c74091d558422be1f8c5946690aee954dd7ef5c92e91d279b9a1ebb3029237ff

Analysis

max time kernel
92s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
13/04/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
Size 46.7MB
Sample240413-3nv35abd89
SHA256 c74091d558422be1f8c5946690aee954dd7ef5c92e91d279b9a1ebb3029237ff
MD5 1b4aa220446f1f655a2c9d9de105887f
SHA1 2bb77e522d549c167d1554916824b6e697c0e3ab
SHA512 a1576954ae7b0b018e3cfa1da65ea8a0d46c8a88a34e2c69d188ed984c3398403e5160c6bf0183cd7234aba62da1dc8b126376c40bad0d83e00a989db1297809
SSDEEP 786432:XUI/0+n83H7c0GkNnvHhqf+xEg1eIHqvRUJjGE7GCDsuhQG6gAecQ/q/MZq:++n8rcDkNvHsfSEuK5x4ZDC9Oy/M8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 25 IoCs

pid	Process
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3096	wmic.exe
Token: SeSecurityPrivilege	3096	wmic.exe
Token: SeTakeOwnershipPrivilege	3096	wmic.exe
Token: SeLoadDriverPrivilege	3096	wmic.exe
Token: SeSystemProfilePrivilege	3096	wmic.exe
Token: SeSystemtimePrivilege	3096	wmic.exe
Token: SeProfSingleProcessPrivilege	3096	wmic.exe
Token: SeIncBasePriorityPrivilege	3096	wmic.exe
Token: SeCreatePagefilePrivilege	3096	wmic.exe
Token: SeBackupPrivilege	3096	wmic.exe
Token: SeRestorePrivilege	3096	wmic.exe
Token: SeShutdownPrivilege	3096	wmic.exe
Token: SeDebugPrivilege	3096	wmic.exe
Token: SeSystemEnvironmentPrivilege	3096	wmic.exe
Token: SeRemoteShutdownPrivilege	3096	wmic.exe
Token: SeUndockPrivilege	3096	wmic.exe
Token: SeManageVolumePrivilege	3096	wmic.exe
Token: 33	3096	wmic.exe
Token: 34	3096	wmic.exe
Token: 35	3096	wmic.exe
Token: 36	3096	wmic.exe
Token: SeIncreaseQuotaPrivilege	3096	wmic.exe
Token: SeSecurityPrivilege	3096	wmic.exe
Token: SeTakeOwnershipPrivilege	3096	wmic.exe
Token: SeLoadDriverPrivilege	3096	wmic.exe
Token: SeSystemProfilePrivilege	3096	wmic.exe
Token: SeSystemtimePrivilege	3096	wmic.exe
Token: SeProfSingleProcessPrivilege	3096	wmic.exe
Token: SeIncBasePriorityPrivilege	3096	wmic.exe
Token: SeCreatePagefilePrivilege	3096	wmic.exe
Token: SeBackupPrivilege	3096	wmic.exe
Token: SeRestorePrivilege	3096	wmic.exe
Token: SeShutdownPrivilege	3096	wmic.exe
Token: SeDebugPrivilege	3096	wmic.exe
Token: SeSystemEnvironmentPrivilege	3096	wmic.exe
Token: SeRemoteShutdownPrivilege	3096	wmic.exe
Token: SeUndockPrivilege	3096	wmic.exe
Token: SeManageVolumePrivilege	3096	wmic.exe
Token: 33	3096	wmic.exe
Token: 34	3096	wmic.exe
Token: 35	3096	wmic.exe
Token: 36	3096	wmic.exe
Token: SeIncreaseQuotaPrivilege	4956	wmic.exe
Token: SeSecurityPrivilege	4956	wmic.exe
Token: SeTakeOwnershipPrivilege	4956	wmic.exe
Token: SeLoadDriverPrivilege	4956	wmic.exe
Token: SeSystemProfilePrivilege	4956	wmic.exe
Token: SeSystemtimePrivilege	4956	wmic.exe
Token: SeProfSingleProcessPrivilege	4956	wmic.exe
Token: SeIncBasePriorityPrivilege	4956	wmic.exe
Token: SeCreatePagefilePrivilege	4956	wmic.exe
Token: SeBackupPrivilege	4956	wmic.exe
Token: SeRestorePrivilege	4956	wmic.exe
Token: SeShutdownPrivilege	4956	wmic.exe
Token: SeDebugPrivilege	4956	wmic.exe
Token: SeSystemEnvironmentPrivilege	4956	wmic.exe
