b658fdb91cc66e571b36c9f75e9af7f9aed1b85f500c2d4656d6173bfe1f5bd1

Analysis

user interaction
yes
max time kernel
240s
max time network
240s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hdp.dll
Size 5.8MB
Sample260820-k2mpsscd59
SHA256 b658fdb91cc66e571b36c9f75e9af7f9aed1b85f500c2d4656d6173bfe1f5bd1
MD5 9b50be2ac11fb44e80a0efd76c2c385b
SHA1 37e5f6c68b91bca291fe2b87a6502b6190f81aae
SHA512 c3c73026bd943a5af990504f1fbdb4f3132215579b7d25745d9a4f3598768dfeebdcfc7af42940345970b4fc54cba1c3735c4634a22fc9552bab0ec22f0ab747
SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmknrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkm2i1RZ4O7NADtV6v+zZT
TLSH
T1EE56D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4256	rundll32.exe
8	4256	rundll32.exe
10	4256	rundll32.exe
11	4256	rundll32.exe
12	4256	rundll32.exe
13	4256	rundll32.exe
14	4256	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
3144	rundll32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	icanhazip.com
10	api.ipify.org
14	icanhazip.com

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4376	tasklist.exe
5964	tasklist.exe
3724	tasklist.exe
5204	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3768	cmd.exe
1020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
256	timeout.exe
2104	timeout.exe
4992	timeout.exe
2804	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3188	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5444	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe
4256	rundll32.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	rundll32.exe
Token: SeLoadDriverPrivilege	4256	rundll32.exe
Token: SeTakeOwnershipPrivilege	4256	rundll32.exe
Token: SeIncBasePriorityPrivilege	4256	rundll32.exe
Token: SeTcbPrivilege	4256	rundll32.exe
Token: SeDebugPrivilege	3188	taskkill.exe
Token: SeDebugPrivilege	5964	tasklist.exe
Token: SeDebugPrivilege	4256	rundll32.exe
Token: SeCreateTokenPrivilege	4256	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	4256	rundll32.exe
Token: SeLockMemoryPrivilege	4256	rundll32.exe
Token: SeIncreaseQuotaPrivilege	4256	rundll32.exe
Token: SeMachineAccountPrivilege	4256	rundll32.exe
Token: SeTcbPrivilege	4256	rundll32.exe
Token: SeSecurityPrivilege	4256	rundll32.exe
Token: SeTakeOwnershipPrivilege	4256	rundll32.exe
Token: SeLoadDriverPrivilege	4256	rundll32.exe
Token: SeSystemProfilePrivilege	4256	rundll32.exe
Token: SeSystemtimePrivilege	4256	rundll32.exe
Token: SeProfSingleProcessPrivilege	4256	rundll32.exe
Token: SeIncBasePriorityPrivilege	4256	rundll32.exe
Token: SeCreatePagefilePrivilege	4256	rundll32.exe
Token: SeCreatePermanentPrivilege	4256	rundll32.exe
Token: SeBackupPrivilege	4256	rundll32.exe
Token: SeRestorePrivilege	4256	rundll32.exe
Token: SeShutdownPrivilege	4256	rundll32.exe
Token: SeDebugPrivilege	4256	rundll32.exe
Token: SeAuditPrivilege	4256	rundll32.exe
Token: SeSystemEnvironmentPrivilege	4256	rundll32.exe
Token: SeChangeNotifyPrivilege	4256	rundll32.exe
Token: SeRemoteShutdownPrivilege	4256	rundll32.exe
Token: SeUndockPrivilege	4256	rundll32.exe
Token: SeSyncAgentPrivilege	4256	rundll32.exe
Token: SeEnableDelegationPrivilege	4256	rundll32.exe
Token: SeManageVolumePrivilege	4256	rundll32.exe
Token: SeImpersonatePrivilege	4256	rundll32.exe
Token: SeCreateGlobalPrivilege	4256	rundll32.exe
Token: 31	4256	rundll32.exe
Token: 32	4256	rundll32.exe
Token: 33	4256	rundll32.exe
Token: 34	4256	rundll32.exe
Token: 35	4256	rundll32.exe
Token: SeDebugPrivilege	3724	tasklist.exe
Token: SeDebugPrivilege	6072	firefox.exe
Token: SeDebugPrivilege	6072	firefox.exe
Token: SeDebugPrivilege	6072	firefox.exe
Token: SeDebugPrivilege	5204	tasklist.exe
Token: SeDebugPrivilege	4376	tasklist.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
6072	firefox.exe
6072	firefox.exe
6072	firefox.exe
6072	firefox.exe
6072	firefox.exe
6072	firefox.exe
6072	firefox.exe
6072	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4256	rundll32.exe
1476	OpenWith.exe
6072	firefox.exe
6072	firefox.exe
