Malware Analysis Report

2025-08-11 01:03

Sample ID 240611-nlv8sawaqk
Target 54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667
SHA256 54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667

Threat Level: Shows suspicious behavior

The file 54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Loads dropped DLL

Modifies system executable filetype association

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-11 11:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 11:29

Reported

2024-06-11 11:32

Platform

win7-20231129-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718105382" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718105382" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe

"C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp

Files

memory/1364-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 a5da74734020f0ec6dcd3222d6ec7358
SHA1 128477a0f2080738cf4a23c5ac846b1952c29174
SHA256 a0d0cc13e9672703008ae8f50a1f1f08dbc02a5ba1b03ceb3222f8bf4d500912
SHA512 a268b17942d9dce97f97f6aa92de81aefbd52350d3a47981fb889b8672cf23565987a29fda45611e00698961cab75d8a787859662ce866ae9f13b19a7337589f

\Windows\system\rundll32.exe

MD5 6ce9ed5aba586c099ebec3d94fc72cdc
SHA1 19990bc3d470cc43ba6fad0f4c76fb0c1cdd9f77
SHA256 26586035b57c9dc0ad48d94a0a860de6fdfc93331bb000cd26f288ad25e3c6b1
SHA512 3e3d57df3646bf362681a165086a37ab16d5d4fa98e5d8e0ad24fc99dfda617ea72ac392b722cf43a472671758b66ac7410e42e6d85da7adb6dec065d8f69779

memory/1364-14-0x0000000000700000-0x0000000000716000-memory.dmp

memory/1364-17-0x0000000000700000-0x0000000000716000-memory.dmp

memory/2844-20-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/1364-21-0x0000000000400000-0x0000000000415A00-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 11:29

Reported

2024-06-11 11:32

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718105382" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718105382" C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe

"C:\Users\Admin\AppData\Local\Temp\54eead1de8bd27ec7af94eb47732a0a14f00122c592e25f4774b694c49f62667.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp

Files

memory/2216-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 a5da74734020f0ec6dcd3222d6ec7358
SHA1 128477a0f2080738cf4a23c5ac846b1952c29174
SHA256 a0d0cc13e9672703008ae8f50a1f1f08dbc02a5ba1b03ceb3222f8bf4d500912
SHA512 a268b17942d9dce97f97f6aa92de81aefbd52350d3a47981fb889b8672cf23565987a29fda45611e00698961cab75d8a787859662ce866ae9f13b19a7337589f

C:\Windows\System\rundll32.exe

MD5 6ce9ed5aba586c099ebec3d94fc72cdc
SHA1 19990bc3d470cc43ba6fad0f4c76fb0c1cdd9f77
SHA256 26586035b57c9dc0ad48d94a0a860de6fdfc93331bb000cd26f288ad25e3c6b1
SHA512 3e3d57df3646bf362681a165086a37ab16d5d4fa98e5d8e0ad24fc99dfda617ea72ac392b722cf43a472671758b66ac7410e42e6d85da7adb6dec065d8f69779

memory/2216-13-0x0000000000400000-0x0000000000415A00-memory.dmp