Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2022 15:07
Static task
static1
Behavioral task
behavioral1
Sample
9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe
Resource
win10v2004-20220721-en
General
-
Target
9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe
-
Size
340KB
-
MD5
827c533e6030bf67b53460a3bf20813f
-
SHA1
46a5f78f7e79cd5f39ae76c925bc9ada1243be08
-
SHA256
9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77
-
SHA512
57b45d28994722620d5496a0f267060345d385358dabf7bace2337f8975940d6dc39ea6bf5c677943176f55dc536b7c2bb1013671fa3909235b1bf53e9e07f7f
Malware Config
Extracted
socelars
https://hueduy.s3.eu-west-1.amazonaws.com/dkfjrg725/
Extracted
raccoon
9ff0d3252fc925e8866300fd0964f332
http://51.195.166.176
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4884 4616 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3604 4616 rundll32.exe -
Raccoon Stealer payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1576-189-0x0000000000970000-0x000000000143E000-memory.dmp family_raccoon behavioral1/memory/1576-191-0x0000000000970000-0x000000000143E000-memory.dmp family_raccoon behavioral1/memory/1576-198-0x0000000000970000-0x000000000143E000-memory.dmp family_raccoon behavioral1/memory/1576-225-0x0000000000970000-0x000000000143E000-memory.dmp family_raccoon behavioral1/memory/1576-228-0x0000000000970000-0x000000000143E000-memory.dmp family_raccoon -
Socelars payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\mp3studios_51.exe family_socelars C:\Users\Admin\AppData\Local\Temp\mp3studios_51.exe family_socelars -
Downloads MZ/PE file
-
Executes dropped EXE 17 IoCs
Processes:
70AD.exe8157.exe8919.exe8919.exe98E8.exeBCEC.exeCB93.exeCB93.exebuaeacdmoek.exeznLyAjp.exemp3studios_51.exeChiamando.exe.pif70AE.exe8F33.exe9C06.exeChiamando.exe.pifBE25.exepid process 4820 70AD.exe 2328 8157.exe 4784 8919.exe 4612 8919.exe 1284 98E8.exe 4856 BCEC.exe 1408 CB93.exe 2376 CB93.exe 1576 buaeacdmoek.exe 1352 znLyAjp.exe 4308 mp3studios_51.exe 5004 Chiamando.exe.pif 2360 70AE.exe 796 8F33.exe 4948 9C06.exe 2112 Chiamando.exe.pif 2764 BE25.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\98E8.exe vmprotect C:\Users\Admin\AppData\Local\Temp\98E8.exe vmprotect behavioral1/memory/1284-159-0x0000000140000000-0x000000014068C000-memory.dmp vmprotect behavioral1/memory/796-233-0x0000000140000000-0x000000014068C000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8919.exeCB93.exeBCEC.exebuaeacdmoek.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation 8919.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation CB93.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation BCEC.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation buaeacdmoek.exe -
Loads dropped DLL 12 IoCs
Processes:
regsvr32.exerundll32.exerundll32.exebuaeacdmoek.exeChiamando.exe.pifpid process 3612 regsvr32.exe 5024 rundll32.exe 2504 rundll32.exe 1576 buaeacdmoek.exe 1576 buaeacdmoek.exe 1576 buaeacdmoek.exe 5004 Chiamando.exe.pif 5004 Chiamando.exe.pif 5004 Chiamando.exe.pif 5004 Chiamando.exe.pif 5004 Chiamando.exe.pif 5004 Chiamando.exe.pif -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
znLyAjp.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce znLyAjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" znLyAjp.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 81 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
buaeacdmoek.exepid process 1576 buaeacdmoek.exe 1576 buaeacdmoek.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Chiamando.exe.pifdescription pid process target process PID 5004 set thread context of 2112 5004 Chiamando.exe.pif Chiamando.exe.pif -
Drops file in Program Files directory 19 IoCs
Processes:
