44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Analysis

max time kernel
654s
max time network
616s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.js
Size

2B
MD5

99914b932bd37a50b983c5e7c90ae93b
SHA1

bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512

27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
1884	iexplore.exe
1884	iexplore.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2588	1956	iexplore.exe	60
PID 1956 wrote to memory of 2588	1956	iexplore.exe	60
PID 1956 wrote to memory of 2588	1956	iexplore.exe	60
PID 1956 wrote to memory of 2588	1956	iexplore.exe	60
PID 1884 wrote to memory of 1432	1884	iexplore.exe	62
PID 1884 wrote to memory of 1432	1884	iexplore.exe	62
PID 1884 wrote to memory of 1432	1884	iexplore.exe	62
PID 1884 wrote to memory of 1432	1884	iexplore.exe	62

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\file01.js
1⤵
PID:2520

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2600

C:\Windows\System32\winlogon.exe
"C:\Windows\System32\winlogon.exe"
1⤵
PID:2428

C:\Windows\System32\Boot\winload.exe
"C:\Windows\System32\Boot\winload.exe"
1⤵
PID:1180

C:\PROGRA~2\MICROS~1\Office14\OIS.EXE
"C:\PROGRA~2\MICROS~1\Office14\OIS.EXE" /shellOpen "C:\Users\Admin\Desktop\ConvertSearch.easmx"
1⤵
PID:1440

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
1⤵
PID:1820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\MeasureResume.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  PID:2588

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\AddHide.mhtml
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:2
  2⤵
  PID:1432

C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\ConvertSearch.easmx"
1⤵
PID:1872

C:\Program Files\Microsoft Games\solitaire\solitaire.exe
"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"
1⤵
PID:2276

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2376

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2852

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:1480

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2440

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2988

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2016

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:1740

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2344

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:156

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:236

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:576

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:1720

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:1180

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2044

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:632

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:112

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2628

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2560

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2340

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:1664

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2300

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:1440

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:864

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:1600

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2580

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:888

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:1872

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2728

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2280

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2536

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2284

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2272

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2468

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2308

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2740

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2640

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:1620

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2040

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:1596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:1848

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:1484

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:1944

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:2488

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:1104

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:1160

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2212

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:452

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:1516

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:332

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2956

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:1888

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:3004

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:1272

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:2996

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\NETSTAT.EXE

Filesize
31KB

MD5
6f39f6f48cd4828b2c87eb2d2cab45a5

SHA1
ac4a74d027962554608ce9a90bb8204788abcd3c

SHA256
5c748735f5d876a84163d16b042f3ac92d27131b352012e42e16fae89d1a890d

SHA512
3b26a9083a077ede60ea17c584501b112c8050267f14bc18b3710c22f2877c381e6bae2233083610dfe31853962658c4e516da3a6102af20c629e8b97f3132cd

Download Submit
C:\Windows\System32\NcdProp.dll

Filesize
23KB

MD5
f4a779a191f9d1e05df33b390daec224

SHA1
26b14b21f513acff491d67902f5893d19929d720

SHA256
ed79af9f912da36f67bc09742740039d785e51713ef0a4a1da4458614c082357

SHA512
af8395afd200a27fb46ac082da9e1169c1d65595ea1e1c8929de2267e155104af2ead6c7076e4b9bb6b6f635580255c281b4e3883522c8d5e37bcb59a2924b21

Download Submit
C:\Windows\System32\NdfEventView.xml

Filesize
565B

MD5
86166daa04a6c154826508304cc6d4ac

SHA1
268ec08318a53dbcb1c387d4532018d6d8899cba

SHA256
886fd04b819586a8d78dc97df3061ded9a7065e65d030bb02893ed658e29ca0a

SHA512
6a0732b61c35139d50528301df03524245e47aeac25f61f9fb247504f06caf6f086dbaf640743a6199f6c4b9137b3403a6d5ef983606cee506a4719b437fe09d

Download Submit
C:\Windows\System32\NetProj.exe

Filesize
88KB

MD5
7e4e6ae7f8368b5c1438b7f9041ca2ca

SHA1
f9b21003cca0e59b09e3a3790fd47ce155adfff1

SHA256
a840614692be75abd5234541fa80d734dd51da0a8c8ee43db42d85b488b0b320

SHA512
7e89744ce5174e76ecb75d821f3fdcad1e52ab656c428f87f5a1d10eaa8448bb1585e08db7d4c7b3d5cbbc85a1a825ea36c03fca2d7c0bc2001466df7629905c

Download Submit
C:\Windows\System32\NetProjW.dll

Filesize
1.1MB

MD5
47cc4ee5c9d98dc4f03fcd77df8df176

SHA1
842b066e6b8a52f056ac8ebb7a2886af5f606a01

SHA256
b69db74cfc7b39605a9c27c57c930abdf098e0a086d73ca8db55ff3c7f9273b9

SHA512
d4e0cfca0353989c116dd44841ccc9e81c76a0f52ebda976a0c56f4a45c5f758bcda5ee3eea035c7fbb1201c17f6e9b25eefe0c6120f16b6fb0b541fe4faac3f

Download Submit
C:\Windows\System32\NetTrace.PLA.Diagnostics.xml

Filesize
21KB

MD5
cd48ad912839b9fb6cca5d4aa9b37500

SHA1
bfe2e667a0bd9facdbf8f24f363bfb2a6480f315

SHA256
fbf6694058a19c4d870c160d3516700cba3cb924cc6c9b7b29644d64d5d64432

SHA512
4d93f1b170b6bae92c778afc1470fd38300ebce04c5abf8f9605882d176836412e6c04edb3dbe39479fdb4d582d0cb32f849ba555608e38b8293ce0eaf8ef950

Download Submit
C:\Windows\System32\Netplwiz.exe

Filesize
26KB

MD5
e43ec3c800d4c0716613392e81fba1d9

SHA1
37de6a235e978ecf3bb0fc2c864016c5b0134348

SHA256
636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c

SHA512
176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08

Download Submit
C:\Windows\System32\Network_LLU.log

Filesize
40B

MD5
8e24a7bcaef2045da1ff29217622843e

SHA1
8517869e7feaa979f09efe648d96982c088b9d83

SHA256
1ad2bf0b7114eb0564202fb659197ae22123a9430289a754fdcf23e6ff653906

SHA512
47cbe382e8b2f6f257bc2ad4074a900cb28cd4150a5f031010402011cd17db43d470a16814a9bf48ced1c450bc20b070697e121b09f77599cd8794b5df2a3945

Download Submit
C:\Windows\System32\NlsData0000.dll

Filesize
1.5MB

MD5
11542ec1f1c53edb3ccf5aadf4c9972f

SHA1
d4edf1a370ce4dc59b6f578a232488faecd91172

SHA256
3458a80698836b5ecd1f5e61fa1525c4646dda4cdaf11be80e6f11425d8c3674

SHA512
434cdb32c12dcea5eba034ff24a4c0dcf1cf4719e1178484f1bbad47ff1840a32649f11aee101e939eaaccbb385819b9c57d9ffc22bd71b859c63091105d11c9

Download Submit
C:\Windows\System32\NlsData0001.dll

Filesize
2.6MB

MD5
a5bbfcf82d3472483cf60e8787fd0448

SHA1
92572cdbfe09964c07cfde74255ee8f8acbcd09f

SHA256
fee7336cbc26a3dd430f9480e6007520f69f1e02c05d074d4d3a46f7f00f35c1

SHA512
643fbf715955f0f1166679c5b7eb26e151e0b71fa148aaff8075530b4376629243b6e5337f1c958b8a4d3b9c22ae9a613182ec667aa15ba81b2656583d22ce9d

Download Submit
C:\Windows\System32\NlsData0002.dll

Filesize
2.0MB

MD5
08c840e880c35731eec57e23a6ea2572

SHA1
9450013712f7e57ff065aec2aa0f9944c051ab53

SHA256
c745bcab02d5bc8386284bc518c0d0a3cced827722bd79e3efcfbd5909711a4f

SHA512
69fc9c43103f16e786b1df6dd42e8218d0433ce59a9728ab5d865f8f6ce9f3eb43d61ed320a1cc47e9e3a91e17f738172fb495946f6367c8145d45e0ca54051c

Download Submit
C:\Windows\System32\NlsData0003.dll

Filesize
2.0MB

MD5
28943370e3af1d34d77d22911f891213

SHA1
8ec631c09ce3f120ec6295c01f1af7dbb1316727

SHA256
63010e8c8300a976008e7041ee5ec79b0c96c6a2ad4e645e957430ec677c43da

SHA512
b5f1e44b6f18d7deb191b927c67b9d1a25b02533cde2384a76cb19a1fb500e1174c5b3afdc669ac1d8f19103510332ebf88c57ddd79404eba9a59a84fe3ef74f

Download Submit
C:\Windows\System32\NlsData000a.dll

Filesize
9.3MB

MD5
061a78fefa0457fd64f62df791939466

SHA1
d76029b87d300d42aaa0db2cceed48eebc006d3b

SHA256
742e68f3952370d22df220c0d8345c5a3d24d2e792ce4a9dbe84575c910d6166

SHA512
f7325cca94a70f52e9df4aeb0f7d7f51105562e2f87b3789f44516e0a23c41c86a7db8d0e6292f6fad84141941383847656d5dd5e96539d8e70ef720f0784838

Download Submit
C:\Windows\System32\NlsData000c.dll

Filesize
2.3MB

MD5
51272a935f4f482a70f2a7d1c3a67aee

SHA1
c7b7a93e339212a1f022c0d1c5371beba3313acb

SHA256
cda0861fffe918b74e7c30e6a54d9a8b51665acc24185d30273f9782407b0c8e

SHA512
657692e5a1655bd6aaaa8358be91788a5e3555fefabfa9473ffa6d970d41dee89a1fb17d6bbee7b0552d9479076c4c5d97718748955731d3b37529e926797ca7

Download Submit
C:\Windows\System32\NlsData000d.dll

Filesize
2.4MB

MD5
f185e996acbbcdaefcea8b1fd22ac30c

SHA1
9e1ed573d18312b94a74107afa319ea26970a06d

SHA256
a191bedce0f05298ba5047f96bdeb927f55394bffe229e590db1d1748254ae03

SHA512
e9109a5228039fd2e0a95dfd783de22aafff83f8cbdf8bec7748637b0d4202c30585ea8aec7d31d5222cdae9a4a098b38d3efd71206d95767cc3206a336cb65b

Download Submit
C:\Windows\System32\NlsData000f.dll

Filesize
2.0MB

MD5
06740b4ab52412a7d7e9799343c6a1e5

SHA1
21dfbe75acf6600272990687de1449879c5f2670

SHA256
5ef17c151e00cc1e7c9f3f7c959c846bab13d48671735d686e13a581fb968317

SHA512
71de5a59daaad3aaca692537cb91dfc7ff4bad8d9fa8b51a360079c33df472392f8c02b8142c98f40bf7ad18cd7a9adce10f79f3de29e9914d01e227c2e9c9b4

Download Submit
C:\Windows\System32\NlsData001a.dll

Filesize
2.0MB

MD5
a9263f43a5f55f8920defa5db13915d3

SHA1
9252056ac47bf2967890aad30b96efc89b6bbc01

SHA256
a177094a5553b63a786cb7e4b9764093104dc7ea707fa11ca92571a7df64a42d

SHA512
f8f051ddf39b287a04e1b82b9035ad364e369b6238ab6c8254dbf78a75a9fed5100b487a6849a769f6dece46408dab13aa51532b880206ff046ba824b0d3f712

Download Submit
C:\Windows\System32\NlsData001b.dll

Filesize
2.0MB

MD5
916db4feb392bc58239d1c5825e33ea3

SHA1
064a44c2a0d6cb8f092f37464874e979e93cdb59

SHA256
5d1f9aafb557044ba416d98c6eafba8dbaa933e0cc437505aaa3b55469b336fb

SHA512
49bd23cc13a89a8469b82c560729049622ab23de4c5e74f84ff32615387a2e98abd01eed8a00198274862d972402d15f3b10dfdbf3c607e06091e92a455eea26

Download Submit
C:\Windows\System32\NlsData001d.dll

Filesize
4.4MB

MD5
3211daaa9d7d6d723ec5adc07e739db8

SHA1
1bef8a1c228749a2b7ca378c903f90be758842ae

SHA256
801a322c4134aff36ecc23a9d5ca3f7443dc93a2c838163552b31411fe77d813

SHA512
8c70aac9c825b99099ce5b1e22f1d693d0cde8faf73f27510e975943b782ada44b253cfcdc30823034527ed9a3e9f7a37552dc9f95abe1a660627128bee9adfc

Download Submit
C:\Windows\System32\NlsData002a.dll

Filesize
1.8MB

MD5
76b153b2e0b248461bc0ba6cf0d3d337

SHA1
cdff394641c9075e3b604e30d275032481033870

SHA256
6813285de31b5d6eff36215b4abf8eaeea96bf67242cc40245f6ac8027cbbc52

SHA512
fe2733fd12e8cdafb3fb41c3b203b29df9c897c88597e28a68a424c29537c15e348d1b0c16f6e323facd984bec93f327092f956df523a5ca1763988f5897939e

Download Submit
C:\Windows\System32\NlsData0c1a.dll

Filesize
2.0MB

MD5
6cfe4a37696483dd624ff5e15ce65948

SHA1
515ba0be0a9e20a658f20a0efb03ee28476987e9

SHA256
c04dcc5430e7b075c57d954c75be6142094eb83232ef7dfb5522b2ed1d7fba35

SHA512
ee521ebcdce9031a11de3d8beec0e64d68815b057eaee3a2100a76507dade0950f16d45e52057cb0bd42261c5f3b1914eae83881c090bdfe2c6720234874c7e3

Download Submit
C:\Windows\System32\catroot2\edb.chk

Filesize
8KB

MD5
590e6a92b69b0933028690535d98ba97

SHA1
35ce5fa1e899f86777780d0bac3a188a2c5b96f5

SHA256
fdbfe40a1f8798b385a65e7d87d5881a8e05c9234906c1869c0c03342a6c3989

SHA512
dccd362a95f2472b321e10d471ff328bca25fff897f2aca56f25891b9b93c98d99cbeaa4c241d40f9d9a917fff9f70a5bba7d9e1233cb8cdd2a0fa9d38842e6f

Download Submit
C:\Windows\System32\nbtstat.exe

Filesize
17KB

MD5
d6a9fe571146099d6d75a8e4e7871506

SHA1
68dba140959ed155f720060c5466f5fd90a176f6

SHA256
f63d1a87e8d264321bd2ef30b017758ef77cf741849f3f7f214bb169c0c9a461

SHA512
3af0b8c86d31db6df9d896af35c876486b01b271466fe0f631fdbd6d86e5dfe66b357e4d68d139c80239cf515b0da76e6bf2939fdb328f589cf6dadb8c1df6b5

Download Submit
C:\Windows\System32\nci.dll

Filesize
88KB

MD5
feb91b4da0d540865260a33838654fa3

SHA1
2d4a64a82ac21cc9fe887bf8b27561cbf4083fb9

SHA256
8636b008ba329d3e6cc235d08ba4c914eff45dbfcb9297c893ccda8d907ba946

SHA512
82a2d34198baadc5266b9ed4d10ad8bbbf8b65e7e4337b1bdb21d27fa1d35fc34c3f8de94832e5e079e100ba855ca0bfa5356d20afb551178eca594c080afb01

Download Submit
C:\Windows\System32\ncpa.cpl

Filesize
99KB

MD5
b6361f14140f96f1e2ede456febe3cb6

SHA1
2c9f3deb6fc68bd2ace9375f132847214751f584

SHA256
3664ae902cf319d6d5c63d2e713e328d1b624975db21837e2995054f217ec219

SHA512
c5a06c5528372861318b561b057ff800fde5d28cd07fc5df5eb3cf0d2ae1e0945709d999c7a7cbca2730d434c6a326f235536af1eedb9d29657ba91089198182

Download Submit
C:\Windows\System32\ncryptui.dll

Filesize
64KB

MD5
6140a1493ec6fffe2df350ea0e9a7d8b

SHA1
8d12ecdcd50d8a6afb2d8530c38e2371d8479dc1

SHA256
786f5d7022159eb9027d957ad1b4f48992a4378f8bdff1fbd5ece76d34db0734

SHA512
703effd781e3ba5cfafc5e3644efa6ee3eb435f40687d487d9831c60737f180eec0843a69bc10394f8893144f7b774167548c38dca67f8e42f0f598c7381e1f9

Download Submit
C:\Windows\System32\ndadmin.exe

Filesize
73KB

MD5
9591977284a1e8acf240c96940bf94b9

SHA1
14235b0379e27e2a2c23e18c161a0efbd19053d0

SHA256
01dc74b6bdcfea76f6b2977923c21b14918736b5477dd17bf91f08e5f581563f

SHA512
ef351abf9da0220139f80e2da36f37271efc11f4858f3c3686c501bac81015f09390b1848412fb5974b620419accbd68f9952bfe97d5668f1730e37d3341c1be

Download Submit
C:\Windows\System32\nddeapi.dll

Filesize
11KB

MD5
65a4e57a520c3183913fa623bed486c4

SHA1
21d08f7054e1a4dcce036685bed7f0d3d617421a

SHA256
e4d0b1dc082ffbee517c03e464de38e466a6a1a3d9dd4f204c5f21c4c53f36d4

SHA512
177f9f6faf87563d8fe107184316943998f2f0bc72c12a4775dbd280e5dcaf70883b4dad6abcb6061e8261eccbc9ca9098192931d194272821fd65a1a2ac76db

Download Submit
C:\Windows\System32\ndfapi.dll

Filesize
233KB

MD5
18d4729031314f8c217cdfcc599ef4e4

SHA1
ab252f1b7d1c44bf30119785b66db3fd7ff73c11

SHA256
6bdf1858819a8d8ddeb375d3d8737627effcb8d254a455975e16209aef615b17

SHA512
e05437c42bba6e3dd3a0d16d6843e7cf1975baffe4285c5c0a7525778655a678865cd74e658edf78365280a5dc37d2f988885e47ae23bd174901b41fad4c777f

Download Submit
C:\Windows\System32\ndfetw.dll

Filesize
32KB

MD5
94c627864d8e002fedb8561a90c7230c

SHA1
97c9a6294f9e09659f87fe3799792a49fbb6e955

SHA256
21ca12eb1761e027bb9d66e94d79a8c2737e61fa4d04dde711f77d9f0f612d7f

SHA512
5bf3f0b261c8a28a1aee17ca16d3641cbff58b2bda2a5f3a968e687f5ecbd67782ccde757ded81ab2a0593c05250d4ab1ca12a65d89834313a775d4a42ab9141

Download Submit
C:\Windows\System32\ndfhcdiscovery.dll

Filesize
125KB

MD5
7e8d3aa2325afcdf17e12f95b454abb4

SHA1
35e279a9d9e8769e183143a46080ba4c473387cc

SHA256
991a3da74a0476e170337c1230aec8986093e7c69c22104d6e526cf8ac0b58f7

SHA512
778fae397f5b27b625efc98a1c728e21126b6ba1ac07ff59f686acadc21d4daffad7628f5b9c3c4b4981caa462215a32ede3ba8d4beb2e8a47a5ef7fb5815f37

Download Submit
C:\Windows\System32\ndiscapCfg.dll

Filesize
46KB

MD5
79affc7feea9cd2fefea5ef3b631a02c

SHA1
a6fc323b71d44c40b5d2b43b2021f6a2de00e285

SHA256
78889511d6f471009674cc958f8bb77b4a79c952634b18e8aff4a75aa6a60e87

SHA512
6690121d84e56141260a03795a5b05382f416dbee649aa9bdeb5f4f2c0049e2080ab51520aae27745237b2ab1d645a1d72016a221446dedbe69313f828d4cf6f

Download Submit
C:\Windows\System32\ndishc.dll

Filesize
90KB

MD5
8fce9df4c9679c1e4225cec7767be7df

SHA1
e1b6d6ad7d50402b87dbfef17d6ea5f1a8f52eb7

SHA256
9153001a0b619ed22ed0c223a30de1e9371b1064aa29dcb854421a2de931a308

SHA512
45433a34309a3761ce48fe08062e9fe7a28c3eab3ffc9d5811ae9a5f130edb903c9809bacae44512f9b845a3d7f10ce6b0f085078ac320155d4e4a07eed5f177

Download Submit
C:\Windows\System32\ndproxystub.dll

Filesize
20KB

MD5
d9814fb0fbd7aed41d2c6097371d2fa7

SHA1
52e7e4c5da109a0ed1463507b1f9481aeb732593

SHA256
eb05c94b26c2b8575b3a164bd3e91724f3aacb2aa5be84eae9313c3661e8d71e

SHA512
5d1759e179df3b535b0a98500d8d824e8f4592e227983f836961b580f2996b697cb749dadae12e06bd66d400657afcaa7c1702b68013aef0561f6983794c6cb7

Download Submit
C:\Windows\System32\ndptsp.tsp

Filesize
59KB

MD5
1d6bc2769da66c1145f4da5a65f52e61

SHA1
68004d1727bcc34da848193ef2036e9128c42a7b

SHA256
b38eff16652e751bf3b3bd85da6ea33ab9b7f4228c59f741074e33085db66ed0

SHA512
b9326ac7c466365c32aeff473a08b1b90d7fc8b16227c29ee42e428e7d5d282525e7ab1741ca3c762b10f0db9a6a9847f29fab3372973266a27a2d37ffa88e45

Download Submit
C:\Windows\System32\net.exe

Filesize
54KB

MD5
63dd6fbaabf881385899fd39df13dce3

SHA1
b25697b250631bb09d27e259a2d280cfa97ca456

SHA256
3b9ad8e2c1d03ff941a7c9192a605f31671b107def6ff503a71a0fb2c5bbd659

SHA512
5d7676de9baffb600b7dffe33b894690bcd1d845d143cedcaef9bd1716ff0c3d276220398d25e18cec107c3d4fc3608341ca33609de446d3917c219c65ec6a60

Download Submit
C:\Windows\System32\net1.exe

Filesize
148KB

MD5
3b6928bc39e5530cead1e99269e7b1ee

SHA1
b885470c69caea77043b96dc1875c346ec3da0b0

SHA256
0f084ccc40cbf7c3c7472ddad609b5fd31aacafa44e23f9ec7e9e2184713b986

SHA512
687bc3a076d3a7e0dc30f090de0ede4af30e9126489bc2a9c07ccf41ee3d1b9c1795fae8c9f2f22d9d93e25840c441d80266b166897003d6d28f00c81fc34f81

Download Submit
C:\Windows\System32\netbios.dll

Filesize
18KB

MD5
5629e16c6c15a138f9e0fabf42e2ae78

SHA1
907d46f2a6f129111778d2792f6c78814baf36c2

SHA256
cb6ae13501bca1499c0a66a434a006c6c9956deb493025ed81f9bed48c252dc0

SHA512
ef40b2e50f2138543ebb87163b9d566013443fa6a7b9501e23cdade9fd9579721784f0435dc3c48e208aee2a0ddda6dfb5ddf6126606adc1798c224b4e84c54c

Download Submit
C:\Windows\System32\netbtugc.exe

Filesize
24KB

MD5
e139173e5b39b7d7300df28fd9336b38

SHA1
648547368c5fb841a1de5f902240aa91655fd928

SHA256
c801ff821161b64d345765fa5d2b14327c62a977036bb4c204a1c145f8dfcf34

SHA512
c2485790fd50290dc5aede94d2729adf7e1ca48266906415abe2fac818bea17262a475ac4928c3bf79a63924463e5345ea30fae78f39843f5e43f304252b1f5f

Download Submit
C:\Windows\System32\netcenter.dll

Filesize
1.6MB

MD5
56beb546f3f6eeaaad5759e0b32e7c58

SHA1
b476393cdae4c8eddfe6822fd833f6ba0fddf9b4

SHA256
d8da6330e35f0e600f2ee7bb6acf8937338697e2c4e4ecd84f50e154ac141013

SHA512
88c4fd080f4af69c61ce782cd2a7a2ae558407c13b412a681de2d33c052ee627d43fff8c0c12310c97068d5c46f7c7d94425ba5637b56140c44afb05ce809648

Download Submit
C:\Windows\System32\netcfg.exe

Filesize
31KB

MD5
6768d5404f13d21ceebbe2017f296e22

SHA1
a381a44dd679d2b704802b12d32111b5958ce941

SHA256
78e7e21c82727efbfc07df85eca9ea6fdf4c469eb8fdc78e14b2ebfa33285fc0

SHA512
ebee53d9b053b3987b47bae5380563f4669df1096f9eb378de3b78dae42664c6e48e3add4e94b7f1d1f7eac36c64e3972d8b062c1129be304d2b420ed2eb8fb4

Download Submit
C:\Windows\System32\netcorehc.dll

Filesize
240KB

MD5
bb757a560298491ca2728fe8ae11cde6

SHA1
016c9c8f050861b9bfc6a11aa26f52374d7360bd

SHA256
8a2cac3010badc37f2dae309564d143a6dc69a76b0fee2c5c57d487f2cfa5a6b

SHA512
1ef4dd321c3320dd0ccac52296f34a5813e44d9416ee944c2a943cbb9397d2c63e7ac44f70b1f8193fa2497b943732b705227e2488327b2c493fc5dc34207c63

Download Submit
C:\Windows\System32\netdiagfx.dll

Filesize
316KB

MD5
f4ea461a9ddf4861a0bde2b0dd5645ba

SHA1
781dd2ccff1a3795e20ba80d8df74b33855722a8

SHA256
726a39a0e8e71a798285834d936057261a236258dda04941ae37ee770c1eeeaa

SHA512
6a4bf502bb3aaa382b24c6f11cb550451706a9a59571595d6c31d3b40f0788c411e8c1c9960a3ae2def84462a06d8fcc3e916cc3df6172ac6226720e5e9a03f4

Download Submit
C:\Windows\System32\netevent.dll

Filesize
18KB

MD5
62caec17815f39c2050b24b015aedf29

SHA1
1aaadd1a800002f5bd70317c9c01b7ae31c0d086

SHA256
06e22a4e18319b2afcc39d6f5871b14f93e01061db76216452e4bec131d7af4e

SHA512
c7c84515c151da781b11f8423b12ad08eae8babe78ceee0c1276872ca014dc6214a38a115450cfd15c4e2fbfa71353d4d191896905b3c5f6ea5d5f4030bb77b8

Download Submit
C:\Windows\System32\netfxperf.dll

Filesize
47KB

MD5
0f02c3ff97eab0d8295854d6c4f82bee

SHA1
4da958e41d6f758145e57aa46a30cea545277cdf

SHA256
589c4f7fa726089221fd1dba9f5dfe4aea1bddfd4a73c6c76f662bbb9259eea4

SHA512
10387b46237c4a78e463d14d3c9c33f3921b7dad8261977b0982c70090ef0baf9e0208c519388275a0b71408cf94ce32ff17c245201ae3d6a2bd7886af3b8a64

Download Submit
C:\Windows\System32\neth.dll

Filesize
2KB

MD5
b585eebba9014916d069609129947340

SHA1
3265a822a0fdca8430d65c895382ffcb56e8f36c

SHA256
a5d541007cce5e59195b27d68aaf37b3f156409654aca48564d2da78eea6a846

SHA512
43344b47bbef559a73b36f73dd63f9eaf2a26e82acc32e5672219a43815b7033f90e5d7afffc8730a3aa6261f89358faf507175f1bf2d4f05c1c48ed02d683be

Download Submit
C:\Windows\System32\netid.dll

Filesize
161KB

MD5
2f1a635997a0e86aaf99f974e72905b1

SHA1
2ffbd79426ecf668e4ce277da689bc4252f4b519

SHA256
58e4b7134e0a723c1ce8a662201c48cbe19e1370963855db4406d76a4b39b8aa

SHA512
c4b88488df95465e04d33f9b2b78acc000ea5f260edb65705b5e5a11e868597983d4f3de3e33ba93ae097e9ef5485cf9df91158e3532878a6560c2e66fddef78

Download Submit
C:\Windows\System32\netiohlp.dll

Filesize
210KB

MD5
0fe14e3b3c0daa77dfb5b60e1d274d6f

SHA1
6f120817c88946df82a13ffe0a5cc8a4a6b6ef3f

SHA256
7950e953e1f40c8050d1063ada6bd1049b146a289991a0159bbf789b30edd939

SHA512
f2c61c87aedefd46baa7dd364463d28b9bd62873f000574d3fbb3b0f1fdbfb12ca4ad97d0b2e87cf889d657d8883c76e32a5214b02f0d35b54780c21dd25d614

Download Submit
C:\Windows\System32\netiougc.exe

Filesize
26KB

MD5
bacfb6de1316e2b726074997e005f109

SHA1
0d96c7d6a7aeb228f0eae08b2a56d939321ade23

SHA256
312f9af98a9773fac98d679f72f2856e6bcd5512ea2a4727d4031f8b4c83c1a5

SHA512
a3de7c8b8736635cc7e7cee880465ab2b597ac1ec9ddcfdd99fac596f267ccfa4b3dcce79b26d5796db6878e1878e4312afe38a33cbbe98ee7de7a7453b2e748

Download Submit
C:\Windows\System32\netmsg.dll

Filesize
2KB

MD5
cfefa40dde34659be5211966ead86437

SHA1
c70d81a38c647b4a5e3fac260b6847a5737ddd5c

SHA256
ac0a3ad8aa47012c40785013e2273fc571f416bc9c9ffda418fe72b3123c1fb0

SHA512
09018afbfac92d1d229a99f6b00c9207c95ed78a90e5466ecb086727818feda5e4e65413dbb28156374c2ba3668f69169b870a82401d061d8f0c3f7e0384abe5

Download Submit
C:\Windows\System32\netplwiz.dll

Filesize
188KB

MD5
4659dd732b02a7593469882acef1bff6

SHA1
78e6886f4c55fce7603409596bdfbc5399cd1fbd

SHA256
fc383d6ebd9c74f7b6d72a0711dd9567c9af107ff85c608a8792ffee1aa808f0

SHA512
9de49344235813973ef3e3ccd9eb9ba6dcc6ecbda6762ce6d5ed5954b068286ca1ca939145be235231aebef25671f2d000a125ed30799284a743e6a15e322732

Download Submit
C:\Windows\System32\netprof.dll

Filesize
464KB

MD5
cd0fa77c49dc96c97640ba156cf355fc

SHA1
36fd500d2c241985af18aaf0b22bfa589faf8fc7

SHA256
91870f333d0b37cc14cd33f151f698c001ee793c2bfc18b2d2d0bd95942cb6cc

SHA512
857c0206ed60e6659289dc35b577629f0163a0eccaa05fcb72bc81abd2efb534e9a20ed7ed2715cb2af958ab56329296673f806c0f0464307e615d62e555ce8b

Download Submit
C:\Windows\System32\netsh.exe

Filesize
85KB

MD5
637982a421d0133dceaa0d1490d1dc9c

SHA1
be48070856d4a1097b0de1228711593728bb6ee1

SHA256
cbaa8242c1013e4d9e48bee146d6ac3abf8b2370b7390d80a01344771a097b2a

SHA512
96ee2233656e3b5fcc7b4028c957b62de8d72b9a7b04bdd6ae930c1824b969949071801d497a56644ba451558e30fa07de8e756e0cde29e801b47ac97983ca9b

Download Submit
C:\Windows\System32\nettrace.dll

Filesize
666KB

MD5
6d672fe62df8b2a6626f128c1abab4f8

SHA1
66640ae53bcc2d6aab63718738059409df302f1f

SHA256
1545e5d63a0928929aad9498ebd9c9e91470ae90497f4853835baeb9d972325a

SHA512
5ca5b352caeeaa593e1db107559495a30f423cc5556447fa4b925105353e4d04c90dda7beea17e87671a6aa1c36047432d0d1474e333c4a48c90a862c94e7628

Download Submit
C:\Windows\System32\networkitemfactory.dll

Filesize
52KB

MD5
ade059f2599d02d8a627357d410bf713

SHA1
d86eea8a259945acb79ea8e9c23003f2261f7aba

SHA256
11fddf911f0da72144c06af80e77775e6d27e8855c6da437d423f365f63e2887

SHA512
162bf988757e625181d4b70f8186dfa84cc572499a535fb92181ead876336d2915a9a3b95ec61ee7360a1fe9da806e0534c2c25f2798ec4a6b50aef2ac8adef8

Download Submit
C:\Windows\System32\networkmap.dll

Filesize
2.0MB

MD5
d2d30dac4de4ec8bf09564bb51915263

SHA1
2bb753b87a023e1f781ff0646747d0cbd29605f9

SHA256
9be5882fc51b66f276c424eef23974630f358dde831eff04a04e141f0387e4f1

SHA512
ffa09f1cd71ca3848f4051d4d080d56562cb78e5765929f4a82b66dd220b958a6ee2c6b60337236231e24ce92ce1461ec165a2935b83dae13addce10acbfc636

Download Submit
C:\Windows\System32\newdev.dll

Filesize
306KB

MD5
bb7e865599fa258c70df8b1f70109f6f

SHA1
69878fd925b0986f818f945e838e0469cb9535d6

SHA256
9de5150d59127632bf2cd5daf84d2d9e6e367e958a3a839f5134dc6685e7a284

SHA512
d434b0b520b3818bfc9bd0a699f3d54891c119ac00081fa8f583c95ef52a62f2564015b981f975a22bb3f7c8beb55cddb4576dd403c735a863b76faf0af3c760

Download Submit
C:\Windows\System32\newdev.exe

Filesize
74KB

MD5
78d26e7614ddbc22b34c412624285d81

SHA1
76cb8e2602c4b37ac213255f3287a9102de01b46

SHA256
1e0205420ef47992cb60baa92db9fc72dfb3039bec375676a0ba14909c62b486

SHA512
1152c20981d55d5ff4cfa6f0c696f5d8e2c2ac01b9ce46b16315a6527b0a37e823014bd430eb14128db9370d3cd8640ea73ec5fa72b16fcf414f16dacafa0e2e

Download Submit
C:\Windows\System32\nlahc.dll

Filesize
124KB

MD5
8f6fbdfe7baf2b9c6cca0ccafcdfdeb9

SHA1
e5ee6f31c2995098af834ac56ab8940f5fc220c3

SHA256
6dd476844284b6e5ea697fcc14d563c816553564eaae2a87570d7e258cfa9212

SHA512
34c404f1c6cba612d0e15fe8f56fafc84fbc7db2ef2b7c0cbf5cb3675b66ca5db0e0f4b1a7aae704c19fd35da31c697f18547e9a86273fc057647a3ccb773c6d

Download Submit
C:\Windows\System32\nlhtml.dll

Filesize
195KB

MD5
534cb6b00c52301aeae8d875d0e12c9a

SHA1
faa838cd29e07305f50e11962c3d547ee9f398a7

SHA256
c482c94979335eab8b1182fa852985dae63cf5c524b7680a42a45e66fbad2547

SHA512
12b02e8f2cc24d39f94449bdd7c0ad3fe502e7913e7dfb685012b3633283a09011dac438ad84d22a82208ed0babd49fccb1e254935dad1b3b865fb64d8d0714a

Download Submit
C:\Windows\System32\nlmgp.dll

Filesize
175KB

MD5
7045a0d6e2037b75e11e26d7c56cbf16

SHA1
6fe4b96a980ff7540fcb904543b76087f702066b

SHA256
a8130d53b5f1ca19a91b87b45a3a164216b1925304dd3663eae8e6644ee0b666

SHA512
cea582d549ba15a538771ed2023be331e9012c718c9c9785b48e7feda53510d46bd5c9da72a5088e792158b53e395ad625aa72cae636e197e3c539652312233e

Download Submit
C:\Windows\System32\nlmsprep.dll

Filesize
13KB

MD5
3ffb941659a6bd63afe0e7a04bbb3ccb

SHA1
a8cb68b290ea3d0a75e4d9007bafcae04b35520e

SHA256
83496cf32dfac4ecbabc19dcc5174a415b7678848d81240026f163e8d062fcd5

SHA512
a796efa440f836bed7f131cf13619b77dde2f8d746dc47b77614b4764e2eeaec2b7b9178c633a9e09bd76e4ca3e636588910a60ddb4327d3dae4620f6f2dfc14

Download Submit
C:\Windows\System32\nlsbres.dll

Filesize
67KB

MD5
36917e19edabcc37054c6f2fd27db6fc

SHA1
181707c8d9a552ec3c493d10f200bc3fbd4437e3

SHA256
cad21a59a59575d545b362e2ad380da52d0f2d37bb74cfc1f854f3573ad3f984

SHA512
90770834b1c60a1b9a9a6de3b8833227f28d48db0ed446f02558368e04429760ad40ac3f3fca160cdf89954fb3f90358737e70993e30fe7fc4904bbf85b57d4b

Download Submit