Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 00:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kedadecoder/kedadecodersetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
kedadecoder/kedadecodersetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
kedadecoder/wm814127.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
kedadecoder/wm814127.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target kedadecoder/kedadecodersetup.exe
- Size 2.1MB
- Sample260824-ag6basbf36
- SHA256 bfcc8f71ddedb7f0b555a1492c8b1699c95aa892d69424595e07d5b3d4689783
- MD5 1a0c1cd73a8dc9e56dcc26eea49b729d
- SHA1 cbff351748a8ad3fe4f53f8d7508b533bdf4b52f
- SHA512 48da91de68f6c0ec2f736d93c83d8c4f197718564f53595b02b5741c3f150d4ebe808668c1ced7032201c65a8932756b4ffbf8e7e8cbcff75e557dc5d48031c8
- SSDEEP 49152:8F9d4FsSJnZz4sIWnDcy0c951Ly5/g6ATk6BVBnE9ff6cgPlFjMWc:8F9aFseM+cy0cdyl+3TBmfYPztc
- TLSH T130A5332236D1C0B2C8038431EADE9B72F669F66157E6594AFF500FBF1B547B28212B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2544 decoder_dll_setup.exe - Loads dropped DLL 1 IoCs
pid Process 4828 regsvr32.exe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\kdvyv12.dll regsvr32.exe File created C:\Windows\SysWOW64\kdimg.dll regsvr32.exe File created C:\Windows\SysWOW64\kdmjpg.dll regsvr32.exe File created C:\Windows\SysWOW64\kdg7221.acm regsvr32.exe File created C:\Windows\SysWOW64\kdg711a.acm regsvr32.exe File created C:\Windows\SysWOW64\kdh4.dll regsvr32.exe File created C:\Windows\SysWOW64\kdg711u.acm regsvr32.exe File created C:\Windows\SysWOW64\kdadpcm.acm regsvr32.exe File created C:\Windows\SysWOW64\kdm4.dll regsvr32.exe File created C:\Windows\SysWOW64\kdvyuv.dll regsvr32.exe File created C:\Windows\SysWOW64\kdvyuv8.dll regsvr32.exe - Drops file in Windows directory 48 IoCs
description ioc Process File opened for modification C:\Windows\kedadecoder\kdg711u.acm kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdm4.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\setup.ocx kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\setup.ocx kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdh3.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdh4.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\decoder_dll_setup.exe kedadecodersetup.exe File created C:\Windows\kedadecoder\kdadpcm.acm kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdadpcm.acm kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdg711a.acm kedadecodersetup.exe File created C:\Windows\kedadecoder\kdm4.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\kdvyv12.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\lame_acm.xml kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\mp3ad.acm kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\compile.bat kedadecodersetup.exe File created C:\Windows\kedadecoder\__tmp_rar_sfx_access_check_240728812 kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdmjpg.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdvyuv8.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\lame.acm kedadecodersetup.exe File created C:\Windows\kedadecoder\lame_acm.xml kedadecodersetup.exe File created C:\Windows\kedadecoder\kdg711a.acm kedadecodersetup.exe File created C:\Windows\kedadecoder\kdg7221.acm kedadecodersetup.exe File created C:\Windows\kedadecoder\kdh1.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\kdh4.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdm2.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\kdvyuv.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\mp3ad.acm kedadecodersetup.exe File created C:\Windows\kedadecoder\kdg711u.acm kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdg728.acm kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdg7221.acm kedadecodersetup.exe File created C:\Windows\kedadecoder\kdimg.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdimg.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\kdm2.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\lame.acm kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\mp3pro.acm kedadecodersetup.exe File opened for modification \??\c:\windows\kedadecoder kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdaudproc.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\kdg728.acm kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdh1.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\kdh3.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\kdmjpg.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdvyv12.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\mp3pro.acm kedadecodersetup.exe File created C:\Windows\kedadecoder\kdaudproc.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\kdvyuv8.dll kedadecodersetup.exe File opened for modification C:\Windows\kedadecoder\kdvyuv.dll kedadecodersetup.exe File created C:\Windows\kedadecoder\compile.bat kedadecodersetup.exe File created C:\Windows\kedadecoder\decoder_dll_setup.exe kedadecodersetup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 364 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kedadecodersetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language decoder_dll_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\TypeLib\ = "{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCE6BE9F-907F-4F0D-BEF6-4FC0B4745FC6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SETUP.SetupCtrl.1\ = "Setup Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}\1.0\FLAGS\ = "2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\ = "_DSetupEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\TypeLib\ = "{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}\1.0\0\win32\ = "C:\\windows\\kedadecoder\\setup.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\ToolboxBitmap32\ = "C:\\windows\\KEDADE~1\\setup.ocx, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCE6BE9F-907F-4F0D-BEF6-4FC0B4745FC6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\InprocServer32\ = "C:\\windows\\KEDADE~1\\setup.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\TypeLib\ = "{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCE6BE9F-907F-4F0D-BEF6-4FC0B4745FC6}\ = "Setup Property Page" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\Control\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\ = "Setup Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\ = "_DSetup" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\TypeLib\ = "{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCE6BE9F-907F-4F0D-BEF6-4FC0B4745FC6}\InprocServer32\ = "C:\\windows\\KEDADE~1\\setup.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\TypeLib\ = "{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}\1.0\ = "Setup ActiveX Control module" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SETUP.SetupCtrl.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\ = "_DSetupEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\ = "_DSetup" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}\1.0\HELPDIR\ = "C:\\windows\\kedadecoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEBFA730-D263-459B-A7EF-B746F4AA047D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B33179D2-BA43-4DE4-AB4B-8875E999707B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SETUP.SetupCtrl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\ProgID\ = "SETUP.SetupCtrl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4F480A24-1EE0-4C2D-BEF8-EA0DFCFBA859}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SETUP.SetupCtrl.1\CLSID\ = "{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F60BDEE1-7754-45F5-89B6-69C9C08BEB5A}\TypeLib regsvr32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2544 decoder_dll_setup.