Token: SeRemoteShutdownPrivilege	4956	wmic.exe
Token: SeUndockPrivilege	4956	wmic.exe
Token: SeManageVolumePrivilege	4956	wmic.exe
Token: 33	4956	wmic.exe
Token: 34	4956	wmic.exe
Token: 35	4956	wmic.exe
Token: 36	4956	wmic.exe
Token: SeIncreaseQuotaPrivilege	4956	wmic.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3096	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	77
PID 4964 wrote to memory of 3096	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	77
PID 4964 wrote to memory of 3096	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	77
PID 4964 wrote to memory of 4956	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	80
PID 4964 wrote to memory of 4956	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	80
PID 4964 wrote to memory of 4956	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	80
PID 4964 wrote to memory of 4292	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	82
PID 4964 wrote to memory of 4292	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	82
PID 4964 wrote to memory of 4292	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	82
PID 4964 wrote to memory of 3300	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	84
PID 4964 wrote to memory of 3300	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	84
PID 4964 wrote to memory of 3300	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	84
PID 4964 wrote to memory of 4928	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	86
PID 4964 wrote to memory of 4928	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	86
PID 4964 wrote to memory of 4928	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	86
PID 4964 wrote to memory of 2512	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	88
PID 4964 wrote to memory of 2512	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	88
PID 4964 wrote to memory of 2512	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	88
PID 4964 wrote to memory of 4752	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	90
PID 4964 wrote to memory of 4752	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	90
PID 4964 wrote to memory of 4752	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	90
PID 4964 wrote to memory of 4780	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	92
PID 4964 wrote to memory of 4780	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	92
PID 4964 wrote to memory of 4780	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	92
PID 4964 wrote to memory of 4064	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	94
PID 4964 wrote to memory of 4064	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	94
PID 4964 wrote to memory of 4064	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	94
PID 4964 wrote to memory of 440	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	96
PID 4964 wrote to memory of 440	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	96
PID 4964 wrote to memory of 440	4964	PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe	96

