0c996a17c139960d1b20c248
SSDEEP 12288:/Nta3A9E5yUoK6MPbq7mJQwOca8hHiewKu/8qSnaX4:/TaQE5yUj6MP+iJf93hHiEc8qSnao
MD5 SHA1 SHA512 SSDEEP

Submit Download

slc.dll

Path C:\Windows\System32\slc.dll
Size 143KB
SHA256 a68d1f8265d6a1175e55283a6f57b96ac94bad9585d19d3d56f8d2c6d4c92df4
MD5 4f6f869094d632eb65e88ca037986aa3
SHA1 681b0201ca12047db8768462497be8aba49fea29
SHA512 1d292560d7c91c4922113181ae757f15e61c43edda5daa68e83f946c9abe5d05272adcb88a2e90592adb002148a6cf924c0478c4008edd4addf56d6d3f4e3f3e
SSDEEP 3072:XK1TJADrUrxgstq1zLZviqCHpLWc8j0rFqCtQEuZIZ8oqD:a1TJErU5tq1zLRiqCHpLD8j0rFqVEumU
MD5 SHA1 SHA512 SSDEEP

Submit Download

sppc.dll

Path C:\Windows\System32\sppc.dll
Size 127KB
SHA256 63acba2d7b1e0ff51b1fb5eddac20b89e7d47051a4d7e3180da4f99ecca8ae32
MD5 1a344a53306779abd7a3242f7521ca19
SHA1 93105d0b684532fd5ae8f302497beec84891087a
SHA512 d622a97d475094d0043b49bd34ebb8a1ee7f89701715ad147f172a6809dedb8d11331ae11a860dbcbe108dcfc643f5d6f5673b2b8847c9ff1e03dc06a70fdf43
SSDEEP 3072:BKwZi6GZQGg8WBKZDfmjn5wZX9vvm8puN:kdFgp+7vvm8pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

sspicli.dll

Path C:\Windows\System32\sspicli.dll
Size 182KB
SHA256 74542c85c237583a61bfd6296e7610da2973872645ddc614ad837705d9c4ac72
MD5 956ad5a3683b1d05ecb2927114682495
SHA1 1c241020754267181dd501949e0d43f35f0a4d10
SHA512 39b691f216778a42eb8351cf84222c42d8bee81ad5ddaa480dddff36c419778abd63d08cc09a431df18b37fca4f98af104dc8ab7967b5864c90b77474f377a94
SSDEEP 3072:/ueItsrELq6lIRlJzPFQ0yCy9uU+k+xiC9hcFtwDsVzOPaqCXYrex8TUcBd1+J/e:meItsQ+6GRlJzPFSR9uU+kJQhc0Dtexc
MD5 SHA1 SHA512 SSDEEP

Submit Download

threadpoolwinrt.dll

Path C:\Windows\System32\threadpoolwinrt.dll
Size 66KB
SHA256 192e53a11e563333ea528dd2682bf97690f7d9b4b15dfb8fd111a39980a513ec
MD5 a0dea5c1f4ad089439054c8c0ae8c8ea
SHA1 5f7f1fb7dc8822573ba9130fc5395ea8d94d0258
SHA512 e3632430f46fe2cda4f7db81e93deb0bc9b1ebb8ffd25d6fee5a3bdf3c8036c0d1374b729c06ed42c91aee2f6b34765d1552ee8ece357753ec984bd64a6aaee5
SSDEEP 1536:cTE/O1TKBDbgjU+KJwCHocjj+Mt95ZbA0qAo:cQ/O1u0U++g2qMt95Zb3qAo
MD5 SHA1 SHA512 SSDEEP