6072	firefox.exe
6072	firefox.exe
5100	OpenWith.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4256	4236	rundll32.exe	90
PID 4256 wrote to memory of 3188	4256	rundll32.exe	91
PID 4256 wrote to memory of 1020	4256	rundll32.exe	94
PID 1020 wrote to memory of 3768	1020	cmd.exe	96
PID 3768 wrote to memory of 5964	3768	cmd.exe	97
PID 3768 wrote to memory of 3020	3768	cmd.exe	98
PID 3768 wrote to memory of 256	3768	cmd.exe	99
PID 3768 wrote to memory of 3724	3768	cmd.exe	103
PID 3768 wrote to memory of 700	3768	cmd.exe	104
PID 3768 wrote to memory of 2104	3768	cmd.exe	105
PID 1476 wrote to memory of 4116	1476	OpenWith.exe	111
PID 4116 wrote to memory of 6072	4116	firefox.exe	112
PID 4116 wrote to memory of 6072	4116	firefox.exe	112
PID 6072 wrote to memory of 5172	6072	firefox.exe	113
PID 6072 wrote to memory of 5172	6072	firefox.exe	113
PID 6072 wrote to memory of 5172	6072	firefox.exe	113
PID 6072 wrote to memory of 5708	6072	firefox.exe	114
PID 6072 wrote to memory of 5708	6072	firefox.exe	114
PID 6072 wrote to memory of 5708	6072	firefox.exe	114
PID 6072 wrote to memory of 5708	6072	firefox.exe	114
PID 6072 wrote to memory of 1312	6072	firefox.exe	115
PID 6072 wrote to memory of 1312	6072	firefox.exe	115
PID 6072 wrote to memory of 1312	6072	firefox.exe	115
PID 6072 wrote to memory of 1312	6072	firefox.exe	115
PID 6072 wrote to memory of 5196	6072	firefox.exe	116
PID 6072 wrote to memory of 5196	6072	firefox.exe	116
PID 6072 wrote to memory of 5196	6072	firefox.exe	116
PID 6072 wrote to memory of 4388	6072	firefox.exe	117
PID 6072 wrote to memory of 4388	6072	firefox.exe	117
PID 6072 wrote to memory of 4388	6072	firefox.exe	117
PID 6072 wrote to memory of 4388	6072	firefox.exe	117
PID 6072 wrote to memory of 6320	6072	firefox.exe	118
PID 6072 wrote to memory of 6320	6072	firefox.exe	118
PID 6072 wrote to memory of 6320	6072	firefox.exe	118
PID 6072 wrote to memory of 6320	6072	firefox.exe	118
PID 6072 wrote to memory of 6532	6072	firefox.exe	119
PID 6072 wrote to memory of 6532	6072	firefox.exe	119
PID 6072 wrote to memory of 6532	6072	firefox.exe	119
PID 6072 wrote to memory of 6532	6072	firefox.exe	119
PID 6072 wrote to memory of 6540	6072	firefox.exe	120
PID 6072 wrote to memory of 6540	6072	firefox.exe	120
PID 6072 wrote to memory of 6540	6072	firefox.exe	120
PID 6072 wrote to memory of 6540	6072	firefox.exe	120
PID 6072 wrote to memory of 6548	6072	firefox.exe	121
PID 6072 wrote to memory of 6548	6072	firefox.exe	121
PID 6072 wrote to memory of 6548	6072	firefox.exe	121
PID 6072 wrote to memory of 6548	6072	firefox.exe	121
PID 3768 wrote to memory of 5204	3768	cmd.exe	123
PID 3768 wrote to memory of 2332	3768	cmd.exe	124
PID 3768 wrote to memory of 4992	3768	cmd.exe	125
PID 5100 wrote to memory of 5444	5100	OpenWith.exe	126
PID 3768 wrote to memory of 4376	3768	cmd.exe	127
PID 3768 wrote to memory of 2556	3768	cmd.exe	128
PID 3768 wrote to memory of 2804	3768	cmd.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hdp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hdp.dll,#1
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start "" /B cmd /C C:\ProgramData\S-1-5-21-552508041-2681165170-3229858294\S-1-5-21-552508041-2681165170-3229858294.CMD
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C C:\ProgramData\S-1-5-21-552508041-2681165170-3229858294\S-1-5-21-552508041-2681165170-3229858294.CMD
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5964
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:256
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3724
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:700
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2104
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5204
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4992
    - - C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq rundll32.exe" /FO CSV
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
    - - C:\Windows\SysWOW64\find.exe
        