C:\Users\Admin\AppData\Local\Temp\PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe
"C:\Users\Admin\AppData\Local\Temp\PID-DJ Felli Fel, Diddy, Akon, Ludacris, Lil Jon - Get Buck In Here (Album Version Explicit).exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  PID:4292
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  PID:3300
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  PID:4928
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  PID:2512
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  PID:4752
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  PID:4780
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  PID:4064
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic BaseBoard get SerialNumber
  2⤵
  PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CPKernel.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\CPKernel.dll
Size 3.2MB
SHA256 bffea8bdb7811b3d52473c07ef2c539dcac00df6bce60c7cafebf8c7beefa52b
MD5 00098438ab2cc364ce45d98902fb2b2a
SHA1 2a88a24a659f9a7962a4b6602b96d12249d2c790
SHA512 ca430ad171f53bbf3e7d670a9ba2961e3a0777abb640fa64cb722a1eb434f4c86bb71e2b3f6be9f1e3081e13a21fb38fb491a53134e9ac84f71c5fec237abf5b
SSDEEP 49152:Wazpv88SP1oMK4Tce0/4j97vcT7prFOVhNHS2r:vV81oMKh/CRUTdBA
MD5 SHA1 SHA512 SSDEEP

Submit Download

CPReader_English.ini

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\CPReader_English.ini
Size 23KB
SHA256 75b28f6989b77cd358dbbbcdbf6d08f2974b27a2b7967d5306740cde32b3e576
MD5 6e2c32cf89bdb3565652db4680e811e4
SHA1 543a1f2eaaa9051f4a0ab44fd056d8f36a073442
SHA512 72e1418075afa2e477fdf5200cb1246966d6795db14d6fe3021b416724703ed5a7eff598a5a668d75aa81a6450c682f49029de4bd31690528f43be3b7d880905
SSDEEP 192:8QoKsGVTBp9+1HaraWsR52JafmeAcG/dC3EQWHR5yziPRz1jkTx2b7/GdWT0:8Qo8VTBp9s62jRoTdUE7P11judWT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

GImageView.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\GImageView.dll
Size 543KB
SHA256 c85ca44b1ff1ad0af0ca3daf5f2302498846f3fdc2f48c6c7262f08280c6f5fc
MD5 3e837b82501aa2f90cc774890656d02b
SHA1 a62e967c006f6bf77fbe489b01ea30993e55fe5d
SHA512 a4a55fc0ef6ae87c5c73489993e2dc6e0e36f783de79dd7894966df3ebe13ae8341a5fe15dd0e26c72865b4a936247f34b08342769edd0a94ba2b90164b0d27d
SSDEEP 6144:k8pne7BI8gmXqBWb21ZLK/9eJVobNfQv3vCJYmS2N1ss9+NowV21Xgv8pTBJ0AOn:Tne6800G49eEb7JYmXVzZ5pTr0R
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImageZoom.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\ImageZoom.dll
Size 283KB
SHA256 ee7205fa96539f9d9e62f5a403a06004c6c7235b7caee368dcb0db3a765c21ad
MD5 b01a100820095dc05fdaa0d1c3b5ca14
SHA1 70af3c7337248cd4dc8c65d5ba1d18d3fba926b0
SHA512 883891959202294edceb3a6360f450182d59e097bb4b0f9fe18b5316c6591aee04d0cd5bf01c1b23d1727b59eeee7c148e56eea2a7436902170993318386933a
SSDEEP 3072:QCAH/7FulSeSsCbO1nSKK6tkRe/dQ2F/gXKaghdCl51ykyRbFiUQOr3XH53C/iU:ewlXSXizRT/dV/hag7XhBJQA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Player.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\Player.dll
Size 84KB
SHA256 e18254dd1e074eb57971d91ab62502611dee96aba1203f2b21810d8d0e761b3a
MD5 08c68e4121ceeac71745015bf17126cc
SHA1 103792ab800377092aabefbf4b94d0a882afdc3c
SHA512 d66c9db8a876260f4b86604dd71a52b72dd91d79b7d1da711c45577b0dddbda8e46802f6184c2cd63a202f58cdb04d51da865968b7b203b8c5c2a76a8cfb5bce
SSDEEP 1536:19Ahrkl6eZrkmEWyUJGrHbP7ITIqVdDVpEdCPO5+L1:19Ahr7qESKAIm3cD501
MD5 SHA1 SHA512 SSDEEP

Submit Download

SDL2.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\SDL2.dll
Size 1.2MB
SHA256 5ff3186465a347ce8a13991fdb659f77ee21ae5dc9813b9fb2aadafda8a86491
MD5 71e603e402afd0fdba84a781c9934446
SHA1 b3a529f7e470e478a77404846d17c1ad2ff017cb
SHA512 45aba98b564e4c18bc8fccb71ad4cf1f03770a916c074c1cbf8546f1385dba6e041c67fd870f792a5eec233b8d19bbbe4c4d047015266ac5c060caf037af9c28
SSDEEP 24576:F696vOhH+P+yOpO4wDV6uRpjOeeIMIEqGa+dAGGQI/uGJy4d5CWVM86g0:496vOhH+P+yOpO4wDV6uRpjOeeIMIEqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SharpWnd.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\SharpWnd.dll
Size 281KB
SHA256 2ad9292c875cb8b71a437b0da803d07867d2ed8deae4568f2be1f623755d5b60
MD5 a555f73041756d249093a1d6a6f28448
SHA1 bc75a0047342fb157047c19193c02a8149187656
SHA512 cb2166fcf3a73e60fef9b90102f6aba3a913cc0e84ca0a5c4cd43c52d21ad1696040215b302d2a46d61599024679cb2477fdaffedcc88396ae9c7ff1c649c84d
SSDEEP 6144:TWqIAbKFrnrlZy7y3aXkNdCLuSulFN3glY82NoSf:SvrlaXkCKSwFN3glHQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

