Analysis
- max time kernel
148s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
deepseek_bat_20260822_9009ff.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
deepseek_bat_20260822_9009ff.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target deepseek_bat_20260822_9009ff.bat
- Size 1KB
- Sample260822-shffdazybx
- SHA256 4ebce29109dac9e0d2c7321949f6bff27517ef28fa2bece77060e2cea6a8deb2
- MD5 68f88795511bc1653b19ffbeba92ac3f
- SHA1 9009ffe75e61ab32e06072f8ffab8c4e44a8a262
- SHA512 4d7683c54089065e443f2e5e9c8eef1ca68e5aedbe0a85393524c8ca0042a1e1fb0a655f7e7e4f80bfcf2bba33b27978fc7dd69aa638b7dac2f9367966cc1592
- TLSH T120219B533FE88E5E008719F266BF914237A4B85F80403EC1A1E6729AE5A66566535CCC
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\condrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tdx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbehci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\gpuenergydrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ksthunk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\PEAuth.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tdi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbport.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vhdmp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vwififlt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hidusb.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mouhid.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mssmbios.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ndiscap.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rdpbus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\storqosflt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\udfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\amdppm.sys cmd.exe File opened for modification C:\Windows\System32\drivers\beep.sys cmd.exe File opened for modification C:\Windows\System32\drivers\drmk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\dxgkrnl.sys cmd.exe File opened for modification C:\Windows\System32\drivers\HNJGKY~1.SYS cmd.exe File opened for modification C:\Windows\System32\drivers\storahci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hdaudbus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ks.sys cmd.exe File opened for modification C:\Windows\System32\drivers\pacer.sys cmd.exe File opened for modification C:\Windows\System32\drivers\srv2.sys cmd.exe File opened for modification C:\Windows\System32\drivers\bindflt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hidparse.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mmcss.sys cmd.exe File opened for modification C:\Windows\System32\drivers\netbios.sys cmd.exe File opened for modification C:\Windows\System32\drivers\netbt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\cimfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\cldflt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\crashdmp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\dxgmms2.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tcpipreg.sys cmd.exe File opened for modification C:\Windows\System32\drivers\npsvctrig.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Diskdump.sys cmd.exe File opened for modification C:\Windows\System32\drivers\dumpfve.sys cmd.exe File opened for modification C:\Windows\System32\drivers\lltdio.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mpsdrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Rtnic64.sys cmd.exe File opened for modification C:\Windows\System32\drivers\srvnet.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wcifs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ahcache.sys cmd.exe File opened for modification C:\Windows\System32\drivers\bowser.sys cmd.exe File opened for modification C:\Windows\System32\drivers\dfsc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mouclass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\null.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rteth.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WUDFRd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\afunix.sys cmd.exe File opened for modification C:\Windows\System32\drivers\csc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\nsiproxy.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rspndr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hidclass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\http.sys cmd.exe File opened for modification C:\Windows\System32\drivers\kdnic.sys cmd.exe File opened for modification C:\Windows\System32\drivers\monitor.sys cmd.exe File opened for modification C:\Windows\System32\drivers\msfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\SensorsAlsDriver.dll cmd.exe File opened for modification C:\Windows\System32\drivers\mrxsmb.sys cmd.exe - Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\wintrust.dll cmd.exe - Possible privilege escalation attempt 2 IoCs
pid Process 4112 takeown.exe 3680 icacls.exe - Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll cmd.exe - Executes dropped EXE 9 IoCs
pid Process 4404 cmd.exe 1408 cmd.exe 4624 Conhost.exe 5004 Conhost.exe 3984 cmd.exe 960 Conhost.exe 4656 cmd.exe 3968 Conhost.exe 3812 Process not Found - Loads dropped DLL 64 IoCs
pid Process 4404 cmd.exe 4404 cmd.exe 4404 cmd.exe 1408 cmd.exe 4624 Conhost.exe 1408 cmd.exe 1408 cmd.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 5004 Conhost.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 4624 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe 960 Conhost.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 4112 takeown.exe 3680 icacls.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\Microsoft.Graphics.Display.DisplayEnhancementService.dll cmd.exe File opened for modification C:\Windows\System32\msftedit.dll cmd.exe File opened for modification C:\Windows\System32\nlaapi.dll cmd.exe File opened for modification C:\Windows\System32\aadcloudap.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\BASICR~2.INF\BasicRender.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\mouhid.sys cmd.exe File opened for modification C:\Windows\System32\httpprxc.dll cmd.exe File opened for modification C:\Windows\System32\ISM.dll cmd.exe File opened for modification C:\Windows\System32\mlang.dll cmd.exe File opened for modification C:\Windows\System32\scecli.dll cmd.exe File opened for modification C:\Windows\System32\schedsvc.dll cmd.exe File opened for modification C:\Windows\System32\catroot2\{F750E~1\catdb.jfm cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.sys cmd.exe File opened for modification C:\Windows\System32\en-US\windows.storage.dll.mui cmd.exe File opened for modification C:\Windows\System32\MSWB7.dll cmd.exe File opened for modification C:\Windows\System32\ncsi.dll cmd.exe File opened for modification C:\Windows\System32\SecureTimeAggregator.dll cmd.exe File opened for modification C:\Windows\System32\shacctprofile.dll cmd.exe File opened for modification C:\Windows\System32\version.dll cmd.exe File opened for modification C:\Windows\System32\AppXDeploymentServer.