        FIND /I "rundll32.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
    - - C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2804

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\hdp.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\hdp.dll
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27098 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 1440 -initialChannelId {376ef499-fe5f-4688-a42d-b73e3ec4e364} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27134 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {fd82dbf8-cb03-49c3-8ceb-05b2a32d9eb2} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:5708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27274 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {01349616-c830-4cae-90eb-5400df1397ab} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {b930961c-20f3-49f6-b8c5-f7fe5f9a4f4e} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336 -prefsLen 34773 -prefMapHandle 4340 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {9e2b7eb2-0917-4cb7-9311-f4a8a7b73fda} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5208 -prefsLen 35010 -prefMapHandle 5212 -prefMapSize 270279 -ipcHandle 5220 -initialChannelId {46583f88-cd8c-4228-8057-5ae151fc80e2} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2940 -prefsLen 32952 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4952 -initialChannelId {dcf6f9db-f703-4eba-a2f1-515f38a5e768} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5736 -prefsLen 32952 -prefMapHandle 5740 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {a5dc3ec2-452b-4e82-938f-011218468c0d} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5924 -prefsLen 32952 -prefMapHandle 5928 -prefMapSize 270279 -jsInitHandle 5932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5940 -initialChannelId {597f3294-c7a1-46ec-9eb9-3cfbb3ce27fb} -parentPid 6072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\hdp.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5444

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:6184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S-1-5-21-552508041-2681165170-3229858294.CMD

Path C:\ProgramData\S-1-5-21-552508041-2681165170-3229858294\S-1-5-21-552508041-2681165170-3229858294.CMD
Size 1KB
SHA256 ec61a7a64a601257259da3874ac028c02748d92e9b0050234eff845258a9e773
MD5 40170b1891ba74e558c26d5df6a3aeb1
SHA1 dfd564a129a04855f6340f830fa82193f8697763
SHA512 387c57c328ed7d81e63216c46bfb049fd38f332232378cc0f925e1d6ab070ef29855123bc62cc8dbdef679da542fd8c8a732054919544a8d8d3ab7f27e1d0d3b
TLSH
T1AA31109EC8038E1D432002DE275ACC6BC210E047EEC5709071DC6BC52345F690D69BAE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 609a68ef75f2a16afd8fce0363c370f09102c5fc7e3afa62f97fa35d2e10792c
MD5 bde2379fd3caa0fd32a9880d129a911f
SHA1 6d939f207a7f2330f56b56b18bd8fff59492d379
SHA512 d6728f3206cf0a7ad14eca450f1b16392486a785db3178c1ccb796c1da151b161283fb621221c764dcd07c0f6fa92c32eceb204bb8247e435e5ab83e9364dc83
SSDEEP 192:jOv5zbo7+Z4hyjy8Gm1d66JoztdzgCl6mc0dz:sboaZ4hyjhd66Joz/zgC1jd
TLSH
T1DBE110A8F639867FC818027BCCA21B410F75384AD84E3F19359D25082C5B2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4451c40848da39e8f39d722e218eaf980f55984fd2187f63b74bd9f74e834377
MD5 8a070e8d5adb179a5fd4a205f106f072
SHA1 8bf9d9d695c69c7a266143b415eb31a847797852
SHA512 572643dbdb5a1e73072239ba64ffe4eb1cde9a480f7cb9a3c584174d7a9abb8d73d3e972f8c7af608cfb3c6f055b5223d49c6fdbcc363970423331dcad01848f
TLSH
T1B8217C5C39F94D6AAC8BF69C784112CE57524E1605C72C834E12FE8CCE856DE32AE438
MD5 SHA1 SHA512 TLSH

Submit Download

0c96a618-4fa3-46b1-9ee6-7c1425a2e021

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\0c96a618-4fa3-46b1-9ee6-7c1425a2e021
Size 15KB
SHA256 7a48ec8a21f84a6c1f1371d2db6a9f47fafbe56a2192045f39a1532d8a3690be
MD5 31bb4444f956ae0548b7025bf1093de5
SHA1 4c74a17a6638c46a5491f17a3cffb3da35f6e1a8
SHA512 2fd49949a9cddcef07ff16f14e6f3e7ba2178480014ab8f7ff7b1b8ce5fc10b0b26417a7755383db1d2c9447960b48e8dae607bed0fbf98200ff49ef7fa93087
SSDEEP 192:mSldHEBAAJ6y1Sqh5GFV1C+MWJ12ch+vRiyNzx10wQ3lyiPzdf7i6pKSRTSv/yKu:HEB2Y2V1cc5LR7i6pKSRmv/yKu
TLSH
T15C62D9596430497E8691E368D8E97FC3E2F518CF8C019FC99BE47E0869EE06E5127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