avcodec-55.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\avcodec-55.dll
Size 9.3MB
SHA256 2be959285f432eec4115a9d3d945b9594b5356b4d8d5774ae4b3de82bcec33e6
MD5 5332b5114c712cd5b246515be3958200
SHA1 22e3e2a95643131537516863ba07b10df93417fa
SHA512 827bbebc37eebb0e487a967b4edf18d737fa491feb319de4df34486d26950606ce09bd2f0fe7f2e92927bc80a49c6b003a5c0ac08bf7a7a4357f6bf2df8a069a
SSDEEP 196608:tUC2EPKYUAH82wGvGd7o2WqM6+45Laq3YIfpGpP/bMrVUB:5nq3YIfpGp7MQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

avfilter-4.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\avfilter-4.dll
Size 1.5MB
SHA256 bfc20232c4ecf4aece403d005624c82a64a2d54d5d84720341dc6d45b3522ba5
MD5 6b007bedabaa20fb6d445bc62f1091d3
SHA1 d3905661051c4415ac92bd5492100a5f2df6f659
SHA512 7b0cb0959434437f31ab3e6df721be412de003979f19a66d3855ee4c87fe8a79d5cc4b42e6cf453be9289575854d2176d2bfff88a9308f5ab9f0895c0a899cfa
SSDEEP 24576:uoWHEfvAxkRiBFA+/Yay3a1NDJp2Vlot6Wi7wIshL7+zSOeFZNrAsQU:X8xRBus7xYot6W+wj5izSOef
MD5 SHA1 SHA512 SSDEEP

Submit Download

avformat-55.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\avformat-55.dll
Size 3.0MB
SHA256 c0fb1896ee5838e9f8bd1e4495367baffa0e71aa2d3785944d5b470f29aec53a
MD5 fb9763ac3b3f51551b4a77e833c395fb
SHA1 9a3f8e9225f214b31b4e703fe428b0537a7cac63
SHA512 6eecdf0d290e259fcb1c8aa9da5f3ca32f760c9039b84b11f40b63b39b1119152bde54d2c6e1c7d0a1af9f64c6a340501f934000a2f3e232612f525dd9b0c7fd
SSDEEP 98304:23Ic2MMwvA3DH/dMOTEOBevA/y7uvCInBIfOpZogtGN:24c2MjvkDHFMOTEOBevuy7uvCInBIG3q
MD5 SHA1 SHA512 SSDEEP

Submit Download

avutil-52.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\avutil-52.dll
Size 327KB
SHA256 67a0f7d47ceff1407b9c4851032346a9b81a75fee6569274f15d092610f04cdc
MD5 f832d24b70a2f4583c57a5fa9b6f0d68
SHA1 092ce5cb6bfe6eadde62c4cfb911eab2474196f8
SHA512 41048c023871b485718ae219f0d79bbe01a0704f8d2107d68ead2262e3f66737718afbb636b02109d1a2b427aab04dd394ef82d8014298fa3fdee0c61bfab185
SSDEEP 6144:VKvkCbK3qvkQRbWNZ3b5wPWBRjpmD/CiPTiD99XsxWQdPVrHB517SFYC:5CbQqMmyPb5wWptvFYC
MD5 SHA1 SHA512 SSDEEP

Submit Download

corem.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\corem.dll
Size 52KB
SHA256 deac6221d0abe480012e836e5e9dd915828ae55401f0c46fb7ce8049c380c698
MD5 71f601f8151e34ef31307ab4e46e902d
SHA1 1f3d312e2f4755b7f2decca1dedb91bc795288ea
SHA512 377e6c9540616cad77cf151a31f6461338910d441a12b26175d8bcc2020eba83f621b0df1756123b58fb4358786fcb6a3e187af11123f100a91255218a616aa9
SSDEEP 768:y7Utp1RlHkGRRrvT/DvV601kUBwr4uw9FBYasokoJW:ywr1RldvT/D9609BA4uwfzmoJW
MD5 SHA1 SHA512 SSDEEP

Submit Download

corez.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\corez.dll
Size 92KB
SHA256 00d4986dfff92cfdd45576da9100d49f374a8dba1a476cfc8dc7cf50f5a6735f
MD5 355f1b97cad97743a8e70dd2803e2f9d
SHA1 c7c12bc74483874cbdd39343d149509be355c2d9
SHA512 eb7f8d7b68ab01a95de5aad0023fc4c51c3828138610b488c92ca3ab5c320305f295467972b542c7fe436d08e21ba7926a997702e4383ce5f4cbc674f62479b7
SSDEEP 1536:+GmWuWvx+4pDmX45es09TK02Oeq52xN9ok:7mWvtEz2xN9ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

postproc-52.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\postproc-52.dll
Size 185KB
SHA256 72180a408b13b7d98c0bc2395b886a5c3aa0b2dea39ef081e193f60ef373365f
MD5 f75d1b175e1687ee0a9b9e4a7abd123b
SHA1 026f4db79aa8db651964acf17233302d1809de1e
SHA512 200aec20c95b1ec2e7d1bb33ed89d846a128847b82c9d09aa2788b258967e750718414f05bdec0cf2e4f9c7af697404e19caccac354a1a62db52e76c6a45886b
SSDEEP 3072:mxxxxRxRw6fxxxxRxRw6RIqWaa6aa66vumpaGaa6aa66v+ism5V1+lr74YkSFx5I:mxxxxRxRw6fxxxxRxRw6lWaa6aa66vuL
MD5 SHA1 SHA512 SSDEEP

Submit Download

pthreadGC2.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\pthreadGC2.dll
Size 68KB
SHA256 72e6c8dd77fa7e10a7b05ef6c3e21d3f7e4147301b0bf6e416b2d33d4e19a9c3
MD5 6f346d712c867cf942d6b599adb61081
SHA1 24d942dfc2d0c7256c50b80204bb30f0d98b887a
SHA512 1f95a211d5dd3e58d4e2682f6bf2c5380b230e9907e2882097b77b99520cd2c788f43ad2abcce617dd8ded0043e4ef1c8b6e083c44688b23109868e6cdd2364c
SSDEEP 1536:C+Sg9oMF5bqgRePiHyYelXevOzWAPehIt2uhZD:C49oI5bqliHyYcudAPehIt2Q5
MD5 SHA1 SHA512 SSDEEP

Submit Download

pthreadVC2.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\pthreadVC2.dll
Size 44KB
SHA256 ee15e6e3f82c48461eb638c1ea11019ae9e3e303e067e879115c6272139026e7
MD5 54aeddc619eed2faeee9533d58f778b9
SHA1 ca9d723b87e0c688450b34f2a606c957391fbbf4
SHA512 7cec39f32804109b3d502027d1ec42a594c1e4a2d93512195c60bd41aad7e32a8b0eb21a0ee859fecb403ee939eebc4608d9d27a4002b8c282de32f696136506
SSDEEP 384:W6E5etE/YrPfUMH+R/6NNzRUOI0havjIAGRdqMKHWjFYeOphngA9iHy2J0+:WpI+/QfU3N6NNR/atUfid9iHyY0+
MD5 SHA1 SHA512 SSDEEP

Submit Download

swresample-0.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\swresample-0.dll
Size 101KB
SHA256 d179c01c646d821cf745ae5e66ffc7ed394a61a595ecc2bccf27dc144ba91a2c
MD5 77bceb240f65c91d26299a334a0cf8e1
SHA1 de9d588a25252d9660fe0247508eadfa6f8a7834
SHA512 b380b592c39fd22302fc4a36aa6f773a79253230f0dd73ad129500654dbdf24c5a0b0ae3b2a4ffd762da4f9705a0c8e48ad4372d85cdb6271c5d3f315c82a281
SSDEEP 3072:qxSmku/WFRj1jqPgBUmLnMw+OC7l+NTvZ0:mSmkRFxE/Aw4Tm
MD5 SHA1 SHA512 SSDEEP