mp3studios_51.exe70AE.exedescription ioc process File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png mp3studios_51.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js mp3studios_51.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js mp3studios_51.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js 70AE.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json 70AE.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html mp3studios_51.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json mp3studios_51.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js 70AE.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js mp3studios_51.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js mp3studios_51.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js mp3studios_51.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html 70AE.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js 70AE.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js mp3studios_51.exe File created C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js mp3studios_51.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png 70AE.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js 70AE.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js 70AE.exe File opened for modification C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js 70AE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4896 1284 WerFault.exe 98E8.exe 2996 5024 WerFault.exe rundll32.exe 1792 2504 WerFault.exe rundll32.exe 5024 796 WerFault.exe 8F33.exe 364 3300 WerFault.exe explorer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exechrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1576 taskkill.exe 4672 taskkill.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 76 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 89 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exepid process 1612 9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe 1612 9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3020 -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exepid process 1612 9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe 3020 3020 3020 3020 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
chrome.exechrome.exepid process 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
mp3studios_51.exedescription pid process Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeCreateTokenPrivilege 4308 mp3studios_51.exe Token: SeAssignPrimaryTokenPrivilege 4308 mp3studios_51.exe Token: SeLockMemoryPrivilege 4308 mp3studios_51.exe Token: SeIncreaseQuotaPrivilege 4308 mp3studios_51.exe Token: SeMachineAccountPrivilege 4308 mp3studios_51.exe Token: SeTcbPrivilege 4308 mp3studios_51.exe Token: SeSecurityPrivilege 4308 mp3studios_51.exe Token: SeTakeOwnershipPrivilege 4308 mp3studios_51.exe Token: SeLoadDriverPrivilege 4308 mp3studios_51.exe Token: SeSystemProfilePrivilege 4308 mp3studios_51.exe Token: SeSystemtimePrivilege 4308 mp3studios_51.exe Token: SeProfSingleProcessPrivilege 4308 mp3studios_51.exe Token: SeIncBasePriorityPrivilege 4308 mp3studios_51.exe Token: SeCreatePagefilePrivilege 4308 mp3studios_51.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
Processes:
Chiamando.exe.pifchrome.exechrome.exepid process 5004 Chiamando.exe.pif 3020 3020 5004 Chiamando.exe.pif 5004 Chiamando.exe.pif 3020 3020 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 3020 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe -
Suspicious use of SendNotifyMessage 51 IoCs
Processes:
Chiamando.exe.pifchrome.exechrome.exepid process 5004 Chiamando.exe.pif 5004 Chiamando.exe.pif 5004 Chiamando.exe.pif 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe 1516 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
pid process 3020 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exe8919.exerundll32.exeCB93.exeBCEC.exeznLyAjp.execmd.exerundll32.exemp3studios_51.execmd.execmd.exedescription pid process target process PID 3020 wrote to memory of 4464 3020 regsvr32.exe PID 3020 wrote to memory of 4464 3020 regsvr32.exe PID 4464 wrote to memory of 3612 4464 regsvr32.exe regsvr32.exe PID 4464 wrote to memory of 3612 4464 regsvr32.exe regsvr32.exe PID 4464 wrote to memory of 3612 4464 regsvr32.exe regsvr32.exe PID 3020 wrote to memory of 4820 3020 70AD.exe PID 3020 wrote to memory of 4820 3020 70AD.exe PID 3020 wrote to memory of 4820 3020 70AD.exe PID 3020 wrote to memory of 2328 3020 8157.exe PID 3020 wrote to memory of 2328 3020 8157.exe PID 3020 wrote to memory of 2328 3020 8157.exe PID 3020 wrote to memory of 4784 3020 8919.exe PID 3020 wrote to memory of 4784 3020 8919.exe PID 3020 wrote to memory of 4784 3020 8919.exe PID 4784 wrote to memory of 4612 4784 8919.exe 8919.exe PID 4784 wrote to memory of 4612 4784 8919.exe 8919.exe PID 4784 wrote to memory of 4612 4784 8919.exe 8919.exe PID 3020 wrote to memory of 1284 3020 98E8.exe PID 3020 wrote to memory of 1284 3020 98E8.exe PID 4884 wrote to memory of 5024 4884 rundll32.exe rundll32.exe PID 4884 wrote to memory of 5024 4884 rundll32.exe rundll32.exe PID 4884 wrote to memory of 5024 4884 rundll32.exe rundll32.exe PID 3020 wrote to memory of 4856 3020 BCEC.exe PID 3020 wrote to memory of 4856 3020 BCEC.exe PID 3020 wrote to memory of 4856 3020 BCEC.exe PID 3020 wrote to memory of 1408 3020 CB93.exe PID 3020 wrote to memory of 1408 3020 CB93.exe PID 3020 wrote to memory of 1408 3020 CB93.exe PID 1408 wrote to memory of 2376 1408 CB93.exe CB93.exe PID 1408 wrote to memory of 2376 1408 CB93.exe CB93.exe PID 1408 wrote to memory of 2376 1408 CB93.exe CB93.exe PID 4856 wrote to memory of 1576 4856 BCEC.exe buaeacdmoek.exe PID 4856 wrote to memory of 1576 4856 BCEC.exe buaeacdmoek.exe PID 4856 wrote to memory of 1576 4856 BCEC.exe buaeacdmoek.exe PID 4856 wrote to memory of 1352 4856 BCEC.exe znLyAjp.exe PID 4856 wrote to memory of 1352 4856 BCEC.exe znLyAjp.exe PID 4856 wrote to memory of 1352 4856 BCEC.exe znLyAjp.exe PID 4856 wrote to memory of 4308 4856 BCEC.exe mp3studios_51.exe PID 4856 wrote to memory of 4308 4856 BCEC.exe mp3studios_51.exe PID 4856 wrote to memory of 4308 4856 BCEC.exe mp3studios_51.exe PID 1352 wrote to memory of 4984 1352 znLyAjp.exe fc.exe PID 1352 wrote to memory of 4984 1352 znLyAjp.exe fc.exe PID 1352 wrote to memory of 4984 1352 znLyAjp.exe fc.exe PID 1352 wrote to memory of 3952 1352 znLyAjp.exe cmd.exe PID 1352 wrote to memory of 3952 1352 znLyAjp.exe cmd.exe PID 1352 wrote to memory of 3952 1352 znLyAjp.exe cmd.exe PID 3952 wrote to memory of 3800 3952 cmd.exe cmd.exe PID 3952 wrote to memory of 3800 3952 cmd.exe cmd.exe PID 3952 wrote to memory of 3800 3952 cmd.exe cmd.exe PID 3604 wrote to memory of 2504 3604 rundll32.exe rundll32.exe PID 3604 wrote to memory of 2504 3604 rundll32.exe rundll32.exe PID 3604 wrote to memory of 2504 3604 rundll32.exe rundll32.exe PID 4308 wrote to memory of 3452 4308 mp3studios_51.exe cmd.exe PID 4308 wrote to memory of 3452 4308 mp3studios_51.exe cmd.exe PID 4308 wrote to memory of 3452 4308 mp3studios_51.exe cmd.exe PID 3452 wrote to memory of 4672 3452 cmd.exe taskkill.exe PID 3452 wrote to memory of 4672 3452 cmd.exe taskkill.exe PID 3452 wrote to memory of 4672 3452 cmd.exe taskkill.exe PID 3800 wrote to memory of 4720 3800 cmd.exe tasklist.exe PID 3800 wrote to memory of 4720 3800 cmd.exe tasklist.exe PID 3800 wrote to memory of 4720 3800 cmd.exe tasklist.exe PID 3800 wrote to memory of 1596 3800 cmd.exe find.exe PID 3800 wrote to memory of 1596 3800 cmd.exe find.exe PID 3800 wrote to memory of 1596 3800 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe"C:\Users\Admin\AppData\Local\Temp\9f0c6ca016ddc2dba64ee16b0c9b68e98f85299d09cf455decc9f0550b1b1a77.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\67E2.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\67E2.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\70AD.exeC:\Users\Admin\AppData\Local\Temp\70AD.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8157.exeC:\Users\Admin\AppData\Local\Temp\8157.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8919.exeC:\Users\Admin\AppData\Local\Temp\8919.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8919.exe"C:\Users\Admin\AppData\Local\Temp\8919.exe" -hq2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\98E8.exeC:\Users\Admin\AppData\Local\Temp\98E8.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1284 -s 7082⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 1284 -ip 12841⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 6083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5024 -ip 50241⤵
-
C:\Users\Admin\AppData\Local\Temp\BCEC.exeC:\Users\Admin\AppData\Local\Temp\BCEC.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\buaeacdmoek.exe"C:\Users\Admin\AppData\Local\Temp\buaeacdmoek.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\znLyAjp.exe"C:\Users\Admin\AppData\Local\Temp\znLyAjp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\fc.exefc3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Bel.xls & ping -n 5 localhost3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq PSUAService.exe"5⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /I /N "psuaservice.exe"5⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^phBHUZBJCXhpvtzymmPzZMfWZWQaqxSnGoozLPuRzxxDWWWaBxCbsMVvXFHXopIitOChWZxJzYZEaMZeZnQGSciUhLvyooIlMjmizIcCqStzMdrkFEYKaefJHIqkDfBlfPSuhSIdegFqsN$" Pel.xls5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chiamando.exe.pifChiamando.exe.pif H5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chiamando.exe.pifC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chiamando.exe.pif6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 55⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost4⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\mp3studios_51.exe"C:\Users\Admin\AppData\Local\Temp\mp3studios_51.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc5364f50,0x7ffdc5364f60,0x7ffdc5364f704⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1672 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1876 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4672 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5260 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5724 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5740 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5748 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4708 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1664,4225521239157486270,16200150353318653306,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:14⤵
-
C:\Users\Admin\AppData\Local\Temp\CB93.exeC:\Users\Admin\AppData\Local\Temp\CB93.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CB93.exe"C:\Users\Admin\AppData\Local\Temp\CB93.exe" -hq2⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2504 -ip 25041⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\70AE.exeC:\Users\Admin\AppData\Local\Temp\70AE.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc5364f50,0x7ffdc5364f60,0x7ffdc5364f703⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1860 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1812 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4984 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1800,5130161579861868071,4453392548298780388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:83⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\8F33.exeC:\Users\Admin\AppData\Local\Temp\8F33.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 796 -s 9282⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 796 -ip 7961⤵
-
C:\Users\Admin\AppData\Local\Temp\9C06.exeC:\Users\Admin\AppData\Local\Temp\9C06.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BE25.exeC:\Users\Admin\AppData\Local\Temp\BE25.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 8722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3300 -ip 33001⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.htmlFilesize
786B
MD59ffe618d587a0685d80e9f8bb7d89d39
SHA18e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA256a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
SHA512a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.pngFilesize
6KB
MD5c8d8c174df68910527edabe6b5278f06
SHA18ac53b3605fea693b59027b9b471202d150f266f
SHA2569434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5
SHA512d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.jsFilesize
13KB
MD54ff108e4584780dce15d610c142c3e62
SHA177e4519962e2f6a9fc93342137dbb31c33b76b04
SHA256fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
SHA512d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.jsFilesize
19KB
MD5286278df39ffe54ddd48cf6ab1683686
SHA16a560bc3751af8befa966160f4ca4b070b12fd2a
SHA25631b0e811045d0cf1809d2049233f00a108a73cbdbceb0caae67faa198e8ab6d3
SHA5124712fdfe2ad8c66fa57a270fedb6fb30ff110345788967859334be7d0a551e0edd8f4554a2a53792da9f9936ea146dfe4db7bfb2b0e47db0a945e4b9e4e3e2d2
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.jsFilesize
3KB
MD5f79618c53614380c5fdc545699afe890
SHA17804a4621cd9405b6def471f3ebedb07fb17e90a
SHA256f3f30c5c271f80b0a3a329b11d8e72eb404d0c0dc9c66fa162ca97ccaa1e963c
SHA512c4e0c4df6ac92351591859a7c4358b3dcd342e00051bf561e68e3fcc2c94fdd8d14bd0a042d88dca33f6c7e952938786378d804f56e84b4eab99e2a5fee96a4c
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.jsFilesize
84KB
MD5a09e13ee94d51c524b7e2a728c7d4039
SHA10dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
SHA512f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.jsFilesize
604B
MD523231681d1c6f85fa32e725d6d63b19b
SHA1f69315530b49ac743b0e012652a3a5efaed94f17
SHA25603164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
SHA51236860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.jsFilesize
268B
MD50f26002ee3b4b4440e5949a969ea7503
SHA131fc518828fe4894e8077ec5686dce7b1ed281d7
SHA256282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
SHA5124290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
-
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.jsonFilesize
1KB
MD56da6b303170ccfdca9d9e75abbfb59f3
SHA11a8070080f50a303f73eba253ba49c1e6d400df6
SHA25666f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333
SHA512872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD59b8ca681db253b427e4a360c483f9912
SHA1afd10a20df6d26283767484b2f193e168964614a
SHA25615efe98830caa155865f7bfe9e1785de497c95fc3be03611dface96ae09a85f0
SHA5121fc71a45621f75437ecc2ad75f104987be3405abd517b552f561f012a34215046848805938753ddb13649195d4f67b1a44e1e9cecf6b8031468fb44c4f0ea019
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD51092abd23850e15e95d1209d9e3338b7
SHA1fdb0cbe7705efeb513348fcda7f02d44836b4b0c
SHA256bd9dc959f66679e4d28a507846d3e53eaa9111c4e33d0615e51688d0ee55f80e
SHA5126e5c96cec727a4596764e24f565f19b0564f1d97ebd0579b60beb11015d4780d35d2a8d7c2b92687f1a0b40f770606549a17bdeb1876dfe9b3fa71a7b8ce6992
-
C:\Users\Admin\AppData\Local\Temp\67E2.dllFilesize
1.6MB
MD55b0579107c97e240a56d84920dacb561
SHA113e4dd52630bf51045dc9a6d758611762de3ea56
SHA2568d50a4fdce0519907f0839158f5d76134b03a09bf5b7d5a26aab456ed3126022
SHA51216264e7527e7d0a9ba9b59eb9ef97f46186746a8eec19a7e72761f456b8f148e62b4c657841f720fb5dfd9c1ce6adebcd383985e0d2074c5369c79a7d0778eb3
-
C:\Users\Admin\AppData\Local\Temp\67E2.dllFilesize
1.6MB
MD55b0579107c97e240a56d84920dacb561
SHA113e4dd52630bf51045dc9a6d758611762de3ea56
SHA2568d50a4fdce0519907f0839158f5d76134b03a09bf5b7d5a26aab456ed3126022
SHA51216264e7527e7d0a9ba9b59eb9ef97f46186746a8eec19a7e72761f456b8f148e62b4c657841f720fb5dfd9c1ce6adebcd383985e0d2074c5369c79a7d0778eb3
-
C:\Users\Admin\AppData\Local\Temp\70AD.exeFilesize
1.0MB
MD50260760e44605dd3402d72d749206bbf
SHA182a7c00647ad5bd78aac2a38b389f908b6cdb40b
SHA2563860806ef4272970c3456bdeb0b3d199a5beb9c916bc3833e09a0357b891de1a
SHA512fe93ae186bd80adf64d51e4900040160704775e82060cac26a72eced4bcd48b9e7bcffd692741160264b1de52018894a51e170eb56544828e965ae7b35320856
-
C:\Users\Admin\AppData\Local\Temp\70AD.exeFilesize
1.0MB
MD50260760e44605dd3402d72d749206bbf
SHA182a7c00647ad5bd78aac2a38b389f908b6cdb40b
SHA2563860806ef4272970c3456bdeb0b3d199a5beb9c916bc3833e09a0357b891de1a
SHA512fe93ae186bd80adf64d51e4900040160704775e82060cac26a72eced4bcd48b9e7bcffd692741160264b1de52018894a51e170eb56544828e965ae7b35320856
-
C:\Users\Admin\AppData\Local\Temp\8157.exeFilesize
1.1MB
MD5fd2ec40096b9580b8b1c59b764b5f4b2
SHA19db220d90f9317636846f16ef2e7b9f52068848f
SHA256c169ae33c22593003f30c37ab4cf59172b762ea1674df82e000bad6f49f24fd8
SHA51212d371fa2775eb25f6a738c7de2c0550685f4946f2014eb48004fd7efcdb0a7c82eab5530d9130622ddbd9a226323e85a7ebab6ec6264fab677731dfab051b84
-
C:\Users\Admin\AppData\Local\Temp\8157.exeFilesize
1.1MB
MD5fd2ec40096b9580b8b1c59b764b5f4b2
SHA19db220d90f9317636846f16ef2e7b9f52068848f
SHA256c169ae33c22593003f30c37ab4cf59172b762ea1674df82e000bad6f49f24fd8
SHA51212d371fa2775eb25f6a738c7de2c0550685f4946f2014eb48004fd7efcdb0a7c82eab5530d9130622ddbd9a226323e85a7ebab6ec6264fab677731dfab051b84
-
C:\Users\Admin\AppData\Local\Temp\8919.exeFilesize
76KB
MD591c1e8f4da22bda4a24dd23066e0d8b4
SHA16bfcb55cc76d8b06962dc47aec445499fcbc3621
SHA2565ac72de7f6ad06775c3a616d1e14185b1eba82e1f03790a647c05e7289663cb5
SHA512e1fde55633bc42812216ce3b38fbf70248ef4fae76766821c8434f9b336ccdec20f1d71cf227e74c79c952cac0a87d9e4f783dede872a89b1a5a3f5829f681ff
-
C:\Users\Admin\AppData\Local\Temp\8919.exeFilesize
76KB
MD591c1e8f4da22bda4a24dd23066e0d8b4
SHA16bfcb55cc76d8b06962dc47aec445499fcbc3621
SHA2565ac72de7f6ad06775c3a616d1e14185b1eba82e1f03790a647c05e7289663cb5
SHA512e1fde55633bc42812216ce3b38fbf70248ef4fae76766821c8434f9b336ccdec20f1d71cf227e74c79c952cac0a87d9e4f783dede872a89b1a5a3f5829f681ff
-
C:\Users\Admin\AppData\Local\Temp\8919.exeFilesize
76KB
MD591c1e8f4da22bda4a24dd23066e0d8b4
SHA16bfcb55cc76d8b06962dc47aec445499fcbc3621
SHA2565ac72de7f6ad06775c3a616d1e14185b1eba82e1f03790a647c05e7289663cb5
SHA512e1fde55633bc42812216ce3b38fbf70248ef4fae76766821c8434f9b336ccdec20f1d71cf227e74c79c952cac0a87d9e4f783dede872a89b1a5a3f5829f681ff
-
C:\Users\Admin\AppData\Local\Temp\98E8.exeFilesize
3.7MB
MD5ba1b640cafc93dafb0f78aedfee3b146
SHA1c44971948fc7745fdd72ec7493c485633d0a7e91
SHA2564d39e940c908fafd2d1384f0aa398e54e5305424ed3b6fe5ed7121c5e22cc72b
SHA51245ffecec7c204ffc628e1b6aaed94f221fbfd17f91d906b8fa3608c1f160dd9a407590e302ecae487bc73ba0a1229934c1c7ae1ada47d9f9c147e9622909baf5
-
C:\Users\Admin\AppData\Local\Temp\98E8.exeFilesize
3.7MB
MD5ba1b640cafc93dafb0f78aedfee3b146
SHA1c44971948fc7745fdd72ec7493c485633d0a7e91
SHA2564d39e940c908fafd2d1384f0aa398e54e5305424ed3b6fe5ed7121c5e22cc72b
SHA51245ffecec7c204ffc628e1b6aaed94f221fbfd17f91d906b8fa3608c1f160dd9a407590e302ecae487bc73ba0a1229934c1c7ae1ada47d9f9c147e9622909baf5
-
C:\Users\Admin\AppData\Local\Temp\BCEC.exeFilesize
9.6MB
MD5fd17d0406345aa0821765da404b18c5f
SHA11ee12945b125bce9c163fa0be61b3b24683d0f3d
SHA2568d7bb4d07a4e3cefbc54f70aa7b783433f3c527ac0f4a03c1d84a4f7ba0a8e2e
SHA51246b4fbf2f99d91c93cdacd1f7e67f5c96c2adf5a8298670a527809ae758c4f22a27bab4136daa6561fa794760b2af1d400a6437b1a4a66bfcd90c43dfb7f4e1c
-
C:\Users\Admin\AppData\Local\Temp\BCEC.exeFilesize
9.6MB
MD5fd17d0406345aa0821765da404b18c5f
SHA11ee12945b125bce9c163fa0be61b3b24683d0f3d
SHA2568d7bb4d07a4e3cefbc54f70aa7b783433f3c527ac0f4a03c1d84a4f7ba0a8e2e
SHA51246b4fbf2f99d91c93cdacd1f7e67f5c96c2adf5a8298670a527809ae758c4f22a27bab4136daa6561fa794760b2af1d400a6437b1a4a66bfcd90c43dfb7f4e1c
-
C:\Users\Admin\AppData\Local\Temp\CB93.exeFilesize
76KB
MD591c1e8f4da22bda4a24dd23066e0d8b4
SHA16bfcb55cc76d8b06962dc47aec445499fcbc3621
SHA2565ac72de7f6ad06775c3a616d1e14185b1eba82e1f03790a647c05e7289663cb5
SHA512e1fde55633bc42812216ce3b38fbf70248ef4fae76766821c8434f9b336ccdec20f1d71cf227e74c79c952cac0a87d9e4f783dede872a89b1a5a3f5829f681ff
-
C:\Users\Admin\AppData\Local\Temp\CB93.exeFilesize
76KB
MD591c1e8f4da22bda4a24dd23066e0d8b4
SHA16bfcb55cc76d8b06962dc47aec445499fcbc3621
SHA2565ac72de7f6ad06775c3a616d1e14185b1eba82e1f03790a647c05e7289663cb5
SHA512e1fde55633bc42812216ce3b38fbf70248ef4fae76766821c8434f9b336ccdec20f1d71cf227e74c79c952cac0a87d9e4f783dede872a89b1a5a3f5829f681ff
-
C:\Users\Admin\AppData\Local\Temp\CB93.exeFilesize
76KB
MD591c1e8f4da22bda4a24dd23066e0d8b4
SHA16bfcb55cc76d8b06962dc47aec445499fcbc3621
SHA2565ac72de7f6ad06775c3a616d1e14185b1eba82e1f03790a647c05e7289663cb5
SHA512e1fde55633bc42812216ce3b38fbf70248ef4fae76766821c8434f9b336ccdec20f1d71cf227e74c79c952cac0a87d9e4f783dede872a89b1a5a3f5829f681ff
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bel.xlsFilesize
9KB
MD53c7abc6e86cd6353d3f9231fe948dfad
SHA1d783c9b9cae3b30a37bf901e11af7bc92067406d
SHA256129b585eff2b904fd4c464904583162d281483d88f8177f84c643fd359cd6929
SHA5125a5a5c5e98d09689285994a74bc4ed40e973f2a09f06d67e3ddd3f7ef38c2a508f31cf250af154ecbefdfc1bf9f43f1b7021fd0cc674c3414102d7901029d035
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chiamando.exe.pifFilesize
924KB
MD56987e4cd3f256462f422326a7ef115b9
SHA171672a495b4603ecfec40a65254cb3ba8766bbe0
SHA2563e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
SHA5124b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chiamando.exe.pifFilesize
924KB
MD56987e4cd3f256462f422326a7ef115b9
SHA171672a495b4603ecfec40a65254cb3ba8766bbe0
SHA2563e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
SHA5124b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pel.xlsFilesize
924KB
MD51f7e72e83c4e2450a1c180ebfe26e1a9
SHA1ce31fd11fff9361bf2edf8041a987a3dbd7fc21c
SHA2566c153dfe5472be6e231658d40324301421d0b402494021f2ef32f92caf50eb51
SHA512ef357503699134788925db8685ef7c84e90b09b00b55bd4f21ad4745ef5fabec61d2a096d00064b2704c5b1cecf79818d083fc86bbc48fbb616f82c51fdd3f97
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sgomento.xlsFilesize
1.1MB
MD554387b9aaa708f58c31dc227810c1e3e
SHA17575d973b492f6ad48185a6cb35dc06ba5529a8d
SHA256404700ec34e975502cb3e68d87f3b661e0d94af974fe9d12a8b48a8c34e60873
SHA512cacc9b03f4b976fac2bc51aa4b76c2697c2d8a9dfdf946e635f476c78950bbf037dc0a9824a5300966c3948a15d437207da17dc0b7cda6be5e07c5d6bc275ea4
-
C:\Users\Admin\AppData\Local\Temp\buaeacdmoek.exeFilesize
7.0MB
MD5c1094dc49b34caa6d96b4c31e9e27e26
SHA1c7883434ddcf7f21760f67e5bbc1f28aca1e7236
SHA256249d2b563329d815e7ea451f6c60e17652d2a00f3fd235d0f5ac187b7077e611
SHA512662adec87a208078d1b73c7fb5e929ddfa537161da467f0537ef4747d548072733beb6e0414dae56471fc88a86cedd4122b31d7e41e7b8638960db2e27a9813f
-
C:\Users\Admin\AppData\Local\Temp\buaeacdmoek.exeFilesize
7.0MB
MD5c1094dc49b34caa6d96b4c31e9e27e26
SHA1c7883434ddcf7f21760f67e5bbc1f28aca1e7236
SHA256249d2b563329d815e7ea451f6c60e17652d2a00f3fd235d0f5ac187b7077e611
SHA512662adec87a208078d1b73c7fb5e929ddfa537161da467f0537ef4747d548072733beb6e0414dae56471fc88a86cedd4122b31d7e41e7b8638960db2e27a9813f
-
C:\Users\Admin\AppData\Local\Temp\db.datFilesize
557KB
MD5720ec3d97f3cd9e1dc34b7ad51451892
SHA18c417926a14a0cd2d268d088658022f49e3dda4b
SHA2566c05e113ed295140f979f4a8864eac92e119e013e74e6ed3d849a66217e34c6a
SHA5120d681247d1f7f5932779da58d59de2dd0e01e904acc8702bea93676f029b2dd0745b961f833d49ef4a6af712a3a3ba51364533741cd605d39442fe2993279dee
-
C:\Users\Admin\AppData\Local\Temp\db.datFilesize
557KB
MD5720ec3d97f3cd9e1dc34b7ad51451892
SHA18c417926a14a0cd2d268d088658022f49e3dda4b
SHA2566c05e113ed295140f979f4a8864eac92e119e013e74e6ed3d849a66217e34c6a
SHA5120d681247d1f7f5932779da58d59de2dd0e01e904acc8702bea93676f029b2dd0745b961f833d49ef4a6af712a3a3ba51364533741cd605d39442fe2993279dee
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD58defa1d8ec654dc658423940185a576a
SHA1dd35cf0908cd5edbf189737686c3e33e4267d8b8
SHA25694ce3e910e9bfd474528848e8c2b2968925fce018674cef64f225b09f25eba4a
SHA512d110348773a84dffcd2f39f98e4019c6638129fefa3ed90de4a10ed4db3b03171a81d2e87b269ac97cffadfd17f9ef701f2e4952ae61c5703eac2d68273e0328
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD58defa1d8ec654dc658423940185a576a
SHA1dd35cf0908cd5edbf189737686c3e33e4267d8b8
SHA25694ce3e910e9bfd474528848e8c2b2968925fce018674cef64f225b09f25eba4a
SHA512d110348773a84dffcd2f39f98e4019c6638129fefa3ed90de4a10ed4db3b03171a81d2e87b269ac97cffadfd17f9ef701f2e4952ae61c5703eac2d68273e0328
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD58defa1d8ec654dc658423940185a576a
SHA1dd35cf0908cd5edbf189737686c3e33e4267d8b8
SHA25694ce3e910e9bfd474528848e8c2b2968925fce018674cef64f225b09f25eba4a
SHA512d110348773a84dffcd2f39f98e4019c6638129fefa3ed90de4a10ed4db3b03171a81d2e87b269ac97cffadfd17f9ef701f2e4952ae61c5703eac2d68273e0328
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD58defa1d8ec654dc658423940185a576a
SHA1dd35cf0908cd5edbf189737686c3e33e4267d8b8
SHA25694ce3e910e9bfd474528848e8c2b2968925fce018674cef64f225b09f25eba4a
SHA512d110348773a84dffcd2f39f98e4019c6638129fefa3ed90de4a10ed4db3b03171a81d2e87b269ac97cffadfd17f9ef701f2e4952ae61c5703eac2d68273e0328
-
C:\Users\Admin\AppData\Local\Temp\mp3studios_51.exeFilesize
1.4MB
MD5c521a65d11dca76a0ac886f15e0ba15b
SHA156154763cc5c5073682c583ee86e99bb2dec14d2
SHA25643fe43a7462d892ae08bfdb50dc07249796bf90631a4975ea75738291b484f13
SHA51277f7fcb92f1cec4f0de7fc2d5cc226db66f73aebbfd1b65e869e5bb57a1a0995160ecb5c00a0aae2d2993d0a9b3d445bbc8889fefce36f8942feb7198889b486
-
C:\Users\Admin\AppData\Local\Temp\mp3studios_51.exeFilesize
1.4MB
MD5c521a65d11dca76a0ac886f15e0ba15b
SHA156154763cc5c5073682c583ee86e99bb2dec14d2
SHA25643fe43a7462d892ae08bfdb50dc07249796bf90631a4975ea75738291b484f13
SHA51277f7fcb92f1cec4f0de7fc2d5cc226db66f73aebbfd1b65e869e5bb57a1a0995160ecb5c00a0aae2d2993d0a9b3d445bbc8889fefce36f8942feb7198889b486
-
C:\Users\Admin\AppData\Local\Temp\znLyAjp.exeFilesize
981KB
MD5949d021b13c25170d83986aa22869926
SHA14662f1ed7e5e37f9d716ddc915b6b8603e31ca7b
SHA2568b54f808618be321efc042286e61403307f264da1af129bbeaa140efb73f0605
SHA512d553894db214e7e0010c859061457aee49c79d77e4867840aefb210356f8165968a62f54237b09c3756b67d886c11ced6cf2ecaac44c826021745eb39270e1aa
-
C:\Users\Admin\AppData\Local\Temp\znLyAjp.exeFilesize
981KB
MD5949d021b13c25170d83986aa22869926