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_b78a9c5b6fd62c27\umbus.sys cmd.exe File opened for modification C:\Windows\System32\RstrtMgr.dll cmd.exe File opened for modification C:\Windows\System32\schedcli.dll cmd.exe File opened for modification C:\Windows\System32\sihost.exe cmd.exe File opened for modification C:\Windows\System32\slc.dll cmd.exe File opened for modification C:\Windows\System32\ubpm.dll cmd.exe File opened for modification C:\Windows\System32\wbem\wbemcore.dll cmd.exe File opened for modification C:\Windows\System32\netprofmsvc.dll cmd.exe File opened for modification C:\Windows\System32\normaliz.dll cmd.exe File opened for modification C:\Windows\System32\sppcext.dll cmd.exe File opened for modification C:\Windows\System32\ucrtbase.dll cmd.exe File opened for modification C:\Windows\System32\wbem\WmiPrvSD.dll cmd.exe File opened for modification C:\Windows\System32\wshbth.dll cmd.exe File opened for modification C:\Windows\System32\dhcpcsvc.dll cmd.exe File opened for modification C:\Windows\System32\npmproxy.dll cmd.exe File opened for modification C:\Windows\System32\oleaut32.dll cmd.exe File opened for modification C:\Windows\System32\SystemEventsBrokerClient.dll cmd.exe File opened for modification C:\Windows\System32\upshared.dll cmd.exe File opened for modification C:\Windows\System32\Windows.Internal.Graphics.Display.DisplayColorManagement.dll cmd.exe File opened for modification C:\Windows\System32\Windows.UI.dll cmd.exe File opened for modification C:\Windows\System32\Windows.UI.Input.Inking.dll cmd.exe File opened for modification C:\Windows\System32\en-US\SHCore.dll.mui cmd.exe File opened for modification C:\Windows\System32\MMDevAPI.dll cmd.exe File opened for modification C:\Windows\System32\wbem\wmiutils.dll cmd.exe File opened for modification C:\Windows\System32\Windows.UI.Xaml.Controls.dll cmd.exe File opened for modification C:\Windows\System32\winevt\Logs\MIDE4D~1.EVT cmd.exe File opened for modification C:\Windows\System32\winevt\Logs\MIE432~1.EVT cmd.exe File opened for modification C:\Windows\System32\winsrv.dll cmd.exe File opened for modification C:\Windows\System32\dllhost.exe cmd.exe File opened for modification C:\Windows\System32\notificationplatformcomponent.dll cmd.exe File opened for modification C:\Windows\System32\pkeyhelper.dll cmd.exe File opened for modification C:\Windows\System32\sechost.dll cmd.exe File opened for modification C:\Windows\System32\Windows.Networking.Connectivity.dll cmd.exe File opened for modification C:\Windows\System32\windows.storage.dll cmd.exe File opened for modification C:\Windows\System32\AppXDeploymentClient.dll cmd.exe File opened for modification C:\Windows\System32\BFE.DLL cmd.exe File opened for modification C:\Windows\System32\en-US\netmsg.dll.mui cmd.exe File opened for modification C:\Windows\System32\SebBackgroundManagerPolicy.dll cmd.exe File opened for modification C:\Windows\System32\wbem\en-US\cimwin32.dll.mui cmd.exe File opened for modification C:\Windows\System32\wbem\wbemess.dll cmd.exe File opened for modification C:\Windows\System32\Windows.UI.Xaml.Resources.Common.dll cmd.exe File opened for modification C:\Windows\System32\winevt\Logs\MI8CDD~1.EVT cmd.exe File opened for modification C:\Windows\System32\appinfo.dll cmd.exe File opened for modification C:\Windows\System32\DevDispItemProvider.dll cmd.