Submit Download

twinapi.appcore.dll

Path C:\Windows\System32\twinapi.appcore.dll
Size 2.0MB
SHA256 73dcb1aee444575b40f189b90af2058664a4ed5e1bfc6f13f5ed925550292732
MD5 17bfa6a3976985873eac662f03341cec
SHA1 a06acef0a8fac114709f9fa61ed079724559bd9b
SHA512 19953627c1bdb87581d18cf0ed85b5091a2c42a43ad115d2d72a13d609f36bfacfb25e3a560e7f6be975021bf091ecc3672a5e8f97f35bc61ee8e59f6fdfcc26
SSDEEP 24576:+tNW8H4z+fO9z+KkLdT5oZaKJ140xvT1GR1F25hio1nD64OMSy4OUO3Wy6rguQo/:+t8WS+f1KINmZaKJqGvZC1m2Y4O0Muh
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Windows\System32\ucrtbase.dll
Size 1020KB
SHA256 de8d08d01291df93821314176381f3d1ae863e6c5584a7f8ea42f0b94b15ef65
MD5 2c8fe06966d5085a595ffa3c98fe3098
SHA1 e82945e3e63ffef0974d6dd74f2aef2bf6d0a908
SHA512 fb08838983c16082a362b3fc89d5b82e61ae629207c13c3cb76b8a0af557ad95c842ce5197ae458b5af61e5449cbab579f509fa72866308aa6fbd3d751522d0f
SSDEEP 24576:k1foGwlaDT2hOPk+j2ZXCE6ccJEsmxvSZX0ypCDb:kfoBRhOPfXiL/
MD5 SHA1 SHA512 SSDEEP

Submit Download

umpdc.dll

Path C:\Windows\System32\umpdc.dll
Size 63KB
SHA256 ab37401f78b29cc26db5b27b3dc0cec3c37ce99ad4e9df6ebb54f4a239f30232
MD5 8cdd866e0707a71952fba8be899b7512
SHA1 25635102c3159c4ca42e802492fea502316054ba
SHA512 51225b22a143fb390116112499e5c10c2ffabcc1c582a0f8e04d7c913cfcb75f79bb1dcb5310408dce81389c22dec00eef5bb4df6fcf4c7c76de141ef8ef28f9
SSDEEP 1536:AMwE8iBRdHEZvGD1+q6J0tUQbNbBPtRYcsPA:RzRdkZvGD1+q6UUQbNbB1RYZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32.dll

Path C:\Windows\System32\user32.dll
Size 1.6MB
SHA256 a1331a9b4c8cca6ccdda97efa7b57fe249cb1753b0ee9c212a41856866c21b23
MD5 f804d60514ec31233e6df99949b7ff1e
SHA1 96d48b58e741a33d6729d4d2ae57f7f52a0d4961
SHA512 fa60f5ea399a316946dd35c0c346ff6cf19e76d905055f4473f11edd47dae937efe2482ef4a0bb435aaf68d4aa29ead23c538231f66d2a58499d79547341f58a
SSDEEP 24576:TNjNU+J4wogYQIA4wPrfZk9BFAoUXlJJBwuCx59U4IgL5pQ:h94wogYQIA4qrfqIokPJBwuOTU4IJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

userenv.dll

Path C:\Windows\System32\userenv.dll
Size 172KB
SHA256 de6f6cd7d703dca17c147b358fb0ded9b763c5642c56dca0280204a8d3e2cdc3
MD5 6331627f363f17f1b1d28c4fe3fb433b
SHA1 31ab07ef67ba94c1d219235ca7db246b3d0f2fe2
SHA512 26affaf64593cd41b970310f91f9ba445d78a01afe373bef6c644c9eb6357671d3a6c1e210981ac43eb1d0d3d33687595885f52c37dfc2d47e6930fa65a9531f
SSDEEP 3072:f2xmnI9BQ25GxNg6ED9ANM0wHTsVyG8DRTzWEZQ9OSL0nRRDLx:fImzx0mCHTsVyG89u9j0Dnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

uxtheme.dll

Path C:\Windows\System32\uxtheme.dll
Size 614KB
SHA256 8080001033997f644aceb6a08c9a8fb445a9e338ec3202fa819936dc71f06367
MD5 77b94683930015f413c0479f4f21e8f6
SHA1 e5703d9697da0d23023980847a48eb3e49f22458
SHA512 57ca6c40b9c5848fc5aa5e3df73249af41dfb09e3b84309807b6a84385cf7d4324cf831872e42ce456fc1302eccde3aeef8feebb57aa451811540fac25545924
SSDEEP 12288:BOXTGVgMfb96X8bPRUWDqMqByjSB3a0Vt7Pgw:BQCZfJ6Xmk9S2zPgw
MD5 SHA1 SHA512 SSDEEP

Submit Download

win32u.dll

Path C:\Windows\System32\win32u.dll
Size 129KB
SHA256 f9f54817d8174c8cefecbb36c1c001d8a088bfd87d769d38f2dd0b5108c668ac
MD5 1fb6e05a75de3ac92adfdbf8f8dd2bae
SHA1 5627fd2027f52276b790c2c4a6ac39b5f370728b
SHA512 a26f4a1583e77e0d2b8085813b40b17e5e007dde602f92a1e0d736c41b1adf56bfa0a5bd4715dd281cf7acc33d034b8dcccdbf71ceddca8a8082368181881eb4
SSDEEP 1536:e9d37P99r/EcfkJf8k7f+sBi5igjWu9jhk7OSM9q/QOmlvPurp:e9d37VV/Ec/k72DY1vS9qI/lv2rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

wincorlib.dll

Path C:\Windows\System32\wincorlib.dll
Size 427KB
SHA256 d8dcc13ee3c37d6412c120a6370a15ca3d103571f7681fefb06709d8191f95a3
MD5 61f81db6484c0e94820ad6f8bba5a03f
SHA1 167e549bf81e0c9d27f8481ce4904d8627549e1e
SHA512 7634db3a104d3ad4ef9970cc506111d58c5ff39f9affc27abeab6556b1c1dfd4b0e2e7580e9410c2520cf6cc3d75f8f8e9c0bfd8f2980cec8dcec88e6a7b68e3
SSDEEP 6144:59d/OzzQpV7aGqg3DSGnkZ9Ds2FO+pvp8dUR:joz0/7aG8GkZHFT1Yi
MD5 SHA1 SHA512 SSDEEP

Submit Download

wldp.dll

Path C:\Windows\System32\wldp.dll
Size 168KB
SHA256 08225860b8e9b712439cd83bc3a04fa802c56c5fa6c2471f23e0047ac639f1f5
MD5 61f961a945669430557457615cf53493
SHA1 5b12fca5bf3ee6d0bafc18f96dc81604bb95de4a
SHA512 a89e09a2897e496b39ca6f6b30e4545c195b4524936b4b184fe2a65aac1901de6c522c1eb573954b4279c008e2b7c030249f87f327379735c393ac4e44cff6a2
SSDEEP 3072:8th1n+uQ6FQYUPPvrF4F4a9Jme90+FcC6O0rthsMnk0aV44gZzU5pWHArQ50dH0M:8Pd+j6FQ/3Z4F/Jmeyo27PkP44H
MD5 SHA1 SHA512 SSDEEP

Submit Download

ws2_32.dll

Path C:\Windows\System32\ws2_32.dll
Size 417KB
SHA256 1f996574f38219cdd848375f517f8d86e17542bc84d64cce63aa0c64cc15f22d
MD5 6eed88c1206032a2797abf131c6242cf
SHA1 2865c9ad28810c59f5eeed6f894467c9eb2c4ee8
SHA512 26ff0c48ce331e4d60b1933bc04043a5c5b761e2202652acee27c48a567ff25d11f3a0a49327e9f2d02bd656ce94506a5ff5880bb9ba07878e84784843bda4a6
SSDEEP 6144:+LICVVHTKYExs7v27vq/zf6uWPYKNZcSHyKE9LxfDY5o8jjxPKNzLJn4t56M7BVL:zYjr/zyuOLFSKqLtDSiNp4tpqU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads