5a2775ce2aae72216b9aca4ab5c16fcb097f23c8d0f1698f68585ff2db64a677

max time kernel
1150s
max time network
1084s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26-11-2024 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.js
Size

66KB
MD5

871ec2c9c1f5fb35e9aeccc269714074
SHA1

1e74f1f8acb9dd1248996fda1b68a5a970a1ca83
SHA256

5a2775ce2aae72216b9aca4ab5c16fcb097f23c8d0f1698f68585ff2db64a677
SHA512

e56a0e5aa5614a22d0f859098410accb0c1d44fab50b9e47396dd7c36c7e1938a636643c4ab1ca99a89aafbb9931fc7f085dacee03ed019eb7eb52d0ad6926d9
SSDEEP

1536:U69UFLCCwNieoupehNFZuSuWtWWxSRoH1rjWAkSSpcEqN2RI6ZsnJVr+5va0Ym6C:T9UFLhwjLRoH1rjWAkSSpcEqN2RI6Zsm

Score

8^/10

execution persistence

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\cimfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dxgkrnl.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\npfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\srvnet.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bowser.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fsdepends.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ksthunk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tcpipreg.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tdi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\condrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ntfs.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mouhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mslldp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Rtnic64.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\srv2.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\udfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vhdmp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\amdppm.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mpsdrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb20.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Ndu.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\null.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\PEAuth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Vid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\monitor.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\csc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\gpuenergydrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hdaudbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\http.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kbdclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kdnic.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cdrom.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\filecrypt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\HdAudio.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UCPD.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbhub.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\watchdog.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ahcache.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dxgmms2.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mouclass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\netbios.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rteth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bam.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ndiscap.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rdpbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mmcss.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cdfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidusb.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\i8042prt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\NdisVirtualBus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pacer.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rspndr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tbs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidparse.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bindflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nsiproxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storqosflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vwififlt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\afunix.sys	cmd.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
3232	Process not Found
4236	DllHost.exe

Loads dropped DLL 33 IoCs

pid	Process
3996	Process not Found
3996	Process not Found
3996	Process not Found
3648	Process not Found
3648	Process not Found
3648	Process not Found
3648	Process not Found
3648	Process not Found
3232	Process not Found
3232	Process not Found
3232	Process not Found
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe
4236	DllHost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\dusmapi.dll	cmd.exe
File opened for modification	C:\Windows\System32\wbem\Repository\MAPPING2.MAP	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MI755E~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\coloradapterclient.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\i8042prt.sys	cmd.exe
File opened for modification	C:\Windows\System32\wldp.dll	cmd.exe
File opened for modification	C:\Windows\System32\dcomp.dll	cmd.exe
File opened for modification	C:\Windows\System32\WinMetadata\Windows.Storage.winmd	cmd.exe
File opened for modification	C:\Windows\System32\config\TxR\{55F20~1.REG	cmd.exe
File opened for modification	C:\Windows\System32\csrsrv.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\USBPOR~1.INF\usbport.sys	cmd.exe
File opened for modification	C:\Windows\System32\en-US\MsCtfMonitor.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\win32kbase.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\aepic.dll	cmd.exe
File opened for modification	C:\Windows\System32\cflapi.dll	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MI00FB~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\wininitext.dll	cmd.exe
File opened for modification	C:\Windows\System32\ACPBackgroundManagerPolicy.dll	cmd.exe
File opened for modification	C:\Windows\System32\RTWorkQ.dll	cmd.exe
File opened for modification	C:\Windows\System32\Windows.UI.Xaml.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\explorerframe.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\gamestreamingext.dll	cmd.exe
File opened for modification	C:\Windows\System32\IPHLPAPI.DLL	cmd.exe
File opened for modification	C:\Windows\System32\PrintIsolationProxy.dll	cmd.exe
File opened for modification	C:\Windows\System32\amsi.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\activeds.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\TextShaping.dll	cmd.exe
File opened for modification	C:\Windows\System32\umpo.dll	cmd.exe
File opened for modification	C:\Windows\System32\Windows.UI.Immersive.dll	cmd.exe
File opened for modification	C:\Windows\System32\TaskFlowDataEngine.dll	cmd.exe
File opened for modification	C:\Windows\System32\UIAutomationCore.dll	cmd.exe
File opened for modification	C:\Windows\System32\Windows.Cortana.Desktop.dll	cmd.exe
File opened for modification	C:\Windows\System32\wbem\wbemess.dll	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MICROS~4.EVT	cmd.exe
File opened for modification	C:\Windows\System32\BthRadioMedia.dll	cmd.exe
File opened for modification	C:\Windows\System32\pnrpnsp.dll	cmd.exe
File opened for modification	C:\Windows\System32\lmhsvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\shdocvw.dll	cmd.exe
File opened for modification	C:\Windows\System32\StartTileData.dll	cmd.exe
File opened for modification	C:\Windows\System32\activeds.dll	cmd.exe
File opened for modification	C:\Windows\System32\pku2u.dll	cmd.exe
File opened for modification	C:\Windows\System32\Windows.UI.Xaml.Resources.19h1.dll	cmd.exe
File opened for modification	C:\Windows\System32\WinMetadata\Windows.ApplicationModel.winmd	cmd.exe
File opened for modification	C:\Windows\System32\dnsapi.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\BASICR~2.INF\BasicRender.sys	cmd.exe
File opened for modification	C:\Windows\System32\ntasn1.dll	cmd.exe
File opened for modification	C:\Windows\System32\OnDemandConnRouteHelper.dll	cmd.exe
File opened for modification	C:\Windows\System32\tbs.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\inetpp.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\NetworkExplorer.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\usosvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\wbem\wbemprox.dll	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MI483C~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\SystemSettings.DataModel.dll	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MI4C58~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\dwmcore.dll	cmd.exe
File opened for modification	C:\Windows\System32\netprofmsvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\rmclient.dll	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MICROS~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\winevt\Logs\MI8CDD~1.EVT	cmd.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	cmd.exe
File opened for modification	C:\Windows\System32\ShellCommonCommonProxyStub.dll	cmd.exe
File opened for modification	C:\Windows\System32\Windows.UI.Input.Inking.dll	cmd.exe
File opened for modification	C:\Windows\System32\WUDFPlatform.dll	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\sample.js
1⤵
PID:1980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1272

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3956

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Drops file in System32 directory
PID:3916

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\IDStore.dll

Filesize
181KB

MD5
205b34ed26e563961e3fc10d20cdcd31

SHA1
a3e0930757b2efd8c62f1392d23b2a950de50694

SHA256
d7c8118073f36f7bd7e25458a08e50cefa2faa6168478c83c6a663350d749bf5

SHA512
b6c65ec88d6b3ffe3f004e7ab11d84de54358c6b4efe241186a014e1e33b1e9f74df51645c5f9f7cae364e21d03aa0bb0bcfece9713072e95fd74d46867528c2

Download Submit
C:\Windows\System32\KernelBase.dll

Filesize
3.0MB

MD5
ec2f71780fb0d2335f988904cf9a01a7

SHA1
2fca70f331d9cb71f8052178c14ad05f786a0160

SHA256
a5ca39c8dbf3997b94a6a005d308bcf927bcb1ab5bfc9a7414075fab3f54d241

SHA512
932e479671fa8801427aad26fc2bd08a8dd6906b8db07d1c9ccf0beed3edd1fdc0ecba5c35f41cdf3c8d49a773db87287472df25827490c5b52c3d09a74aaad6

Download Submit
C:\Windows\System32\SHCore.dll

Filesize
685KB

MD5
a6b48bd563961dfc86e28f16a2ff565f

SHA1
ca7ba56632427be2c7340008c13b85b841eaf4b5

SHA256
3e9f77910432348b6beff52f2204a934880ea2bbe9ca31c3c585d1332c3b3106

SHA512
2c75c2cdb5393f58a7664066a42c6fca84ef4dc14923afbaaced132f5cf9584245301e6d8e4a68451c83a9c8ebe20e58a87e6e11ed5ca70b641fab86cd9f3301

Download Submit
C:\Windows\System32\UIAnimation.dll

Filesize
263KB

MD5
6ad7a40afe5f9d0fab33d0234b320772

SHA1
057f378f10dc1e6c8ce8f9e37d5cfeafc2592fe8

SHA256
bed117be4269b03390e3f94392a13a16fca25796d732913aa80536889446ed6c

SHA512
200d1a069ba6868a8d98a9017a56692c0edefd70adb610b1c104532f817a6179bb9022dea097ae9dd590088e83ef18c27cefd044794f6ee422657005a46e1d19

Download Submit
C:\Windows\System32\UIRibbon.dll

Filesize
3.9MB

MD5
e8f407e40c03a769ceb5ddd12f217e37

SHA1
7d695c8b02551e35abbb6b03ecb5fe0e76c68ee6

SHA256
941dcfcd96b3d9799945a5ab1b4d4b7d6859682a0af9df38223568d7f3c46a2f

SHA512
bdf556c3c12ea6eb1955d21ff022a2e719f47e8ed4dbe4525e9a60f96d41b3c7184a3d123787938902d52346773dc6d923d0f4bce15d2e011fccfbe41f1350f5

Download Submit
C:\Windows\System32\UserMgrProxy.dll

Filesize
316KB

MD5
8041fcedaa33d53f496da14e592d052b

SHA1
2973600e8dd1be0012a11da400dc724661d75edb

SHA256
ff14a9d4734a90181009912e67ba31a6f10398f58f4c43f7e21661781b3b773a

SHA512
e2f5f675e873e5d3487ea53d60a964441df275aa8c0a51053d376788f6c99bdb7fc2d0252918a5493635b72e0cbbc3aa450876929ac7feaa13e744711f578daf

Download Submit
C:\Windows\System32\Windows.Internal.System.UserProfile.dll

Filesize
252KB

MD5
a512e41f0f2bf1ffffd1b34b47a5cae3

SHA1
16d0474e065eb5a669e6fe870274099049fb7b6c

SHA256
1f4b7cb2f555a7ff1c6f63600bf5e5b2c0b526382b4961d1cb4cf8dba21f5066

SHA512
4852800c15944ebeb8e68c2c0de2b8fc6d19542fa765e4ff5865285a3e27a18a1c3a0186b5d000b340decb6de4918abc82161788302ddd1b366ba6f24b3b2915

Download Submit
C:\Windows\System32\Windows.Security.Authentication.Web.Core.dll

Filesize
1.1MB

MD5
07a3f7bb0f0c645269e9051df394fbb1

SHA1
3727f79d773f0966e791727401e6679b0c249146

SHA256
9fa5e1bf2c4b78dbf99e11855468ebe47020ed2a19aef5b90bd833cabe84f4ec

SHA512
93b6b94bc2cd368dc6fd7101bd49527d778750d8c8a377d8b07a2875985ee8c9e6dd5ca254a4874dd8d12e32f4dab6e1840cb995a748ef05436fe4f5cf39c61c

Download Submit
C:\Windows\System32\bcrypt.dll

Filesize
143KB

MD5
39ef6359a529d2d44e849905d4ace360

SHA1
d6c376747e55e92b771d43b8309a1b4637845c59

SHA256
5d05db7db46d509ff71b7a952fd36d3a9e432f1e8e26fa0a5772f3d260146e81

SHA512
056256298c8117fa61bc5802af62514a2345ec43cea58d5eec9aedca61ba773c32b899c6ed934062d2a5d26672fce3c4687fc55d617bd5197e82d6f0d8957ca1

Download Submit
C:\Windows\System32\bcryptprimitives.dll

Filesize
515KB

MD5
fa7e5ed7db370614dc453f6573b0bc97

SHA1
862b1ccc4ba5cbfdbabb69d873717d799d6340d2

SHA256
605da9c5812900dc12780bf54d85de0cd6c300055c2548cb6d6036e4eb42c1f7

SHA512
5e454772eb93e34a5f83bbbf07200b6d741afef84e49c1b3e9d9c42d9be2a93458b7fe08277a5bae59d1d8a33a13b41b23a5ed1a98dde5f118ce91bc692555fc

Download Submit
C:\Windows\System32\clbcatq.dll

Filesize
658KB

MD5
94a96f09f2a95f21123721d0a140c3ec

SHA1
1650dea8d89ea7cf41afd1a0f25a182d9e6f10a7

SHA256
af30c5fddaf675df238f0da108843367b1075fe691a76b6642bf8595b62860cf

SHA512
afa02856163c38761be25b575403f125fa2d25a3fba0b86b42e07b39daff09c35f462ba90bd40002a7efb7ec2ccc2fc3b5127d3237deadc0e0b6c000fb2b0ada

Download Submit
C:\Windows\System32\combase.dll

Filesize
3.3MB

MD5
b104c481313e49c5bcc036c03ecc4a67

SHA1
5d8a9cce16b7928ceda1f931ba20bdd90bd7346d

SHA256
b50a09b7f91d8e11b2f3a6191d2e4651898166cb57dbd28b4bec40d11b179fd8

SHA512
bd4faef136d39d4c03dbdbef2365ef36bfc7af2c9bb7680ccc533c9b98431455d2209173701fbb7111685c272e8f877129131163b7d7a1c711deb99472796eb3

Download Submit
C:\Windows\System32\d3d10warp.dll

Filesize
6.9MB

MD5
7e0fbebe0a960d5eb4516bd79d055e3e

SHA1
686b250c192126c6c2d33517f15c27cca76e4de9

SHA256
6d35cf4c17afc7a2f4218cd30344fe40df95339b211cc483bef909a31c0ef192

SHA512
a8c22cc2277375f9918200e12c9a5a60c4ed0f5389a62eba67d5991da966a0e596c855d164746a8c9f5ab2bcf3692d345b3290de92d2e284cbe52280e4921e3f

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
21KB

MD5
dfe1e4b1b8714cbe1005ee9413c2bae9

SHA1
660e47d00af463cdb615026565f06d9edb896fee

SHA256
0309834d40475ccd5a88c48f7ff5ec62e5c6798900357dd83665c3d0345124e0

SHA512
5d455cad427d994221097aee675e1e991b358d3ccf06939fa935092e262372c122ec2052ba4c83d548c78d3c8fdde5c95f1ebd57276c5e29bd65b300f30fc4b1

Download Submit
C:\Windows\System32\gdi32.dll

Filesize
159KB

MD5
d9b128dfee53ed802f24e9004918edd2

SHA1
2c93cb9c83b072defb8557482e01124d94e5962a

SHA256
a2e4ca9c9c43d94d297031cc5fb6504512a29c7f9b84493b3be270b74525ec5c

SHA512
610f74cfc49462766fc9572cc669c203784e6c2d1b9464c16caa7c0f98803c0817d19d4ca2030f0917eb3b57143bc647a94cfbab9f62bfb261d03844752526ab

Download Submit
C:\Windows\System32\gdi32full.dll

Filesize
1.1MB

MD5
f22f6d15d22d80f0ca4767cf884df26b

SHA1
2c178425125a6d5eaa0025c2b38a15986189c59c

SHA256
5522d71da1f8c3641e5cc649e33e7f62a5e1d333574256c50dfbd52ecd3de8a3

SHA512
3ff2a87a2464891fcb26ed5b43b9c55a99ceb8df3cb3f0d4609745538f41423670977cab7c86f3a33910aa51b30b6749cc7c24708ad026bea6ad0995acebd126

Download Submit
C:\Windows\System32\imm32.dll

Filesize
180KB

MD5
193d2ccd28cdbb246ff4cd47361c2cbb

SHA1
ee58d02a3e847be829708ef2ef5e35e5ecdfa9c6

SHA256
de60bf11a8d3102a895535fdd843884ab244bbeeb0db09a819e5abfa39025d50

SHA512
93bfa30dd70dce8ee68f72fd8d35c1bf5bcb05b4249762618f249aed69429af2da79fecc3a79cd7b69428610e9ce194474b521dc72e6efdd02e7fa2e9ca91dd8

Download Submit
C:\Windows\System32\kernel.appcore.dll

Filesize
60KB

MD5
7402b27bcb9d703a0603013f361fd773

SHA1
abfed6157a24b63055e3066c317a24213b08621f

SHA256
abff38d9efaca07602acc2a31775f8790ac720261842dbb6d7d9e1a46bba91f8

SHA512
1913d97edd8421a7985b131656aa1b3fe9cb629e0cd3d9be31a3ce40788f59111c50ec3e80bf2a775d72690fc0142935d205dfb06538f0c7cb3d0193057f6662

Download Submit
C:\Windows\System32\kernel32.dll

Filesize
748KB

MD5
77b8814884ba1ce656543c1bd53fb8b1

SHA1
2948b6bf7188304e62b7ae76e0c980911d0820b0

SHA256
2e6ba282f487d785072033722f916cccf28b8250b3fd03cd72fe3cc712104e98

SHA512
3c621fd72e852535a5380731f2430853c583ea109428243cca309d8bd5b612d3680f91ffd510c3c3985872a5b54b65906e5f2379acb903bac509520d00a0331e

Download Submit
C:\Windows\System32\msftedit.dll

Filesize
3.3MB

MD5
1dbc9addda3f6d41a4a373a2952e9f8c

SHA1
1a6bb8a6f32bc4ef5b7608b261f000703e3df44e

SHA256
31f7726c9ec401aa413f2b15d9ecf1204834d5a0841773c092fbde05643635fa

SHA512
087403d2131ffd929d3b39f02e588e08f598aae171d01c2368826bd7828e1e7058544bf5918979467f611779f242954339696f9e58ded17a19d94146dc62fac9

Download Submit
C:\Windows\System32\msvcp_win.dll

Filesize
621KB

MD5
ec9f1cdd909f7c0bae4db21dcd2033de

SHA1
4c2a112e048fc75cd4c581836356e881552c9be2

SHA256
2a7825c2925347e0cb767a0dcb611f3eb80d0f71cbec981069b227bdc7cb871a

SHA512
924022bb40c542a3ff0d09da35b8156113a83336d57924888d921f070f6192d83fcec6b89bde89957731e55e41118ca2affeb5885541bd345da7857996c22fd5

Download Submit
C:\Windows\System32\msvcrt.dll

Filesize
623KB

MD5
ae02a1e372952134e967b336d2dc1822

SHA1
7a1fc1113ca908cfd2db55948634cf1949cafb03

SHA256
a7f4196d9476d36894ce17c3b0dd97504ca2cc31b3e0a774fee326e867565885

SHA512
da3b0d985cb6e8d64176b8024eb783c276970aee486d25cbc2468a781d51a455315840d6c9da063c84c484db7d7ad2994af337c4a66160d6eb7b64e77041cead

Download Submit
C:\Windows\System32\ntdll.dll

Filesize
1.9MB

MD5
d393bcdc6c83b15339bb018cd8b3bc57

SHA1
d064dbc3be4281512293a85425578af2d1052afa

SHA256
3b2363e47b5143d5d2f927a5b84cabd62d1f08214030f5db1120214631bf6033

SHA512
1fb3928846920b5a67cd40b908bc52491a74772e04615edea6dd9e29c63270895a01fed72b06df4732584006e66261bbd6b2464f75dfd69698ec697246323609

Download Submit
C:\Windows\System32\propsys.dll

Filesize
980KB

MD5
0e57ad3078f3b255002a33d5160cda86

SHA1
b618bc9d1e23a0b05baec147f16ddb0e499df968

SHA256
831d824534c1b5e61f3f81e8c08db7e6477c1193c0e54932130c5ea9b56b9624

SHA512
af0651cca2b084ed6feac722a17ced52782078ed6097b75b263b2af959d686d1840ac785207c47c3f8aa51cc1f24dcde69b7d091d5399cf0971135a8bdd35302

Download Submit
C:\Windows\System32\rpcrt4.dll

Filesize
1.1MB

MD5
aed18cb654be822c9075b8dda0b03fa3

SHA1
5bcc2703e78920e211cc3303b6bad6d3b2257e2b

SHA256
1f8496f533572dce66edbd1be23d9b480cf9bbf719b43aec1a1461ed16b59c4b

SHA512
afabb99ac4e3e7cf0122fb52e341c5b7970360990df4e90a2f5b23d6df42a449972d44bcc4283e2b7b922b7aaf10c6d5e5a15107ce23ef46ea82b273c115686f

Download Submit
C:\Windows\System32\samcli.dll

Filesize
81KB

MD5
88fc8a7c285558b7f502f1a4c7f66314

SHA1
6ccceff830bf6683a4c20e64654fd05a12f40406

SHA256
09a086e2575c72f0835b7df861f219ad58b80f3a6318d44be29f4fde36a57f3c

SHA512
89bb84e876368d457d63471072ebd45c2801a329e83ca400a9eee9864449cd4a3bc8c779b184929ff797074bf160258f6388779549c42d54d001fe21c550d947

Download Submit
C:\Windows\System32\samlib.dll

Filesize
136KB

MD5
fd26fd71c10175584d40bfe05cacb6da

SHA1
99a3619763158b4d08599a8b95974871f7585197

SHA256
d2e38985c92c17b6b84c21f9b45f315dc58ceb2653dcacbb7864d360822af7e8

SHA512
52857d7c4569bead72f1f01193d96870b7879c902137592da95b36fe3dcb63512efeb61f0edf1bb7dd315dce559d2bc0c036bedf412814c604c9b551e63737b2

Download Submit
C:\Windows\System32\sechost.dll

Filesize
630KB

MD5
b5530ec897acfbdfa70c42e38abffb35

SHA1
67db2561e5eb977c01fd1e9a74ed56f30cbf8eda

SHA256
16cc87808786ae2d77e6d79ef1a8061365d80349dfb2bc949e409d9007daf7e1

SHA512
70699cd0515d62ca6ac8522b19ad9e5f1a0ea100491475a90695c06571e1685af061d3798ff4733ba85a854253f7720acb6c5befe09c0dd86afbf936c70a676d

Download Submit
C:\Windows\System32\thumbcache.dll

Filesize
393KB

MD5
f812b0011124f504530a0a9912d72d83

SHA1
cf23d9641b6ba06c899738fec754911a918f74f5

SHA256
a6aea7d5c84fd2a62b27b739f29377014566d4b16c69288d41a66a69531f1439

SHA512
4458c6aadba5fd765a2b2f19e8bf155776b06bb8751157420e311d167b639ac210f8010e8e2705f8190d3bb3c56d23c2a52ff1210846d4a214c37e449ba542ab

Download Submit
C:\Windows\System32\ucrtbase.dll

Filesize
1021KB

MD5
4e326feeb3ebf1e3eb21eeb224345727

SHA1
f156a272dbc6695cc170b6091ef8cd41db7ba040

SHA256
3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9

SHA512
be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67

Download Submit
C:\Windows\System32\user32.dll

Filesize
1.6MB

MD5
70f007ee4ccb64732fb83dda73a3b467

SHA1
2edea7dacd6debcb403a413002de0f0a4ccbc729

SHA256
2f791adfbfba32cb70f84fee508264f379ef69b9486dddd00f3a9cd380f53b4a

SHA512
9e1e36e1416986aba85f25d62b6034dee8c0ebfe838f791a651d51c0c43dcb4cb2d04c99bf4f94bc20a160569b6ed8dbe5cb0a4d30992eba06eccfb8f7ba685e

Download Submit
C:\Windows\System32\uxtheme.dll

Filesize
612KB

MD5
3a06846e4d484d7e1b8544f0908cf78b

SHA1
cbd45c947320cdb2db3b8938f4fbea80b9b95ee1

SHA256
d1ff2c49e692cce061d33b43798aa909c14cc86a549a5da27fe87fdf40129d3c

SHA512
cf8791769045a8f72360be3687fbd59a4687fc9d31f836e1966f25be57f76dd8d61f94be0a376e282b29143aa984d92abb7b4afdbf85c79625dbfd3f3b0a1327

Download Submit
C:\Windows\System32\win32u.dll

Filesize
130KB

MD5
476be05ae880e2ea273a25a5c7ab2656

SHA1
9341ec566878cdbb260ba583359ab789700ebc0b

SHA256
4cfa33a61214746399bf0dd1f405e150edfa410419409470dd40f91a3876e478

SHA512
c267d71443575be41750d3d85895b8d7136d3c416b0f817b65229250457a7c184f85f47ae866e93a4cdb10751bf3b73fc085a073eafc5cb1536d5309ca55b0b6

Download Submit
C:\Windows\System32\wlidprov.dll

Filesize
651KB

MD5
6a8939f6440a9a8e74723fcbfec5cd85

SHA1
c32cdb2aeceb4cd9192ce1725f5d353f343e59d4

SHA256
09915341618848f8d6c150704fa2d8ae7d9aec83d37751c3f5eeb5bb0ca05fb5

SHA512
c8f7311a5a57c506c24bc49ea1eedcb8a82db3174babd9fa0371cc05eeaea4a02fc4851d58bc1267c481aad82915e7febf68aa81856a2d7a7ca8a7afe5bacbde

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads