b658fdb91cc66e571b36c9f75e9af7f9aed1b85f500c2d4656d6173bfe1f5bd1

Analysis

user interaction
yes
max time kernel
231s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20260513-ja
resource tags

arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
20/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hdp.dll
Size 5.8MB
Sample260820-k2mpsscd59
SHA256 b658fdb91cc66e571b36c9f75e9af7f9aed1b85f500c2d4656d6173bfe1f5bd1
MD5 9b50be2ac11fb44e80a0efd76c2c385b
SHA1 37e5f6c68b91bca291fe2b87a6502b6190f81aae
SHA512 c3c73026bd943a5af990504f1fbdb4f3132215579b7d25745d9a4f3598768dfeebdcfc7af42940345970b4fc54cba1c3735c4634a22fc9552bab0ec22f0ab747
SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmknrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkm2i1RZ4O7NADtV6v+zZT
TLSH
T1EE56D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	5256	rundll32.exe
12	5256	rundll32.exe
14	5256	rundll32.exe
16	5256	rundll32.exe
26	5256	rundll32.exe
53	5256	rundll32.exe
54	5256	rundll32.exe
75	5256	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
5404	rundll32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	api.ipify.org
14	api.ipify.org
74	icanhazip.com
75	icanhazip.com

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4656	tasklist.exe
3068	tasklist.exe
884	tasklist.exe
4480	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1000	cmd.exe
4836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
5816	timeout.exe
1824	timeout.exe
4744	timeout.exe
4264	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3580	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3024	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe
5256	rundll32.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	5256	rundll32.exe
Token: SeLoadDriverPrivilege	5256	rundll32.exe
Token: SeTakeOwnershipPrivilege	5256	rundll32.exe
Token: SeIncBasePriorityPrivilege	5256	rundll32.exe
Token: SeTcbPrivilege	5256	rundll32.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	5256	rundll32.exe
Token: SeCreateTokenPrivilege	5256	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	5256	rundll32.exe
Token: SeLockMemoryPrivilege	5256	rundll32.exe
Token: SeIncreaseQuotaPrivilege	5256	rundll32.exe
Token: SeMachineAccountPrivilege	5256	rundll32.exe
Token: SeTcbPrivilege	5256	rundll32.exe
Token: SeSecurityPrivilege	5256	rundll32.exe
Token: SeTakeOwnershipPrivilege	5256	rundll32.exe
Token: SeLoadDriverPrivilege	5256	rundll32.exe
Token: SeSystemProfilePrivilege	5256	rundll32.exe
Token: SeSystemtimePrivilege	5256	rundll32.exe
Token: SeProfSingleProcessPrivilege	5256	rundll32.exe
Token: SeIncBasePriorityPrivilege	5256	rundll32.exe
Token: SeCreatePagefilePrivilege	5256	rundll32.exe
Token: SeCreatePermanentPrivilege	5256	rundll32.exe
Token: SeBackupPrivilege	5256	rundll32.exe
Token: SeRestorePrivilege	5256	rundll32.exe
Token: SeShutdownPrivilege	5256	rundll32.exe
Token: SeDebugPrivilege	5256	rundll32.exe
Token: SeAuditPrivilege	5256	rundll32.exe
Token: SeSystemEnvironmentPrivilege	5256	rundll32.exe
Token: SeChangeNotifyPrivilege	5256	rundll32.exe
Token: SeRemoteShutdownPrivilege	5256	rundll32.exe
Token: SeUndockPrivilege	5256	rundll32.exe
Token: SeSyncAgentPrivilege	5256	rundll32.exe
Token: SeEnableDelegationPrivilege	5256	rundll32.exe
Token: SeManageVolumePrivilege	5256	rundll32.exe
Token: SeImpersonatePrivilege	5256	rundll32.exe
Token: SeCreateGlobalPrivilege	5256	rundll32.exe
Token: 31	5256	rundll32.exe
Token: 32	5256	rundll32.exe
Token: 33	5256	rundll32.exe
Token: 34	5256	rundll32.exe
Token: 35	5256	rundll32.exe
Token: SeDebugPrivilege	884	tasklist.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	2920	firefox.exe
Token: SeDebugPrivilege	4480	tasklist.exe
Token: SeDebugPrivilege	4656	tasklist.exe
Token: SeDebugPrivilege	3068	tasklist.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
5256	rundll32.exe
2544	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
1232	OpenWith.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
2920	firefox.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 5256	3856	rundll32.exe	86
PID 5256 wrote to memory of 3580	5256	rundll32.exe	89
PID 5256 wrote to memory of 1000	5256	rundll32.exe	93
PID 1000 wrote to memory of 4836	1000	cmd.exe	95
PID 4836 wrote to memory of 884	4836	cmd.exe	96
PID 4836 wrote to memory of 2576	4836	cmd.exe	97
PID 4836 wrote to memory of 5816	4836	cmd.exe	98
PID 1232 wrote to memory of 3576	1232	OpenWith.exe	107
PID 3576 wrote to memory of 2920	3576	firefox.exe	109
PID 3576 wrote to memory of 2920	3576	firefox.exe	109
PID 2920 wrote to memory of 6136	2920	firefox.exe	110
PID 2920 wrote to memory of 6136	2920	firefox.exe	110
PID 2920 wrote to memory of 6136	2920	firefox.exe	110
PID 2920 wrote to memory of 2180	2920	firefox.exe	111
PID 2920 wrote to memory of 2180	2920	firefox.exe	111
PID 2920 wrote to memory of 2180	2920	firefox.exe	111
PID 2920 wrote to memory of 2180	2920	firefox.exe	111
PID 2920 wrote to memory of 5388	2920	firefox.exe	112
PID 2920 wrote to memory of 5388	2920	firefox.exe	112
PID 2920 wrote to memory of 5388	2920	firefox.exe	112
PID 2920 wrote to memory of 5388	2920	firefox.exe	112
PID 2920 wrote to memory of 4204	2920	firefox.exe	113
PID 2920 wrote to memory of 4204	2920	firefox.exe	113
PID 2920 wrote to memory of 4204	2920	firefox.exe	113
PID 2920 wrote to memory of 6028	2920	firefox.exe	115
PID 2920 wrote to memory of 6028	2920	firefox.exe	115
PID 2920 wrote to memory of 6028	2920	firefox.exe	115
PID 2920 wrote to memory of 6028	2920	firefox.exe	115
PID 2920 wrote to memory of 5372	2920	firefox.exe	116
PID 2920 wrote to memory of 5372	2920	firefox.exe	116
PID 2920 wrote to memory of 5372	2920	firefox.exe	116
PID 2920 wrote to memory of 5372	2920	firefox.exe	116
PID 2920 wrote to memory of 5204	2920	firefox.exe	117
PID 2920 wrote to memory of 5204	2920	firefox.exe	117
PID 2920 wrote to memory of 5204	2920	firefox.exe	117
PID 2920 wrote to memory of 5204	2920	firefox.exe	117
PID 2920 wrote to memory of 1644	2920	firefox.exe	118
PID 2920 wrote to memory of 1644	2920	firefox.exe	118
PID 2920 wrote to memory of 1644	2920	firefox.exe	118
PID 2920 wrote to memory of 1644	2920	firefox.exe	118
PID 2920 wrote to memory of 656	2920	firefox.exe	119
PID 2920 wrote to memory of 656	2920	firefox.exe	119
PID 2920 wrote to memory of 656	2920	firefox.exe	119
PID 2920 wrote to memory of 656	2920	firefox.exe	119
PID 4652 wrote to memory of 3024	4652	OpenWith.exe	131
PID 4836 wrote to memory of 4480	4836	cmd.exe	133
PID 4836 wrote to memory of 2192	4836	cmd.exe	134
PID 4836 wrote to memory of 1824	4836	cmd.exe	135
PID 4836 wrote to memory of 4656	4836	cmd.exe	136
PID 4836 wrote to memory of 5176	4836	cmd.exe	137
PID 4836 wrote to memory of 4744	4836	cmd.exe	138
PID 4836 wrote to memory of 3068	4836	cmd.exe	146
PID 4836 wrote to memory of 4232	4836	cmd.exe	147
PID 4836 wrote to memory of 4264	4836	cmd.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hdp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hdp.dll,#1
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C C:\ProgramData\S-1-5-21-1788976790-1541110888-1636651838\S-1-5-21-1788976790-1541110888-1636651838.CMD
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C C:\ProgramData\S-1-5-21-1788976790-1541110888-1636651838\S-1-5-21-1788976790-1541110888-1636651838.CMD
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5816
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4480
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2192
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1824
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4744
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4264

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\hdp.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\hdp.dll
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {f7c9ada3-0539-46da-bba0-39fb04012e83} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:6136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {3d292241-3cfc-449c-84af-15da07b1ebc1} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:2180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27276 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {f5db027f-20ed-4431-878d-15b710d246d8} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27276 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {ae03c8fb-25d6-4cc3-8399-9a567ea10b53} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4204
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1640 -prefsLen 34775 -prefMapHandle 1668 -prefMapSize 270279 -jsInitHandle 2672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4240 -initialChannelId {46cf6ba5-2ce3-4210-85d6-fddad2139154} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:6028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5156 -prefsLen 35012 -prefMapHandle 5160 -prefMapSize 270279 -ipcHandle 5168 -initialChannelId {fb4560e0-db58-4e7b-95ba-b356b9a13f82} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 32900 -prefMapHandle 5128 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {a95e2ee9-6bac-44ed-91f7-1a3f8b9b1eb9} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5204
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 32900 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {c72cab4f-4cc8-4bb3-9521-a19831e745d7} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {de116d33-b40d-4a26-a145-7634daba7bfa} -parentPid 2920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\hdp.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3024

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S-1-5-21-1788976790-1541110888-1636651838.CMD

Path C:\ProgramData\S-1-5-21-1788976790-1541110888-1636651838\S-1-5-21-1788976790-1541110888-1636651838.CMD
Size 1KB
SHA256 996ec717ba384bb3bcf7fe020356929fdb89b62f56a4562b929da5837edce009
MD5 d6db6c7eecf51a742cab3d047f8f5ec3
SHA1 cc42663091ea66fd9d57643ad2bd8a1d5bca5196
SHA512 9a34d32a4518f8d2b37b920777e828ed95fdca7ffb337aeaaffe2dcbf5e4ee09f57a19af862abecede75313d7953f84df582898b69c006fbad888ea00d8c20ce
TLSH
T15831C08EC4074D5C436643DA374ECC5FC640E057EED56090F0EC5F852355A5B1866AEE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 765a858fd6cfff51382b65204fe920a06d263697cd1e1e44e4cdc2cb827b147f
MD5 ce2e2f8f94bbc17bf38303865c7986d5
SHA1 eace06b15d1d37c21390b1664be47a00fd51f096
SHA512 06092e0a63238d764ce3c7f5ca7812fbd296617d72cf257f61a67ad50b1bb8a724fb1e2856779310a51584d5cef6958ca1591a9b4f1960873344d20d8a620201
SSDEEP 192:dOv5zboPXCWyj1QV1/66JozGzgCl6mc0d:SbovCWyjG/66JozGzgC1j
TLSH
T16FE12268E628863BC405437BDDA12B550F3A388A9C8E3F1935DC651C2C5B2DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c2f12a01ee6dce4cb3fae48266f7d4bd990d51f6d22f8a60785eedf0474d5c7b
MD5 5933266c8b1ab4e4a5739239d89ac8c2
SHA1 eaade2c4856c58270d354c5967a120f332a84263
SHA512 d4a3aa87cf95400c5b8dc544ad8017ba8dd2f262df66d2f6f12a9d4c411304e3f52a2f890e59f9bba469d2eb7c8a3666218ddfb94417b09c3ba3eaec08b103f4
SSDEEP 192:K1d66JozGzgCl6mc0ddOv5zborZCWyjlxI:0d66JozGzgC1jUborZCWyjQ
TLSH
T1EED1CF68E639863BC815023BCDA52B510F763986988E3F1935DC75182C962CE7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c93f4ab66a07e84d18ff5edd458ccf76856093719ba0a3ba5523185457cc79c9
MD5 985dc170c0e4fb94b7c759d2f19181e0
SHA1 0254d3fb93f4747d9524c0e12b778c81b9d7464f
SHA512 6a54dd85ab36b8b521c82979d5b3e54e0f0082f569b582345ee473b4be60f37291dec0c8dbac5320651784ce9e960fe0383aa0de0f4a1d9cc104b1f2732f9d2f
SSDEEP 192:K1d66JozGzgCl6mc0dCOv5zbo+ZCWyjlxI:0d66JozGzgC1jTbo+ZCWyjQ
TLSH
T13DD1CF68F639853BC815023BCDA52B510F76398A988E3F1932DC75182C962CE76CD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 aa25556db975a3e0246c359c8ca849ff69b512954c7ccb949cffe71d878bbb95
MD5 5a911e592b5960e9a8cd3cae6d4be5a5
SHA1 8852fc72fa126798e91e89b8031a1425bfb94fef
SHA512 4fb9e5fcb6c52f2a64ed691054f21a0d51c42235d30fc973c16cee1560523d508533f85c39315d3e7f5e68b5d6a02babe13bd928a2d0c9b104062ed1a4b59c6c
TLSH
T1EC213A9C39F84D6EA987E29C785102CE57928E5714D72C434D12FE8DCEC56AA32AE43C
MD5 SHA1 SHA512 TLSH

Submit Download

109803dd-2b8e-4572-938e-d1038aeb9105

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\109803dd-2b8e-4572-938e-d1038aeb9105
Size 2KB
SHA256 87b1c24161068a5f5cba5a9845534ff824e90c9110d09a34cb227f386197d497
MD5 5f6ab4b98ab3d3e650d2aa92b803f616
SHA1 2948de58b471097a1b375f54956d26b76d4858cc
SHA512 3572034eac886be9a23415b474c3da930d625495680cad8275a1f7a7a53fb6381a9ece59764b0cf093b425b64409bb88d3f972ec86f31b7604bfcd26a2bab4ca
TLSH
T1F741315875B88CBB8CA6E1DDD541334E5BB04E0240C628C32EA2DF4C8C997AD236A42B
MD5 SHA1 SHA512 TLSH

Submit Download

178264b1-5760-4962-a3fa-b5e293e369e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\178264b1-5760-4962-a3fa-b5e293e369e6
Size 235B
SHA256 db71d877aaa5c644c7b1f187ceee15477d51f7b0fe6980281d401766225fa0ce
MD5 c660e2d58e0869f9781feba167aedbd6
SHA1 0a7826538db62bc10f88603aac70eed3c0d46725
SHA512 273799a9419d2658ec4cee1429a8d438fa41b5e9c9585bd5fe5b4f0174fdc9961146677c350999fed21058a99a4d90195076322dd75bbcdf396ada71a1711e8b
TLSH
T184D097D02888672F49285F07F0E0AADB308C8C3715A96810A59081F8AABE9C802D1816
MD5 SHA1 SHA512 TLSH

Submit Download

23746b8b-a3b2-4c22-a78b-72907752adcd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\23746b8b-a3b2-4c22-a78b-72907752adcd
Size 883B
SHA256 349aa7d71b78789426a6bd6f5faf9d7a99f81770af0c936c271ca1b79c323f7b
MD5 53977a96d4917d4030aca0028dba5bda
SHA1 cd6c22d323eb7674f49c8288eb083f220e8cf42f
SHA512 1ddb5817b45d6e093f55054d4e70c94f6df5166a6dfe8f4dd3f4b43c8af8faa814444ff91b7c3ea80938468e4102ed7f1fff58d7e1a82de47260fcbfaad86eb8
TLSH
T1B31100819230B9B3CC79924BC94137628FF42523D0CA90183DF15A140C7DA1EA3A620B
MD5 SHA1 SHA512 TLSH

Submit Download

3f794aaf-bb10-4a48-8c52-be8225db91ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\3f794aaf-bb10-4a48-8c52-be8225db91ae
Size 235B
SHA256 605d7b66d8fd03e00e1f630c046a323e9b3785e478e5ba7570d6cea43fd7d3ed
MD5 1143f72ba8fe6e288a2d3e8e7df913b0
SHA1 38779d2b0a4089bf627a1dbd39c70bfaf8494bdb
SHA512 df97c57bcca5c37919994f0af25dc0303b80e85797eb071d48ac7b38fb019ffc66b113b0e3e528887010178aef9dee0bc92b2f28ccf7b594d6d6370c56ba0519
TLSH
T19DD097891488272D08280F02F2A0AED370948C3314B0A820CDA19974AAFDAC84191907
MD5 SHA1 SHA512 TLSH

Submit Download

6fa32249-699b-40c8-8e66-ec070d1b03f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\6fa32249-699b-40c8-8e66-ec070d1b03f4
Size 15KB
SHA256 2dd21736bfbb775e8f6397dad32180c970be06f02ce13d285feb81f1326f034a
MD5 d67859ed8dc19c6850b6939ed66e611d
SHA1 99529a58695867abeeb51b927a67e01f2452fba2
SHA512 035767791c143b955d3dbc098441697bec654fa68b199f31d70d39f60a20447d0a404e9145e47d50e5d043f814474cd5c06395103ade5dd6da4e0b5a011bcef0
SSDEEP 192:Va5SlbSzi9RzisrimxepFrRXvsiW2ZHIiNCrMDaafNSj8ODX+VCarN0WNXBOT1xS:6SlbSuRzisGa6FFUiW++ar/NXP
TLSH
T16B72C7165820457A8251E36898FCBFC3E6F638CF4C019FCA9BE47E086DDE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

853dd8a4-8f41-42bf-80ee-d19d9ab8dcab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\853dd8a4-8f41-42bf-80ee-d19d9ab8dcab
Size 886B
SHA256 97c9d82fd9d0b05aa1d04c8376c15058848019f09ac2aa66afb2911eec56c3b0
MD5 56c01062bfb48f96a1c07156bff0917e
SHA1 fb15898a95b3d1bcd95e540c55cfe41fb57e5c94
SHA512 c701f109692fe5e11523d90e3b8bf9025ffae2bfa8fa1f6b623155506df47799774d50e09ddd93c763292059c3aca6684b4d7bdf87d82db265a5654c1e513dfc
TLSH
T165112340D535B9B2CC6A935BD9D1B7838EF47523D0C659187EA15B180CBE50EA3AB307
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 550c793ab6248dc68634ece1eb1e3e0192d473f79cd2c0f30f5e090c3c6c379e
MD5 9db7fd990ac2b086f48c3d5feb22173b
SHA1 9fee45ca153b55512e75841a52e526b859507a25
SHA512 a5b19e89190e141d9ac6cf507dcbc6a5b59f90d6f37c59b1ba044ae106763b434f9515df226f4514949c1ef510b158ddf96a0329c06a058ebfa0de97639c85c9
SSDEEP 96:xHgUTUPDqGqnfLLy1zSq/SSladv9jyn3H8RNBw88n8L4cnFpC:yfORnfLLy7/SSV8HBw885
TLSH
T128E1107895088FBF64B6776CAC688871AAB2013BB7BF68C750B554C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 d91b36f453526ecea47e68d63512f48df837ebb930f8b6d00a4db3603aa07df8
MD5 28c45d0866430f057b4af5ca0910fbfa
SHA1 078d5bba6d84396e05970c6fc5c794129a3fc046
SHA512 04c8dad0c75ba0af5d770e26376f14e505e59055f976dd499083677d95494d9b695cd5b53bca329f8b8def7b04c6f2a97554173a624f5b834d3d3a4a45097e53
SSDEEP 96:xHgUTUPWPqGqnfLW51zSLcNSSladv9jZHn3H8RNBw88n8L4cnFpC:yfWCRnfLW5lNSSKX8HBw885
TLSH
T1F7E11F789508CFAF64B6776CAC6888716AB2013BB7BF68C650B554C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

hdp.dll

Path C:\Users\Admin\Downloads\hdp.dll
Size 5.8MB
SHA256 b658fdb91cc66e571b36c9f75e9af7f9aed1b85f500c2d4656d6173bfe1f5bd1
MD5 9b50be2ac11fb44e80a0efd76c2c385b
SHA1 37e5f6c68b91bca291fe2b87a6502b6190f81aae
SHA512 c3c73026bd943a5af990504f1fbdb4f3132215579b7d25745d9a4f3598768dfeebdcfc7af42940345970b4fc54cba1c3735c4634a22fc9552bab0ec22f0ab747
SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmknrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkm2i1RZ4O7NADtV6v+zZT
TLSH
T1EE56D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\Windows\SysWOW64\rundll32.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
TLSH
T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5256-14-0x0000000002AE0000-0x0000000002B38000-memory.dmp

Download

memory/5256-7-0x0000000002940000-0x0000000002993000-memory.dmp

Download

memory/5256-8-0x0000000002AE0000-0x0000000002B38000-memory.dmp

Download

memory/5256-12-0x0000000002AE0000-0x0000000002B38000-memory.dmp

Download

memory/5256-15-0x0000000002AE0000-0x0000000002B38000-memory.dmp

Download

memory/5256-9-0x0000000002AE0000-0x0000000002B38000-memory.dmp

Download

memory/5256-17-0x0000000002AE0000-0x0000000002B38000-memory.dmp

Download