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4656 cmd.exe 3984 cmd.exe 4636 cmd.exe 4404 cmd.exe 1408 cmd.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2932 timeout.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4112 takeown.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4624 Conhost.exe 5004 Conhost.exe 960 Conhost.exe 3968 Conhost.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4636 wrote to memory of 2932 4636 cmd.exe 86 PID 4636 wrote to memory of 4112 4636 cmd.exe 87 PID 4636 wrote to memory of 3680 4636 cmd.exe 99 PID 4636 wrote to memory of 4404 4636 cmd.exe 102 PID 4636 wrote to memory of 1408 4636 cmd.exe 103 PID 4636 wrote to memory of 3984 4636 cmd.exe 106 PID 4636 wrote to memory of 4656 4636 cmd.exe 108
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260822_9009ff.bat"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Drops file in System32 directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak2⤵
- Delays execution with timeout.exe
PID:2932
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32 /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32 /grant Admin:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3680
-
-
C:\Windows\system32\cmd.execmd /c "for /l %i in (0,0,0) do set x=1"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Executes a command shell one-liner
PID:4404 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4624
-
-
-
C:\Windows\system32\cmd.execmd /c "for /l %i in (0,0,0) do set x=2"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Executes a command shell one-liner
PID:1408 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5004
-
-
-
C:\Windows\system32\cmd.execmd /c "for /l %i in (0,0,0) do set x=3"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Executes a command shell one-liner
PID:3984 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:960
-
-
-
C:\Windows\system32\cmd.execmd /c "for /l %i in (0,0,0) do set x=4"2⤵
- Executes dropped EXE
- Executes a command shell one-liner
PID:4656 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3968
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\KernelBase.dll
- Size 2.8MB
- SHA256 79eadbc61d0762e6931ee5e49007898596ece6bc2a61c080ada7a2c70992d6e6
- MD5 957a7c72c0ad30d568e04fce3313082f
- SHA1 1919c89186b1e3b4da4aea812ea43f02eac28cd6
- SHA512 cbdf38944b7d7132e7c7448bc715e1e94b1a9a97a6108d90c44fd5637c19dbf39969ee69a170525a2c920b6cb67941f79e8ca818c3e4e2ffbbe3ea90fa0f7d7b
- SSDEEP 49152:k9DXAGO5xztYAHzBO9Y66PZKJcbcLW0Zb:EXqU
- TLSH T112D5073AE66509ADC42A923784230636E7F13D204320B2EF56B588ABCE5F7D1533D6D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SHCore.dll
- Size 686KB
- SHA256 79e0e627e4e8b0a34375db8c71592977538e9743cc67adf88c615157a0e86b00
- MD5 ab4b87457d2b08b7c51b136c05bfed27
- SHA1 3fab36a2f84c75232115d3f253c1a9e7f087e7b5
- SHA512 37e8d142ecb1112b25e54cdd10a56b972a435397f2c6dfbb209331181eab68db997a3d2a781581d4b59a66d87ccd22e02300a4112a6223f29fe72e860cd2c4aa
- SSDEEP 12288:BoMfjHRnqfLDRHJDCtIkHuxD3rF66PmGdLE:B7JqfLDRHJDQ1HuV7F66PmGxE
- TLSH T10CE4291E66FD449AD1BA913DC5234619E7B27C201352E6CF1250837E9F3BFE86639B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\advapi32.dll
- Size 673KB
- SHA256 e92f9f71ba5a405c5d1a51bd03d6f830f004aca05b80b5bcf525514eca4480ef
- MD5 e70a1568a400e71a8e644652fca4c925
- SHA1 6cc13f29c70b41326832b2145e134568e5d9a3a7
- SHA512 55863e94e2215b3016df306915bfdbf85486948cd6b1f08e924b7f14539f1ad8fe9a8bd88226fb73f2ce2811196bf48cbff05ecdb8fb3e6ca7cf22f28451fa67
- SSDEEP 12288:Sr0imLVILaIn79vpONQ9r4S+3Rcc7/X4Q2ltOVHffCYOQwkJ6XiPDZAm:FimLPIn79Em9cVh/X4Q2ltOxfAQwkJ64
- TLSH T153E4391FA2A9459AC47A827A84570235BB72B434230267CF5580C63E9F1FBED6F39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\cmd.exe
- Size 283KB
- SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
- MD5 8a2122e8162dbef04694b9c3e0b6cdee
- SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
- SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
- SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
- TLSH T11854291D23991CE5D927923D9903C226C6727C346321A6EF22D0CD7B6F63AE97A34F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\combase.dll
- Size 3.3MB
- SHA256 4d4f893a1e260c4e9e286eb9ab4ac3e9b356495da05b691fc40e65056767a7ab
- MD5 b1e221f0f19f7a1e56cddc254e8ca5c7
- SHA1 490c54ab441f11b64dda968bba5523b9cf87176e
- SHA512 58134ac9cffbb08b24efea681138d53489f7d511ec4098d33bb7b003968e851b5bf17b84f85b83b56407682ca0bc2354a8e388f05da1a9a24435490fda5b3977
- SSDEEP 49152:o+ccYQyMFVoXM1avFZq9TUfHYKkjhGdJSYDpiLO:o9tHd
- TLSH T1DBF54A2A22EC0595D63B913E8817430BF6F17429473166CF2568823DAF63FE55A3EF90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\conhost.exe
- Size 848KB
- SHA256 51bb5aeef2e48dd14fae764f80dc67f516df9914ea9c350329e229f6cea919a2
- MD5 63a31f47716fdaae337e01a231cc2544
- SHA1 2804a88016d8341f5bc6ee7c3fa7b310d3488859
- SHA512 e143e149f17929140a3bd2e346f0cdd5447ab4639f2e236df330471933ec9d5657f9d0d1fd2cb54dc2cc97239fc990f004a25f8122bfcf75549b6ddd65f1d184
- SSDEEP 24576:uqkwFs5YddRkadhmAb5whmJT5OIWe7Zw:uf5YddRkomAmmJNLWe1w
- TLSH T1F0056C1EA6AC01E5D07AD07CC583CA2AF6713815037597CF01A0867E6F2BBE96E3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\gdi32.dll
- Size 162KB
- SHA256 de75aea74bf6453f42f02b949a6a3dc00ecef4ae16310fc4a0acb6d869e1fd2a
- MD5 f1590bdb1c95293cd3b487ffc97353e0
- SHA1 9b3c7713828bda35bb3e4f30a56d61a2c19811dc
- SHA512 5be29ebe010ee79508f806680fb60851d90262877c3f9c24ab56aea3e3d5e0428764f364b0ec592fd7c3daabdf82976ee4f6530902c99eacef4a3c396952fbab
- SSDEEP 3072:gRNHGRdqaLZIPTRgN808TemEaCLrrBteHMzMDLQAoCpC4chIPwRTKeOBw2LEf+cs:HaCLrWiGlLc+cI6Tx+b
- TLSH T196F3283A3E5E1051DD7B783A48238C25A7B2F110835187DB0586817E4E5BFEA9D36BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\gdi32full.dll
- Size 1.0MB
- SHA256 f2f28c7195557af1e6d50016b41839514ea2dcd4716c5c5bb87dd2c200e5499e
- MD5 35e1a13f6a0902b4c89f59c89b355c86
- SHA1 0375b9e121f10c2d201c2f49c1c014723ccfcacd
- SHA512 de155aceace2ebd4a4421eca43a4787faef8371ff0349a3861c480ab7ee56ae43169e34600ad1d52d0342c71dd247d0a589f6ee96cf93c77394c92e88f58cc78
- SSDEEP 24576:8a3fx7BzK0+p+A0rvduXCmNvt9KIllb13ywlzGe:lPx7BO0+p+3Uvt9KIV3plr
- TLSH T179355A0EB36809A7DD6A8CB9D1235607E7B27C251F1183CF6560E2BC8E17BE1793A750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\imm32.dll
- Size 181KB
- SHA256 00053aa7be3825828ad7c8c1c9f9ad29df07f5538107479886d8427df86bb4f0
- MD5 669d9741e74156425354ddab8bcc581e
- SHA1 3384654e76559fc6900e58296967ed89757ba8c9
- SHA512 b520fdae3489202e532e11c73309f5b2a960f202a5872d25377ee2622846066eaff54fca61930426250787e55f243e30430dd6d3ffad004e318c6e6ed597921e
- SSDEEP 3072:W8GBTTrjijAoUsxGuXo3wITZaDclJSalfI1X+6mh2m5sHYQ:W8/ATuXo3NTZaDSoawXbmh2m5sH/
- TLSH T123044C2D237E2069D46EC07D84864259D5B2B43213847AFF15E0CA7D9B53BCABE39E0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\kernel32.dll
- Size 752KB
- SHA256 e5988a4597838f07fff021dd6c1653a8a459ed6caf2a63da95ec42ab49d37e0d
- MD5 1b6d9bd5677f3fe825a7c393ec60dc64
- SHA1 095de4ddb7bb0b3a20918ce78083382ca2eef872
- SHA512 9f1869acd9437f74f1b581e5256a2186b9e24c4e68984e58493224c0e575865d48175f14ec2255948d1dc0c79212c272b9ad514466f21bdcfe98b1d7d5f25798
- SSDEEP 12288:tQnWOb1WA37aVPo8kpKp0Gd8LH6ZG6HF4W7tRcQrHYjsX/Sa4jb:t8WOxVuZPk8f8L2BPpnrHY4X/Sa4jb
- TLSH T106F47D1EBBA901D5D4BBC279C0524216FAB2B43423115ACF5590C77D8E1BFE8BB3AB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msctf.dll
- Size 1.1MB
- SHA256 6f76f28097ff333063b56ae707b7f3d8d9091d5ccf3eb092948ad038ef2e5ad1
- MD5 a00141b119f97b3738e81d21f0700cd7
- SHA1 a5c59eb79719b3465b4bbd5cb57a6953a4acf3eb
- SHA512 25bc4b932fddf93c35c43b27027ae8ab1e0e0fb54e29ee6fa318680029691fb36d9a544f671a1f0e3937ec6968e6fffabd6320f0329f654a096046444440ea64
- SSDEEP 24576:pG8q2kzSdHI/CebgMCtGyufWp+dV6B4bwNDi+4j/B2EF:YZzSRIqWWX+Ae7bqr4j/B2EF
- TLSH T128357C1E62FD40E5D57ED07CC247864AE6B174211322A6CB1260C6BDAF77FE12A3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcp_win.dll
- Size 619KB
- SHA256 fd1d0cc8a5ac8bf20af9e1a7ec360dd76dc022dfe992556948df1c17f7a714d2
- MD5 34692d0bde33641b576c32165fbaaf6d
- SHA1 09c6a238c7b2936207f261562079a327aa9ff34e
- SHA512 7d65519f50fd61b08fe7f676ff98a526c469dfc045c15a92c13d2e2227d41cf2c5fd4bbff4d15a6da22840be4bd7ed02fc03bf96905787e7356eaa0066bbbe47
- SSDEEP 12288:UXTCudddboDSf8I+YQtAww7ZQEKZm+jWodEEVM6LZW+V:UXTC/Sf8IdQKQEKZm+jWodEEq6LZWq
- TLSH T136D42A26BB4D06B0D166A3BCA1C38746D7F1BC154722A3C3429BE26D1F6B7C56B3B250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msvcrt.dll
- Size 622KB
- SHA256 dd7c8bc34cdbe30ef921395e874909bbf6be53803822164f75f7207e9f085650
- MD5 a4f2d5942fb447cd48a5cee414983e85
- SHA1 5aff4cfdee689f127df3c555281dc629d4d62318
- SHA512 c464ddc6aee00721fac488256f4ad643634c439558b9ab5f974be9633961a69c99830a308aabeb91e930ddf0d527cd0d328a9aebf1fc2e807dfa2cf02abec3bd
- SSDEEP 12288:TuL6kDcQeKOuNCg7E6NnQCTNv58/PnHzntBiyopdQNwTmVy61Obo:SLTelNoE6NQCTjWnHzntBiyopK0mVy6c
- TLSH T1BBD48C6473D90AB5D87BD23DC9825226F6B2B816137482DB02D18B695F23BF4673F342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ntdll.dll
- Size 1.9MB
- SHA256 12d1bac765448db638adc8327de1101e5e2eb5829b8da7edd5b216a45c717eec
- MD5 47ccb0e28d73f695c5d5266ffbb300ec
- SHA1 63e6167944df951ad2d279d0b64e37bf2f604c07
- SHA512 8219f5cfd7a6bf28b8880529240e0b49a2fd78c0c5227cf6471cbf153fd32b2664ae31396d4b6897c2686e5b7826b9f9dad434e82e7032c7a5aa3ee9b2771145
- SSDEEP 24576:+jDIKW2lX/rJ9cHcqmfvYbk7FKX1LkS5KvAAcHzzd+2/40tDsNx7b+fU:ID7DEpmfvYbknSPBTzddg6DsLm8
- TLSH T1B395B352A3F81654F2F7BA3499B516219F767C86AB38C6DF1280455E0EB2FC09E74323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\oleaut32.dll
- Size 812KB
- SHA256 bbe70836e44ba71555906d37011ec2aa3f86bd1314f5431406bba8f305dfb570
- MD5 eab5aded2242feaee371ed5cab6ea919
- SHA1 d9d46f3be08dd8b988b873c4e034c622bc0fb119
- SHA512 44debfc49043003a3e95af09e6687783c55f31009fa4d156218f70fc4ec41f1f086aa1eaa2a5b044f8d1982554a3be525625c28ca617b9db19f0558b27559c7c
- SSDEEP 12288:DVxBGt9lCED1GHQpo+4gM0yDQdD7HDfoRKv0:DVzylHYwo+4pZQdD7cR
- TLSH T1DC054B6EB69867AAC57A5039C6C7822BDB75742E135063CB00D446BD9E2FBD42F3E304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\rpcrt4.dll
- Size 1.2MB
- SHA256 c84bbd6d2e4f0334d75d6199133515fce3d44439062095f0dcfd1f8df0f5183b
- MD5 dc0b01c678d532758d2b1fac1566f89b
- SHA1 b35fdb8d452e39cdf4393c09530837eff01d33c7
- SHA512 7a898d3ef8ade5047ebe59ba1aa3a82ccd6ac0d12ec0828726dc49ee2791c2c12188052893e208374040c64f26c905fa08363740327735becf9b2fd79e3792f0
- SSDEEP 24576:jJgvgB/03A6KKb1EjNvJ1ET7ZaQdePt6KEzQrAdMl2UTS6:ExKBjNvI74Q4tgz4AdMlDu6
- TLSH T190457D5AB2B840A5D97BC179C6178A1FDB72B820132597CF02D0CA796F23BD65B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sechost.dll
- Size 610KB
- SHA256 f900de6143d808a03584075417940c5d42bcf612811a19129059a696be8645d7
- MD5 e127fce942c28931ded1442a1f2e84bb
- SHA1 2afe30f581351040cf0f6c721fcd33cc285158e9
- SHA512 c6eea30c104cf775a2732492226570bd9cecd65efbfc8f33ac9fae1c2584f8bc0a3121b5dc3566049a8f12aa1260ed002ce39d8b0c996a17c139960d1b20c248
- SSDEEP 12288:/Nta3A9E5yUoK6MPbq7mJQwOca8hHiewKu/8qSnaX4:/TaQE5yUj6MP+iJf93hHiEc8qSnao
- TLSH T1C8D45B0EB2A841E9D4768279C5534326EBB2B430235257CF1290D23E5F27BE96F3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\shell32.dll
- Size 7.3MB
- SHA256 7b5993e69ea99e221f68a73015462bcaa8715016d86b696f3dd7925638c2dc51
- MD5 d95d7855920fb0462704e85f82c2d4aa
- SHA1 071e5939aed6d2a1caf3eda1896a35eefa6cd3ec
- SHA512 d09b0b02cf36ab7e6f7a098eb468313584e564397f8a6560eff20b49ba5a4a3835281740fbc90b9ce59a7825042c2ebcbbfe37c02664c20b981eb7aae37b4607
- SSDEEP 98304:t5y/HcDydPRXRVPiAhttkHP35WtjAbtj3ql:t5y/uy5RGItkHP35WtjApGl
- TLSH T13376285E12FC00A8D9BAE23CC557464EE6B238312322A6DF0521C67D9F27BE4593DF61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ucrtbase.dll
- Size 1020KB
- SHA256 de8d08d01291df93821314176381f3d1ae863e6c5584a7f8ea42f0b94b15ef65
- MD5 2c8fe06966d5085a595ffa3c98fe3098
- SHA1 e82945e3e63ffef0974d6dd74f2aef2bf6d0a908
- SHA512 fb08838983c16082a362b3fc89d5b82e61ae629207c13c3cb76b8a0af557ad95c842ce5197ae458b5af61e5449cbab579f509fa72866308aa6fbd3d751522d0f
- SSDEEP 24576:k1foGwlaDT2hOPk+j2ZXCE6ccJEsmxvSZX0ypCDb:kfoBRhOPfXiL/
- TLSH T1CF25AF64FA5C0AA5D57BE17CC95B550ED5B2780207708ACF03EA4BBD2E2BBD91637320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\user32.dll
- Size 1.6MB
- SHA256 a1331a9b4c8cca6ccdda97efa7b57fe249cb1753b0ee9c212a41856866c21b23
- MD5 f804d60514ec31233e6df99949b7ff1e
- SHA1 96d48b58e741a33d6729d4d2ae57f7f52a0d4961
- SHA512 fa60f5ea399a316946dd35c0c346ff6cf19e76d905055f4473f11edd47dae937efe2482ef4a0bb435aaf68d4aa29ead23c538231f66d2a58499d79547341f58a
- SSDEEP 24576:TNjNU+J4wogYQIA4wPrfZk9BFAoUXlJJBwuCx59U4IgL5pQ:h94wogYQIA4qrfqIokPJBwuOTU4IJ
- TLSH T125855B1EB768C096C83A42358853C275D6B17C305B6066DB62D0FB7FBA33BD16A3A705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\uxtheme.dll
- Size 614KB
- SHA256 8080001033997f644aceb6a08c9a8fb445a9e338ec3202fa819936dc71f06367
- MD5 77b94683930015f413c0479f4f21e8f6
- SHA1 e5703d9697da0d23023980847a48eb3e49f22458
- SHA512 57ca6c40b9c5848fc5aa5e3df73249af41dfb09e3b84309807b6a84385cf7d4324cf831872e42ce456fc1302eccde3aeef8feebb57aa451811540fac25545924
- SSDEEP 12288:BOXTGVgMfb96X8bPRUWDqMqByjSB3a0Vt7Pgw:BQCZfJ6Xmk9S2zPgw
- TLSH T13DD41A1927F82654F1B7A6B89AB64D25E573BC711B10C2CF01A0817E4F37ED49B39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\win32u.dll
- Size 129KB
- SHA256 f9f54817d8174c8cefecbb36c1c001d8a088bfd87d769d38f2dd0b5108c668ac
- MD5 1fb6e05a75de3ac92adfdbf8f8dd2bae
- SHA1 5627fd2027f52276b790c2c4a6ac39b5f370728b
- SHA512 a26f4a1583e77e0d2b8085813b40b17e5e007dde602f92a1e0d736c41b1adf56bfa0a5bd4715dd281cf7acc33d034b8dcccdbf71ceddca8a8082368181881eb4
- SSDEEP 1536:e9d37P99r/EcfkJf8k7f+sBi5igjWu9jhk7OSM9q/QOmlvPurp:e9d37VV/Ec/k72DY1vS9qI/lv2rp
- TLSH T191D3A1B9BF3FAD45CF37043AAAD82632FB5BD08BC39F9CEACC0685F449541A54118598
- MD5 SHA1 SHA512 SSDEEP TLSH