306bf463-0243-4731-9742-38f95eb59918

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\306bf463-0243-4731-9742-38f95eb59918
Size 886B
SHA256 ab80d6d85f3a2edd84a062e93f934aad64e631fa4a59f319f5460bb3538f44d9
MD5 924b5e24bf3a4d9f860513a6ca0b32be
SHA1 476c344eca8c6aecd4cd3daf19c15536f6316a34
SHA512 fa829617933c50d78c10e7bbcbd4bac8913c84efc258e9661e2f4d7980b7138e06dd9183f8b3bb3662cd8f39ea72c19758bac7b29b8328f8f043e48da6d51523
TLSH
T132111C50A538B5B3CC38828B859037835BE0B02390C669147E581B180EAA50BA7AB207
MD5 SHA1 SHA512 TLSH

Submit Download

4d0c41b1-8ebf-414d-983b-1eb633b95482

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\4d0c41b1-8ebf-414d-983b-1eb633b95482
Size 883B
SHA256 827e673e1d7cd62f3c075c73b536fae8b9277c30c25ad56cb427aa9a89135978
MD5 607ed5efa67a634efe0faa19e0d20a79
SHA1 33b5ef38e0cea1578997709752c4e0910a99d5c9
SHA512 85d5cb7926616872b43afc28188e0b74fa7271ee58a043f59813bab3ad827bca3ba0d500bad1a7525804e91e32ebc3f11335bbadad06813c921699a7d8797778
TLSH
T1F1110090E635B6B3CC78825BC590374287E9B423C0C696143DA45F080E6E60BE7AB20B
MD5 SHA1 SHA512 TLSH

Submit Download

873e406a-0be7-41bb-a3b6-2ccef959893e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\873e406a-0be7-41bb-a3b6-2ccef959893e
Size 235B
SHA256 cd885321fb60ad9cc084baa49e4838516dc6e074a1ea08a5ee73c5d9e0d5c879
MD5 8312ab6985f8ba095e44b1dd6e2fcc4b
SHA1 19a6ffc292914202df9903c06dedbeb2f9cb1af4
SHA512 8540da0ddc8d9567ec4dc986795beb288d975ef7540e520bf6cfbc76c3d539742c92d03cae64a41b3aeb1c99b916ce11fec1961bc8422e3c07272be2b78e302e
TLSH
T1DBD097C82488631E0C242F0BB0B129C630888C3350B06822D9B410B8DEBAECC0151C1B
MD5 SHA1 SHA512 TLSH

Submit Download

9d63a92d-7064-498d-a888-ec35076cd7e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\9d63a92d-7064-498d-a888-ec35076cd7e3
Size 235B
SHA256 3631ca0829527b6da13af5f14faedaab72af91beeb506429de0c387962813e52
MD5 3a5258f74048b6ce9143e20e0b7be86e
SHA1 c049f013d44d5c34c2e7eba81e4c4405ceb8ae3a
SHA512 715fc380caa79972c5c44c3a6c90ead443d9c1601f87382af987a789834af140d9bc2e0bd8ee1c7789b33cfddca73cac61b6174b6663dcdc73a6cef8dd98f6e2
TLSH
T1D3D0978424C86B9D08001F0BF0F03AC230858C3360B8AC14C690843499F8ED85191896
MD5 SHA1 SHA512 TLSH

Submit Download

b78e1f44-b7c3-47b4-9d82-12c66d6435a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\b78e1f44-b7c3-47b4-9d82-12c66d6435a7
Size 2KB
SHA256 b5b3ab12973456ab8512db7ac46876e55c2b7c5895c2132e02684bfb47666c76
MD5 dbbfe5f79b163f43ed206300268bbeef
SHA1 b56d2529fb24afdc4ad9320d60f1c865c484c98a
SHA512 34491e3d77eecd9302b1deaa6b260ebf087664f5ba62da29f306d42992192acc75442ff88a4d3a0a6dcbf001cb58bbc1f06da4e59be8189d649290ec0ea153a8
TLSH
T11D41526C35789D779CDAF15D9091338E97A0DA1350C218432E51EF0CCE96A9E737B42B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 d091bc653bcd1bcba44087a4b7cf85fc51612f1c056e2d92ae9eb8e1ff29427a
MD5 3951d9d419383ec87507abc1c9a7bdc1
SHA1 804e5d9b7289f833ded6e13a12c8254fbc7a1ebe
SHA512 e054e3ab3c884e14d0bc73923260c9418473896e735727970f6711573e126c9a4b2fc3c7861ef672c4571940655568f6dcb09b8f47e86c6b3a1b4a8ad57ad0ca
SSDEEP 96:xH+UTUQqGqsfeRo1zS8SSlvdv9j1lyonAHdA0ScSqBw8828L4cnEVgR:ArRsfeRoNSSMZdA0ScDBw88W+
TLSH
T176E11F78A008CB7F65B6776CAC6888716AB2413B7BBF68D750B554C4014CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 27a666744f0d4d4a9e06086f4475d14349bd27e48bb74204b9258597cdb3ac8f
MD5 783955015d09e968479ada934ad97a8a
SHA1 236529fe76788b0332c8a31fea84f91c4b337542
SHA512 6e90e0204555a39d445bb22a0f068a9b00cc56b46deabc8e75752cb991af5f8a263e154135dbb3f75c26c7bfb576f01c8b1ed0ccf9445ebe3d02a409e7cba63b
SSDEEP 96:xH+UTUbPqGqsfeLa1zS8SSlvdv9jYnAHdA0ScSqBw88u8L4cnEVgR:ALCRsfeLaFSS7dA0ScDBw88e+
TLSH
T113E11F789008CBBF64B677BCAC6888716AB2413B7BBF68D650B554C4014CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 e58bc4e2d5915bf429804503de5b9a6fe35b2c1151da283ed7cbfcf9d097e6cb
MD5 c26ca1cd7f9330bda2da41d1ab98de34
SHA1 e5be3ecbcf37cd8bbd898d0f15a7730076ca89cc
SHA512 c8929c0e324361e541050081d201f4cd6fb3c4ea76b473036393a6dd95d2100b701485b058ea6515c4e6b50bf2b3caf6b7b94753beeb51b6a56ea65c679d04e0
SSDEEP 96:xH+UTUQqGqsfeLa1zS8SSlvdv9j1lyonAHdA0ScSqBw88u8L4cnEVgR:ArRsfeLaFSSMZdA0ScDBw88e+
TLSH
T152E11F789008CBBF64B677ACAC6888716AB2413B7BBF68C750B554C4014CF3441F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 c9c699e4f0943ea3f67d760fb9538ddfe2c8b0d8988242312d190936d393eb2f
MD5 5c15d114024daa67b97fbefe6ef8d725
SHA1 2db954ca30966158b1dbe7ce424c69132aba687f
SHA512 d5ee58de5ad285235b5d39656bdebe9291ea7b0178b27435822eb60a64fe2d79c266babb68cef3e37b19234372a26c8a345d611ed77ce8b939276d280eeb4f4a
SSDEEP 49152:nYpKA0vv22ZYJt3NERUGblgN5IQ+zbxnc:Y6c9ERU+M5IQ+zby
TLSH
T1B0363AF820D1A257F3814033664593EF21EFD00C6027DE085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hdp.dll

Path C:\Users\Admin\Downloads\hdp.dll
Size 5.8MB
SHA256 b658fdb91cc66e571b36c9f75e9af7f9aed1b85f500c2d4656d6173bfe1f5bd1
MD5 9b50be2ac11fb44e80a0efd76c2c385b
SHA1 37e5f6c68b91bca291fe2b87a6502b6190f81aae
SHA512 c3c73026bd943a5af990504f1fbdb4f3132215579b7d25745d9a4f3598768dfeebdcfc7af42940345970b4fc54cba1c3735c4634a22fc9552bab0ec22f0ab747
SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmknrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkm2i1RZ4O7NADtV6v+zZT
TLSH
T1EE56D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\Windows\SysWOW64\rundll32.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-24-0x0000021304790000-0x00000213049EF000-memory.dmp

Download

memory/4256-12-0x00000000043A0000-0x00000000043F8000-memory.dmp

Download

memory/4256-11-0x00000000043A0000-0x00000000043F8000-memory.dmp

Download

memory/4256-9-0x00000000043A0000-0x00000000043F8000-memory.dmp

Download

memory/4256-7-0x00000000043A0000-0x00000000043F8000-memory.dmp

Download

memory/4256-6-0x00000000043A0000-0x00000000043F8000-memory.dmp

Download

memory/5100-433-0x0000022A165D0000-0x0000022A1682F000-memory.dmp

Download