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3312 wrote to memory of 2544 3312 kedadecodersetup.exe 89 PID 2544 wrote to memory of 364 2544 decoder_dll_setup.exe 90 PID 364 wrote to memory of 4828 364 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\kedadecoder\kedadecodersetup.exe"C:\Users\Admin\AppData\Local\Temp\kedadecoder\kedadecodersetup.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\kedadecoder\decoder_dll_setup.exe"C:\windows\kedadecoder\decoder_dll_setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regsvr32 "C:\windows\kedadecoder\\setup.ocx"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\windows\kedadecoder\\setup.ocx"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4828
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\kedadecoder\decoder_dll_setup.exe
- Size 20KB
- SHA256 89dac0101dbe1b5e007368b70cf3f6b0aa1e4bc2d89f85a13bd74fab9d27e953
- MD5 035b57800871c48d846f22d55627ba4f
- SHA1 b98fb09ab5ad2b82964920977cc4b60be1e75e74
- SHA512 72228e793a4a7d174313c73b51455fde0c5e1d8a496346324190c83cb7d3b3f0a8b18ac887ded6eee4eaac88ff2f5492f35c60eb8cb42cee23ce0e0719efe534
- SSDEEP 192:330hj8Z6l1/Ct7bYEtBP1oynuaSJPWZeGY+A:3y8ZbYc1ga5
- TLSH T1BF92840697A188B4E970CE3457FF0EBA5EB1BC530A5492DF1743EE8C9C35708A92634D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdadpcm.acm
- Size 100KB
- SHA256 31822500bb69552a83c9f1a2aff3e7e4d583d5432d6eceb03a50382c975c4825
- MD5 6f1fc3dbef13af69a8b965b8872fe97c
- SHA1 dcf7829295805d74d33c04246d1d9c414a5a921c
- SHA512 42a679e9bb9ef584adf0397fe179c891ecc956aafb08abd431f4d387cc845efc2874306d22fd38d1d00d06c5932e779512c92d0582024e29626d513090e67e05
- SSDEEP 1536:GvP/RnZK1+or6WD7kIOqrvLZG7f8L4V/uXloU4jxy47t35o4QN:GvPq1jQIhxb4V/dUYxRt35o4QN
- TLSH T16AA38D047993C073D48A043952DA87D25FFFA913BAE2957BFF64108C8EE169452B63B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdg711a.acm
- Size 88KB
- SHA256 eeaead710f2f172643f5e7d269d80df1f836bfa9cd3e48277df7e0bcbe15ab32
- MD5 712731d3c392f2e87c7c9a31ac1a7c65
- SHA1 f3985b2c6bf48c900b1e75f46f26d39b2c08184a
- SHA512 0933c00bb3a7309a10b6a5dc63a89fb22f3d176d89b952caa799fa009bbda1fcc689fbbcc19d73dcb4c682287147a4b6239454218a6b3c81def031000f22c92d
- SSDEEP 1536:YcpUsqsNcGtz1s0ItglS9CM+3BV7FPVCTyAHjLLXlosVbUT3ItVm5FL:YqUsWG/s0iCMO7nA3msVy4tVm5FL
- TLSH T152938D053943C07BE049093582C687CA2FFE6C133AE2D43FFF65129D5EE169492A67B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdg711u.acm
- Size 88KB
- SHA256 7fdfc8159ec0ab70d9b7c77291fcbbe2ea1fa8137b9322957c0399681fa0b159
- MD5 7712d0c357707024e3c04054bee75925
- SHA1 cff941c080a52fedf219979dee034b913cf4f2d8
- SHA512 a0299622873be45a60262e20b477cdb6a21924e6a8359ddebd8b2454900952e59d47c6ad1b42143c92e1e90df10fbad5feaacc50fbc8da6f3c7eaacd035db3cc
- SSDEEP 1536:Y5D+nUR1PtzYFINJlU9as+z17FRViTSgHDZcXloBObUjto8PtkINh:YZ+nMPGFFasUNngdTB6iNPtkIN
- TLSH T12F938D053953C17BE0450935828687D62FFE6C133AE3D43FFF65228D9EE169492AA3B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdg7221.acm
- Size 112KB
- SHA256 20808ac0df62854fc0c70cd2041c8eda20fa2bf85e6b0e51317f42e1ceaf0173
- MD5 fd5b0063491477c0e91b66236828b84e
- SHA1 5ce489731de2ef1bd374fd9085aa382c443012fd
- SHA512 e44a633a261b70c5591a610a1d7c11bbb25735d03241683154bf475fd5aa2a73b28b76c1a904c4d45e7943313a6652fbd068722a74bdba1365dd93f8126e64c4
- SSDEEP 1536:LAm3XZCOIFc33guHRTnGtfEEoS22GFudWQ94R6toaTzKyO1Astpq/:LAAxqYfHJmku4RAoaTz4t4/
- TLSH T124B38D23F7418BF2E06901794C766B365735B8119ED38B07CB90E959ACE26E0AF353C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdh4.dll
- Size 1.0MB
- SHA256 12485361b23aaed9a8b0432b00e6bbb12149c911b7b27c7a587ceed832e5ab6d
- MD5 117d2b8b760bfaae3b6ae3e3db868e4a
- SHA1 b6d24a83ebbc226d099990af84e727ad970a8526
- SHA512 6bbb0eee6d77edb1d47de7330919877d1bd643ad5efd464547fc33d069bd3054e0bd1abec594a49ff3e39b46a3e818ab3aa407ae0770838fb0902b95b36203c2
- SSDEEP 24576:tjQnkOGXwbpMYe7+TgMqfNafBCUTuKFcat+xZKSe5Q1MVI2EYTUpULAvIUAp5Kxp:tjrXIne74qfNavq2EYTUpULAvIUAp5Kf
- TLSH T12D257DC0D6938694E82F4C71423C3E5BA53C2F698264C67EDFC87E18F977B5848429E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdimg.dll
- Size 1.5MB
- SHA256 4d19f23289820c911cd61eed2ff3fa00bba17b0c6482994ea4082e33258dad07
- MD5 ae5e9e5f2363e6b4ef9dfb0b4da6c04a
- SHA1 4af94eeea8f045712e7d73186cc2596bd14c2aed
- SHA512 52973a9682b5fa0887ed19a7651546da7bf9e49e6850da7f2837ac6b88ae17b0f53188fb4de32f867d6ef0729601eba193f0c903e6e36a12bb649e50dc3e31de
- SSDEEP 24576:TN8e6g8VJkRBT+u2CMnHsEQ6KdEFiDZ6FDt5uqLrKnCX6k7j18l/jmqWbKZ+h1U+:qe6tJkRBllEFiFE5uqLrKnCqyCaHb7ZZ
- TLSH T1FC759EC0FAC706E1D40B0C70822E7A6F96389B598228C67EDFC57F5AF4377258666358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdm4.dll
- Size 452KB
- SHA256 87f757ea17f1f8fecdade7d41e1d728404cebd941bce8c4592dffd70264c8299
- MD5 aede7e89667f9c54063fd07a84e189f7
- SHA1 1ecf547e1bd23dcdf990054942ea03e0cab05fd6
- SHA512 9d48161639d73d7d6b735587bc35830b542d9b55aa5292f325f945e3a30ff4b5a33898a4a0db8e42b3141d00ad50fce4ac0ea7c4612ce01bb4c1be1a4e4af036
- SSDEEP 12288:3b6MGGCtRjruYm7PyEfH2Hr7C1WJhCqW5Q1MhuJbiqwojo:3mMGlSPyEfWHr7C1WJhCqW5Q1MhuJbi7
- TLSH T1DEA49E80FAD384A6C4660DB040DAAB7F573C2D21C564C62BCBD4BD79FAA33744D52E98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdmjpg.dll
- Size 160KB
- SHA256 f85a95377a97884284705a832de0336a9f3d98dd498f4c673a2a0d970e8a8cbb
- MD5 d046a79c3d22aaff5000bdf56dabc293
- SHA1 8db0fa4cc31102cf5a6a42dd7a74bb0a9253fa30
- SHA512 83c0cf4d8e97ceb7badd78f2522c2336b9338f625c44af63204805f5d76bb7454f4386a4c37b453f0020ae7d7d8f540ce7fafdc694d827133b87f4853c79fcf3
- SSDEEP 3072:V92xNsmhatdWey5Q1MkGiXfRrg1wMasZKD9Wv+Kt0:VcxqmhatdWey5Q1MkGiFR2wD9e
- TLSH T1C6F39E40B5E3C077C0460878C0A9A7FF9B7E691366B4E4EBFBD05D49E9E234086667E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdvyuv.dll
- Size 32KB
- SHA256 ebb529a79fe179285ec9ca465e4ee71757da474e2a20e162b629fc0f53feb23c
- MD5 b74695b50230be4a6ef2c4293a58ac3b
- SHA1 44289468d9bbef34bb51eda8944cb4951bba21a3
- SHA512 fac32e7e3981a26d2ed862191e5c9d82ae3c13ed6afbab24e8bc785d24c16390a5f07fcbfdfcd05dced2978bde530ea9269210ff70308f356472bb28c313e607
- SSDEEP 768:+whd4F1XITCpSFHgjpLz/knFjjLy/ani7zK:PnwIWpSEt7qFXcAi7m
- TLSH T1BFE23AD213D0C225F2766A30F7BD2376E872756099B9449E1A24DE7D18B2C219FB4B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdvyuv8.dll
- Size 65KB
- SHA256 8ae1e80143efac140b79b1ccafb6f00200913a524c24710fe9b4cdeda079f3d5
- MD5 b31554b205965e89c46f634e9659131d
- SHA1 ebba801a31c58c4cb61abf05e2410926eb9f99af
- SHA512 7a2a582e9380309ca2f75c0941c7176550f6def9b5c9b1b32e367bf54ec586126f60e782c89327698162a931fcdfb1202f0ad348d32db7d40a48c7357d0ca88e
- SSDEEP 768:DcnER6svep8ovCeNjmk4zd5qMrpayDC8VWJGnnMwnQYdYfY0ChwPu06q+gC73/:DcnE5K/2JC8oEnn8Y6APhyu06HgC
- TLSH T12C536C42F34681B6C49E537E82EBBB75A536792107B399E3E3802C7EBC125D09035B9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\kdvyv12.dll
- Size 42KB
- SHA256 2863d88387c221aefd57009c6a74a479f2fe98005ed10df8309a5187682d952e
- MD5 37044f01b8cdb03e1c155ec57c3971cf
- SHA1 5a2a1b34c7720beca90cf7c39d84ae3453a14f5a
- SHA512 d02b19bbda1ec5ff72a109a6bc8465c9ca4a13f9c4894b7ea9aac44d6ffc40735007a9abce976d7f2538fcf38a7b24a77b9a653f7a40d18c147dcc57a1dcd459
- SSDEEP 768:WCz5p4m7sJxpfOd4g3+9K4LmViGPnBYdLWpqpwQyplo:Nz5ym7sJxp2dXWK46VzPnBYQpqpU
- TLSH T1A3134A01DB86C2B2C995563C01F76B7AE935AD6107E787C38BC22C799C327D1E638768
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\windows\kedadecoder\setup.ocx
- Size 36KB
- SHA256 3a835206094de3361ac2d6e779a5dd6da1b6e7259113aaa9107482ef23a63175
- MD5 512c62e4130324aafb7858f46040dd76
- SHA1 12472a1d92ad288b52d6c7a5452ca4b3db45db36
- SHA512 44535d92e1b942754cf0450840ad6416ba9ea1672e8619d69c83b3f5820b29c07cb5a6f392a333945238bbde81992a9cc74d27a23f445f03a68428fddda8fb30
- SSDEEP 384:3dsNmQTLnTwkJRcrh0p3dMn4ZtMn4GGo9QonXVPaWBgGV:KVTLnNJ0epC4ZC4GGo9Qgfg
- TLSH T18EF2B402F39345B1D36906B93CAB67FA5B656C051EF19A876F28FF5E2C72123E934201
- MD5 SHA1 SHA512 SSDEEP TLSH