Submit Download

swscale-2.dll

Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20240413234112842\swscale-2.dll
Size 490KB
SHA256 4f17b1ceea162390f64f54a3d13de4bb9e553da1e51ae7061545b7843ddad9ca
MD5 2985c39796fb4a5f4357a1a7a134ad45
SHA1 305dc537a03e0137a529dc30bfd2fc6c185402a3
SHA512 4764dbf01defe417d587adbee16901bf374e0548d4a00f4f977f058dbe00c54712fd25162e1bf1986b55521cc2f005e7ed8e78db15e6cabfddc6b6924ec423b8
SSDEEP 6144:gQW0ZFEpf1cIwAn2iBn5iCnFibtjFqBXkNzlfqS9BcGWxcjxQzPkoTMkcOpeGNVA:JtxqBXkNBqSAxexBGNVXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\gs_787D.tmp\7z.dll
Size 722KB
SHA256 6065b1c94e7706afca52412a4cda6fb52f735a3ff5a4e367c1f62bfcde46f286
MD5 598e5b4ad775a5397183f14fb58d420f
SHA1 f0ca1ea4ca682449c48183f461049ad414dd2f3f
SHA512 a9470db9c291bb2dfdb324816681b7bd84e11a58aa066ab326ed896ced9eb7b3ec0d475859d1c0be92f2ae072ead2b7234c959bc460988b95e134b498eb3d690
SSDEEP 12288:FCR0sfbz8QwSOh+PBFayDTAZju0sBdZ7ATm8zIZ:F9GX8JSOM5FayDTAZa0GdZ7G9EZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gsMultimedia.exe

Path C:\Users\Admin\AppData\Local\Temp\gs_787D.tmp\gsMultimedia.exe
Size 209KB
SHA256 c9a02bf16d0222e6534dc8f5ed6af8efc9ed53c5834be79fcc741500a192e624
MD5 67219427b048aa97437a78cde1489f99
SHA1 33754bfaa801c545111af369adaa306f7c0618bb
SHA512 2960f76d354495dd20567e061ba846eb8ece76e454d380b24bc2970b7a2d727ef6cf25069de3efa7897520db8bc1ebc5049ae38289bf7ad8b6f2d7c16aea6d9c
SSDEEP 6144:S7IWhoLUgH5CfHrU+d2rYF+GPcKaYhtCbh/DWpPvWrVk5+:7WhoTZCTU+d2rYF+GPcKaYhtCbh/DWpe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4964-327-0x00000000070D0000-0x00000000070EA000-memory.dmp

Download

memory/4964-353-0x0000000073F10000-0x000000007421E000-memory.dmp

Download

memory/4964-0-0x0000000001C60000-0x0000000001C61000-memory.dmp

Download

memory/4964-352-0x0000000073030000-0x0000000073ED8000-memory.dmp

Download

memory/4964-321-0x0000000006E70000-0x0000000006E89000-memory.dmp

Download

memory/4964-316-0x0000000006E50000-0x0000000006E5B000-memory.dmp

Download

memory/4964-319-0x0000000006E60000-0x0000000006E70000-memory.dmp

Download

memory/4964-354-0x0000000074220000-0x00000000743AE000-memory.dmp

Download

memory/4964-371-0x0000000000400000-0x0000000001554000-memory.dmp

Download

memory/4964-373-0x00000000743B0000-0x000000007443B000-memory.dmp

Download

memory/4964-372-0x0000000074440000-0x00000000744AA000-memory.dmp

Download

memory/4964-376-0x0000000073EE0000-0x0000000073F03000-memory.dmp

Download

memory/4964-378-0x0000000072F60000-0x0000000072F97000-memory.dmp

Download

memory/4964-389-0x0000000001C60000-0x0000000001C61000-memory.dmp

Download

memory/4964-417-0x0000000000400000-0x0000000001554000-memory.dmp

Download

memory/4964-435-0x0000000000400000-0x0000000001554000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads