ae3ae7a9cdbc0324ecd4a19e5c437db5524a0e3f210c865dca557f792718b950

Analysis

max time kernel
119s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/11/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_x64.st.exe
Size 34.7MB
Sample261108-peatyazyfv
SHA256 ae3ae7a9cdbc0324ecd4a19e5c437db5524a0e3f210c865dca557f792718b950
MD5 25e7fd7efbe6bdd8d74c4a0c920a8a60
SHA1 bbfcbc6382c9a3643628ec35d5054c560d3ba333
SHA512 8a8645048e0a2aced18e686fe0a491914a418aa20d43f6f8d0e4b758b7e7d3d0ba7d01ea8af2272fd0f50c1ab400b10683ea3e7f976af9303335a44216b89b2b
SSDEEP 98304:woXhHo2DLxG8fPCBsGFnamKfQAD8ntZQsj:woRI2RqBTRKIAqZLj
TLSH
T1D7871C02B6069D8BE4659238848B4FE1E371EDB18A71977723B57B2D2FFE34C4E96104
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3708	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3668	amEF10.exe

Loads dropped DLL 1 IoCs

pid	Process
3668	amEF10.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2356	cmd.exe
3164	cmd.exe
1344	cmd.exe
3012	cmd.exe
3864	cmd.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3920	cmd.exe
4052	cmd.exe
3300	cmd.exe
5744	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	deepseek_x64.st.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	deepseek_x64.st.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3540	schtasks.exe
3448	schtasks.exe
4776	schtasks.exe
5000	schtasks.exe
5012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
4996	deepseek_x64.st.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe
3668	amEF10.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\deepseek_x64.st.exe
"C:\Users\Admin\AppData\Local\Temp\deepseek_x64.st.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4996

C:\Users\Public\0Mfx1a\amEF10.exe
"C:\Users\Public\0Mfx1a\amEF10.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\0Mfx1a\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1344
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\0Mfx1a\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3540
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3448
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3864
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4616
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2244
- C:\Program Files (x86)\7Mk2ce\7Mk2ce.exe
  "C:\Program Files (x86)\7Mk2ce\7Mk2ce.exe"
  2⤵
  PID:1808

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\0Mfx1a" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3920
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\0Mfx1a" /t REG_DWORD /d 0 /f
  2⤵
  PID:1556

C:\Users\Public\0Mfx1a\amEF10.exe
"C:\Users\Public\0Mfx1a\amEF10.exe"
1⤵
PID:2164

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1480

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4052
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:2248

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3300
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:4536

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5744
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4200

C:\Program Files (x86)\7Mk2ce\7Mk2ce.exe
"C:\Program Files (x86)\7Mk2ce\7Mk2ce.exe"
1⤵
PID:4572

C:\Program Files (x86)\62Di7x\Z7wNE.exe
"C:\Program Files (x86)\62Di7x\Z7wNE.exe"
1⤵
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\62Di7x\XPSPLOG.dll
Size 115KB
SHA256 804496aadeeea8dccfacbfc8c82472f5ae190a9e7e985fb4e73c25bd5d4039d6
MD5 f8f68d61bac460e0ca73a7eb89c708c9
SHA1 5bde1e8d2e7a1b4436ee6c6d4ec4402c7ce7b9f9
SHA512 96574e0dd5d8a43684c6ba8e438903f484c0b1d38398e98ddca6ac16d4a8cdc357477546b01b22652a06476c9a49cc2bdd542ed56d05563eaae8f8483aa10ec3
SSDEEP 3072:VuDVfyYAkejiAJphPDdCpcB3CFtM+qOuF6cdl:VGfQzVDspcR5LOuFD
TLSH
T11AB312E583DB0E19E5447871190CB94DBBFB6AEC41598D09C8A5B4C6EC386B430BF6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\62Di7x\XPSPLOG.dll
Size 95KB
SHA256 007b43f15d255c29f6ce22a6b27d484ed1bd748dbccc396a8c7374ed432153e4
MD5 5f569edec3c8dfac91921be65d91eb83
SHA1 18927cad5d25fa3c5875b0335b01062887398fa1
SHA512 13a7568ed59186a8ee8f023a8c37a93e8f8e1e8158b461277e0da8016013578b6569ec0ec001a0426f71f00e72ebda7f01af1fbf9aee3b1b41b0c3116f9ea5f9
SSDEEP 1536:o2gRD26twkyYSle/qhRZi/IaefvxLhHOdX0D15tCXfR4tB3CFaklEeMXSrse+btF:VuDVfyYAkejiAJphPDdCpcB3CFtM+qF
TLSH
T1AE930255C3DA0F19F140B875190DEA5DBBB716F8425B4E08CCA6B486DC78698307F5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7Mk2ce.exe

Path C:\Program Files (x86)\7Mk2ce\7Mk2ce.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7Mk2ce.exe

Path C:\Program Files (x86)\7Mk2ce\7Mk2ce.exe
Size 95KB
SHA256 5b4602b18146ef118cc5ae09531530bf21be23c0d47a52a1e4de887291f52329
MD5 830b13c009535cbf3899b816fc4c55cf
SHA1 1fbc9095fab2a409053700ebcc034f6be8c35fce
SHA512 81a3153e9fabfd884b728bcfc2ef6f2be17fd22c9b06aeb249b2af559585acae8892f0ffc4729575acfad21f77fa9ebd6a051ecb1c608bf7790c0dbe171b5faa
SSDEEP 1536:AOJ5kh1iOUcZGuYDKM95YRTqWLGzwzzBCLHvaOkYrofdRsW+3cdxtBQDTCCvtO:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCd
TLSH
T12C931B52B6C19475DB7A1B311864C9614A2EFD300E60AE6FF3783D3B1E305838E2796E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\7Mk2ce\XPSPLOG.dll
Size 247KB
SHA256 4fd77cf6da3c1b987cc945ecbd43e5e279c2c36f1b0c297b84506afe18ee95b8
MD5 06ad5e36b83c12da9be1beb5a23b73eb
SHA1 f0466b8aa56cae26a35b6de53d003d1af2fcfb51
SHA512 684981395a3cb33040cc52b741b701c4ce7ffdb9a312a28bd4fbf27f62dd3fd455b9b20e619130401143a25f724462338b7c7d1bab9afc953e018a25e9471bad
SSDEEP 6144:VGfQzVDspcR5LOuFQyDsy8OOnk8oNkLBHtDKqlAoI:6Qls2PLOuWhkdNkXDKLL
TLSH
T1F14412E16397082EEE8679321A0DFD6C75F765EC465ECC5890C5B1C688766B2203C9CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\7Mk2ce\XPSPLOG.dll
Size 155KB
SHA256 9808d7f1c9dc45bfe386129e67ea9e1316b20033fac7da8dc25d2de5fff74860
MD5 9f92c768d63a208b49720224b8b0eee7
SHA1 3ad5008193c2df121fb7bac930a6f09766e4b473
SHA512 7fa9b3ed4bceae1ab42b59c055d9446f93708c4e018392b99bd85a228eac71e6895af6291154f32dd62755a35938b03d2b64c3ebb900fc25ba4ed7894dfed687
SSDEEP 3072:VuDVfyYAkejiAJphPDdCpcB3CFtM+qOuF6cdmFyrf/snch8O1E4tp:VGfQzVDspcR5LOuFQyDsy8O1
TLSH
T1EFF312E153D70E0AED00B9705A4D769D76FB66EC468A4E1AD8C1B4C698392F0303E5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\7Mk2ce\image.png
Size 189KB
SHA256 89d89a23bff785d99d942a56a668263b6b4a973985bfb8049934d938a533799f
MD5 2c5ed00c6028bdcc8e50c8b8c4fec4a9
SHA1 c6d4c78170b00b830367eb251e4347722a7e662a
SHA512 c952f76b87d570bbaef6daf6d35d983ddf3d24d024f4bba3a043cee9a3f43c4ae89ab88bb046810d53bf88bcdece3de541c420a55d5a9020e9dc66482af7168e
SSDEEP 3072:kWt91z4a+2+mrNG+SUXDkYXfKOHR23sA3ZVrlTTJriQw1rJ9EWeUxRocNbd/Eo3E:k+V4yNG2zkYXCOHU3sGLZTNHgrrEhU3i
TLSH
T1CC14134BEDE75EDD96A4F06A94078CC0BB1F96F101C129B56093BBA49E58277F0060BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\7Mk2ce\thumbs.db
Size 64KB
SHA256 4ee16d7fc82efe0fdeaf20d805e878a1b840436dda467b65494982220567dd95
MD5 1e14d38ae7fbb830c308d7b6030b64cb
SHA1 add0b5924621dcbbf5ddd6f841bb2a88c21cac37
SHA512 58fdc5d02bd296fdfcff119f423ed6199181c098d79f6756735964cf188e6aeaf724299597eb55fa753a75fed2c7584292c85365ace5bcf0755b98f47d1c4406
SSDEEP 1536:F3vz2dZLhsBsbqoIkuACkPsTdZJOfYKo67Me5pgy:0HOKbHuACkEJOfY56B
TLSH
T1D853F15DA6862EAB4E1BF77DF08B4069E84E9053079503033BF2C5E1DA0867A859FD6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 2295444dd78f483c7ff2c0e763e2d9a1e4794198a88ff7ee3cb6afe611a419eb
MD5 db9f1b886a6ad4c9322cf7feaddc6527
SHA1 17e0008da722d6a234002816c8efa5075f94bd9c
SHA512 f85fdf36817bbed2d0b43eb83e3617f933919d121a96f24e97068f7bbc477fe0f02f605f559abb4fb1ae8221aa5440d1c5996d82961955058d8aaaa186bc1410
TLSH
T17731C9BF1FBCA5C6AB7A4D8418CEF1352CB0A1605CD6444A9215D4986F083F31F4ED0D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 ca19e6e805dde52947b136d0d978b3f059067e590dd60f71ce92301077d0243e
MD5 d65fae1f27cce5e1e18d0fec6246d866
SHA1 ca6156b08b62291b30001d8fae6e16b3148ee9b9
SHA512 37e652460663875c48db2735eedf58f9bce57f8e55899d9d872b7056062cb26d9df647c93a624705d8fac5ae44bd6a838f08dd02a8fa37179fd99770654cfacc
TLSH
T13331D6924A33E50ADF55CE385A8ACD6239F042E335B5A808D03AD3AB45417B71E4A888
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 718b32953375c51a0f7a4e1646aaa257ecd35758fa9adc3cd926447ec5d0b17b
MD5 97dc811b734dd9cd5178080409520466
SHA1 ae20266a127f4a9a606e803546ef06230bf78ed6
SHA512 886408a6bc266a5945c02eafaedea6700b01cb5364ce1d6c23cc527cf0fb1fee6af5d948b5d2fcf753f792bed5f7e2a25312d2787ec9c5883d935e2cbfca7075
TLSH
T18CF05C0C9678523EF0B3E93D8ACA3B671A6BE605244945A40AE44709A522B433D91779
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 4ccc08ffbf991e44c46ee90be1d5bb60a06b84559e1da519bfa88f5b6fb4e362
MD5 8ba8bb3ac397d56a7dfd22e15ea0b16c
SHA1 00936c2f7c1e79c655dc6380b066b5382b3f540e
SHA512 aa4c303d8a69632d3dbeb27d34cac9f67a532be3086756160d4f5f227a8bfe001543377b7f4585ce1d30177a631f1faba8a9644cbef60011fa001c221474ff53
TLSH
T1BFF05C3886E9416FF17BD2B4CBE67AA36A6DF632210651EE0AA403442A618006C4332C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rambclvs.q2i.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rambclvs.q2i.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\0Mfx1a\UxEnhance64.dll
Size 3.1MB
SHA256 d880b0dfee5ea5d938a9827ce204bb84a47562a88bf9b6e31990efd045174889
MD5 e5356201c3bf1454599eb15b1c316c12
SHA1 b63cfc3262b12c38796e94eba8248c4e5e4c0d5e
SHA512 c73a173301aa4d10c5c956c091047ba57e0531358acab4f6d2cc24f64057f48a1bc1167fd8d4dfe28cb32ded4f487674d8385df37c0b48d8d75119faf54adbd7
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+o:P9m29xx3Tiqt06ox6+z2rNNrKoo
TLSH
T118E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\0Mfx1a\UxEnhance64.dll
Size 1.7MB
SHA256 f95a43144e40812e15318ecec3fcb9b479f2e6d02bb0a5a7fcfd40b913ea2dca
MD5 182a6c69b8f1465d828fd2a97c1b18a5
SHA1 63a12fbcfa498dee94eb2a7283aea022e3c2ab00
SHA512 3eaa49e03dced03d9e3f7b7c426898b95b2833c8039a8954009c4d004cd2b882d7df716dbdf96ad0caf38a6890383a9f097c649d64037915af1cf4ac6c192179
SSDEEP 24576:WTa0QKHReqZIMlcseQCIHfrPqxkglC6BKVu/ayHXBTswHCMJU5bmNlKQ3w8BtSes:P9KpI8cBa0kj6BK0x3TiMQclkGo2PX4
TLSH
T1C18523F563A338F3E8361AF4FE7197C61C501E203F07648F675620165AA91F783AA395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\0Mfx1a\adoresd.dat
Size 4.5MB
SHA256 574ccd9a1c0851b52cd410f4f0a6cae15497d7c0b25a91b399563382095c890b
MD5 62b0b17c006a5c7f607faa08ea9658bd
SHA1 fe6c791194a7e24a3bf40cd3e40ad048a13ba79d
SHA512 d8c090d5942a7f05c0b13722c2205b6d649f8dcb283c7b682608f123df639d30825610d8c288f84c235f0eaf932867ec3bc305333f8a3ea5902641614b242bb1
SSDEEP 98304:rWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNl:rWj3WRdRQH5fimPGmNc7dBtYOR
TLSH
T1952633EB2E83F58F1983335654C8E0256D7FBEC635CA375E6E7888B7932214A04BD548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amEF10.exe

Path C:\Users\Public\0Mfx1a\amEF10.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\0Mfx1a\msadox.tb
Size 8KB
SHA256 258ddd9293a9970fc77aeccafff4fe518b19f1c2aa682f73a2080b28c1c50e5f
MD5 a5bfc9dc76d8b4bc997115fa4dca8cf0
SHA1 59435d52f90fa833f8afcd24a5eb40f5d7983127
SHA512 35abb7ec0e6d6d9a71ee97ba1632890b45639fac58c9478b59c7bb43d6a5ab575407ea2e2e641fa5ee143086fddabf1404e3e422629a01fc61c5f5362047111a
SSDEEP 192:pqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:psZqZOXQ3uqvR2Kfzp
TLSH
T1F8029E06D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-675-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/1808-676-0x0000000074CA0000-0x00000000753EA000-memory.dmp

Download

memory/1808-680-0x00000000033E0000-0x0000000003BBD000-memory.dmp

Download

memory/1808-683-0x00000000033E0000-0x0000000003BBD000-memory.dmp

Download

memory/1808-682-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Download

memory/1808-706-0x00000000033E0000-0x0000000003BBD000-memory.dmp

Download

memory/1808-694-0x0000000004C20000-0x0000000004C34000-memory.dmp

Download

memory/1808-687-0x00000000033E0000-0x0000000003BBD000-memory.dmp

Download

memory/2164-584-0x00007FF8C2CA0000-0x00007FF8C2CA2000-memory.dmp

Download

memory/2164-589-0x0000022427380000-0x0000022427C57000-memory.dmp

Download

memory/2164-586-0x0000022427380000-0x0000022427C57000-memory.dmp

Download

memory/2164-590-0x0000022427380000-0x0000022427C57000-memory.dmp

Download

memory/2164-572-0x00007FF8A0080000-0x00007FF8A059E000-memory.dmp

Download

memory/2164-576-0x0000022427380000-0x0000022427C57000-memory.dmp

Download

memory/2164-591-0x0000022427380000-0x0000022427C57000-memory.dmp

Download

memory/2164-593-0x00007FF8C2C90000-0x00007FF8C2C92000-memory.dmp

Download

memory/2164-592-0x0000022427380000-0x0000022427C57000-memory.dmp

Download

memory/3668-544-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-536-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-567-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-557-0x000002136FAA0000-0x000002136FAEE000-memory.dmp

Download

memory/3668-558-0x00000213711C0000-0x000002137124A000-memory.dmp

Download

memory/3668-564-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-556-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-561-0x00000213711C0000-0x000002137124A000-memory.dmp

Download

memory/3668-531-0x00007FF8A0080000-0x00007FF8A059E000-memory.dmp

Download

memory/3668-562-0x00000213711C0000-0x000002137124A000-memory.dmp

Download

memory/3668-530-0x00007FF8C2C90000-0x00007FF8C2C92000-memory.dmp

Download

memory/3668-566-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-539-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-543-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-559-0x00000213711C0000-0x000002137124A000-memory.dmp

Download

memory/3668-550-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-546-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-545-0x0000021370510000-0x0000021370DE7000-memory.dmp

Download

memory/3668-538-0x00007FF8C2CA0000-0x00007FF8C2CA2000-memory.dmp

Download

memory/3708-607-0x000002682E9B0000-0x000002682EADF000-memory.dmp

Download

memory/3708-600-0x000002682E8E0000-0x000002682E8FE000-memory.dmp

Download

memory/3708-601-0x000002682ECE0000-0x000002682ED92000-memory.dmp

Download

memory/3708-602-0x000002682E900000-0x000002682E90A000-memory.dmp

Download

memory/3708-594-0x000002682E8B0000-0x000002682E8D2000-memory.dmp

Download

memory/4996-0-0x0000000001F10000-0x0000000001F1E000-memory.dmp

Download

memory/4996-525-0x00007FF8BA680000-0x00007FF8BA692000-memory.dmp

Download

memory/4996-524-0x0000000001F10000-0x0000000001F1E000-memory.dmp

Download

memory/4996-504-0x00007FF8BA680000-0x00007FF8BA692000-memory.dmp

Download

memory/4996-2-0x0000000001F60000-0x0000000001F6C000-memory.dmp

Download

memory/4996-1-0x0000000001F10000-0x0000000001F1E000-memory.dmp

Download