SHA14662f1ed7e5e37f9d716ddc915b6b8603e31ca7b
SHA2568b54f808618be321efc042286e61403307f264da1af129bbeaa140efb73f0605
SHA512d553894db214e7e0010c859061457aee49c79d77e4867840aefb210356f8165968a62f54237b09c3756b67d886c11ced6cf2ecaac44c826021745eb39270e1aa
-
\??\pipe\crashpad_2688_SPPZEMGYWQAZEQSZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/8-250-0x0000000000100000-0x000000000010C000-memory.dmpFilesize
48KB
-
memory/8-249-0x0000000000000000-mapping.dmp
-
memory/796-233-0x0000000140000000-0x000000014068C000-memory.dmpFilesize
6.5MB
-
memory/796-232-0x0000000000000000-mapping.dmp
-
memory/1284-159-0x0000000140000000-0x000000014068C000-memory.dmpFilesize
6.5MB
-
memory/1284-156-0x0000000000000000-mapping.dmp
-
memory/1352-180-0x0000000000000000-mapping.dmp
-
memory/1408-172-0x0000000000000000-mapping.dmp
-
memory/1576-225-0x0000000000970000-0x000000000143E000-memory.dmpFilesize
10.8MB
-
memory/1576-228-0x0000000000970000-0x000000000143E000-memory.dmpFilesize
10.8MB
-
memory/1576-198-0x0000000000970000-0x000000000143E000-memory.dmpFilesize
10.8MB
-
memory/1576-191-0x0000000000970000-0x000000000143E000-memory.dmpFilesize
10.8MB
-
memory/1576-231-0x0000000000000000-mapping.dmp
-
memory/1576-177-0x0000000000000000-mapping.dmp
-
memory/1576-189-0x0000000000970000-0x000000000143E000-memory.dmpFilesize
10.8MB
-
memory/1596-205-0x0000000000000000-mapping.dmp
-
memory/1612-132-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/1612-131-0x00000000021B0000-0x00000000021B9000-memory.dmpFilesize
36KB
-
memory/1612-130-0x00000000005AE000-0x00000000005BF000-memory.dmpFilesize
68KB
-
memory/1612-133-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/2112-243-0x0000000002FE0000-0x0000000002FE9000-memory.dmpFilesize
36KB
-
memory/2112-237-0x0000000000000000-mapping.dmp
-
memory/2112-239-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2112-241-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2112-242-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2112-244-0x0000000003010000-0x000000000301D000-memory.dmpFilesize
52KB
-
memory/2328-143-0x0000000000000000-mapping.dmp
-
memory/2360-229-0x0000000000000000-mapping.dmp
-
memory/2376-175-0x0000000000000000-mapping.dmp
-
memory/2504-195-0x0000000000000000-mapping.dmp
-
memory/2756-230-0x0000000000000000-mapping.dmp
-
memory/2764-245-0x0000000000000000-mapping.dmp
-
memory/3300-251-0x0000000000C00000-0x0000000000C6B000-memory.dmpFilesize
428KB
-
memory/3300-248-0x0000000000C00000-0x0000000000C6B000-memory.dmpFilesize
428KB
-
memory/3300-247-0x0000000000C70000-0x0000000000CE4000-memory.dmpFilesize
464KB
-
memory/3300-246-0x0000000000000000-mapping.dmp
-
memory/3452-199-0x0000000000000000-mapping.dmp
-
memory/3592-211-0x0000000000000000-mapping.dmp
-
memory/3612-142-0x00000000044A0000-0x0000000004593000-memory.dmpFilesize
972KB
-
memory/3612-151-0x0000000002C30000-0x0000000002CE2000-memory.dmpFilesize
712KB
-
memory/3612-155-0x00000000044A0000-0x0000000004593000-memory.dmpFilesize
972KB
-
memory/3612-149-0x0000000002B60000-0x0000000002C29000-memory.dmpFilesize
804KB
-
memory/3612-136-0x0000000000000000-mapping.dmp
-
memory/3612-141-0x0000000004280000-0x00000000043A5000-memory.dmpFilesize
1.1MB
-
memory/3800-193-0x0000000000000000-mapping.dmp
-
memory/3952-188-0x0000000000000000-mapping.dmp
-
memory/4308-183-0x0000000000000000-mapping.dmp
-
memory/4464-134-0x0000000000000000-mapping.dmp
-
memory/4516-224-0x0000000000000000-mapping.dmp
-
memory/4612-150-0x0000000000000000-mapping.dmp
-
memory/4672-200-0x0000000000000000-mapping.dmp
-
memory/4720-204-0x0000000000000000-mapping.dmp
-
memory/4784-146-0x0000000000000000-mapping.dmp
-
memory/4804-206-0x0000000000000000-mapping.dmp
-
memory/4820-138-0x0000000000000000-mapping.dmp
-
memory/4856-186-0x0000000007C60000-0x0000000007CF2000-memory.dmpFilesize
584KB
-
memory/4856-171-0x0000000005F90000-0x0000000006534000-memory.dmpFilesize
5.6MB
-
memory/4856-170-0x0000000000710000-0x00000000010A6000-memory.dmpFilesize
9.6MB
-
memory/4856-167-0x0000000000000000-mapping.dmp
-
memory/4948-238-0x0000000000000000-mapping.dmp
-
memory/4984-187-0x0000000000000000-mapping.dmp
-
memory/5004-209-0x0000000000000000-mapping.dmp
-
memory/5024-164-0x0000000000000000-mapping.dmp