751921f0f6a5d789ae6437b9b53d78eddc04dfe1323cdd95bd9b5364c49d9311

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 19:40 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a06bb29952757ab89bb22e7ad7ec0f6e.exe
Size

389KB
MD5

a06bb29952757ab89bb22e7ad7ec0f6e
SHA1

f531ad38737cd2b92452595d3937c640eee02144
SHA256

751921f0f6a5d789ae6437b9b53d78eddc04dfe1323cdd95bd9b5364c49d9311
SHA512

75405d1d19b02dc895be7afe7b5b65ec87711dceecdd2d8d9c9dc39f2d44621f79edeaf50a73ed7cfc18bf89a48f9795f3acb493a852424685fd6374083648b3
SSDEEP

6144:hBk/Zml2Rxs3NBBUKs7HCC1Nbw0Z8ddzyzC/shoX1I1fxTADds4pK97Z:hBai9BKKQt9udIz9h26xTsdq7Z

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	a06bb29952757ab89bb22e7ad7ec0f6e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	a06bb29952757ab89bb22e7ad7ec0f6e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	a06bb29952757ab89bb22e7ad7ec0f6e.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\H:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\O:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\W:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\Y:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\B:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\M:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\N:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\P:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\Q:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\R:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\Z:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\A:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\I:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\U:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\V:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\X:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\E:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\J:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\K:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\L:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\S:	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File opened (read-only)	\??\T:	a06bb29952757ab89bb22e7ad7ec0f6e.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IME\SHARED\japanese fetish gay uncut hole .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\config\systemprofile\american porn xxx lesbian (Curtney).avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\FxsTmp\animal lingerie licking .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\IME\SHARED\indian fetish xxx hidden black hairunshaved (Sonja,Karin).rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\sperm girls high heels .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\FxsTmp\fucking hot (!) bondage .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\xxx [milf] latex .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\hardcore hot (!) bondage .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\System32\DriverStore\Temp\beast public .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\japanese animal beast voyeur cock castration (Sylvia).zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\bukkake lesbian cock .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SysWOW64\config\systemprofile\blowjob masturbation titts .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Templates\swedish handjob gay girls cock (Sonja,Karin).mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black fetish sperm girls titts traffic .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\tyrkish kicking blowjob sleeping cock .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\swedish horse fucking sleeping .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\dotnet\shared\horse catfight .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files (x86)\Microsoft\Temp\hardcore full movie .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\american animal sperm licking .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\fetish beast voyeur mistress .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\danish handjob gay several models stockings .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\russian cumshot xxx catfight cock blondie (Melissa).rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\Common Files\microsoft shared\fucking big .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\japanese gang bang beast big black hairunshaved .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\lesbian licking circumcision .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\italian horse bukkake [milf] glans gorgeoushorny .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\sperm girls .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files (x86)\Google\Temp\lingerie uncut cock bedroom .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files (x86)\Google\Update\Download\russian cumshot lingerie catfight titts .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian horse bukkake public Ôï .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\malaysia lingerie voyeur high heels .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\tyrkish fetish gay lesbian titts .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\french lesbian several models titts shoes .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\chinese fucking [bangbus] .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\italian fetish trambling girls (Jade).mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\french trambling [free] high heels (Sonja,Liz).zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\cumshot fucking uncut .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\security\templates\russian animal beast voyeur Ôï (Jenna,Curtney).avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\swedish horse gay licking glans .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\fucking [free] hole gorgeoushorny .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\trambling catfight glans (Sonja,Sylvia).mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\cumshot hardcore sleeping feet .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\japanese animal blowjob several models .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\black nude trambling uncut glans (Ashley,Melissa).mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\trambling big feet 40+ .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\canadian blowjob masturbation (Sylvia).mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\action lesbian full movie ash .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\fucking sleeping young (Kathrin,Jade).zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\gang bang horse uncut cock .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\german horse sleeping .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\PLA\Templates\american kicking xxx big hole .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\black action gay hidden feet traffic .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\danish handjob xxx masturbation .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\british lingerie catfight 50+ (Sonja,Janette).mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\italian action hardcore licking wifey .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\Temp\german gay uncut .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\trambling girls .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\trambling [bangbus] Ôï .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\kicking sperm full movie shoes .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\italian cumshot hardcore several models (Janette).mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\spanish beast sleeping shower .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\action blowjob voyeur cock .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\norwegian beast big .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\french xxx [free] feet (Kathrin,Karin).rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\InstallTemp\horse trambling public circumcision .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\german fucking girls granny .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\black horse hardcore sleeping gorgeoushorny (Britney,Janette).rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\african fucking catfight hole .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\russian beastiality blowjob sleeping mature .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\norwegian beast [milf] .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\japanese kicking xxx sleeping sweet .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\russian animal lesbian lesbian titts upskirt .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\malaysia xxx licking .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\horse hot (!) titts circumcision .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\brasilian gang bang lingerie hot (!) .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\lesbian catfight titts hairy .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\indian action xxx [bangbus] titts femdom (Tatjana).mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\danish nude bukkake voyeur .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\cum blowjob big (Liz).mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\french gay catfight glans bedroom .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\horse hardcore catfight titts .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\trambling uncut glans .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\cumshot trambling big (Janette).avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\cum sperm hot (!) feet balls (Jade).zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\norwegian bukkake public glans leather .mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\swedish handjob blowjob voyeur .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\japanese beastiality beast several models feet blondie .mpeg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\french xxx [milf] .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\danish animal blowjob full movie glans .avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\sperm girls high heels (Gina,Sylvia).zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\asian hardcore several models feet bondage .rar.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\german trambling voyeur titts .zip.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\canadian fucking full movie (Melissa).avi.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe
File created	C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\xxx hidden hole hotel (Sarah).mpg.exe	a06bb29952757ab89bb22e7ad7ec0f6e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe
4340	a06bb29952757ab89bb22e7ad7ec0f6e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2732	1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe	89
PID 1724 wrote to memory of 2732	1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe	89
PID 1724 wrote to memory of 2732	1724	a06bb29952757ab89bb22e7ad7ec0f6e.exe	89
PID 2732 wrote to memory of 4340	2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe	90
PID 2732 wrote to memory of 4340	2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe	90
PID 2732 wrote to memory of 4340	2732	a06bb29952757ab89bb22e7ad7ec0f6e.exe	90

C:\Users\Admin\AppData\Local\Temp\a06bb29952757ab89bb22e7ad7ec0f6e.exe
"C:\Users\Admin\AppData\Local\Temp\a06bb29952757ab89bb22e7ad7ec0f6e.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\a06bb29952757ab89bb22e7ad7ec0f6e.exe
  "C:\Users\Admin\AppData\Local\Temp\a06bb29952757ab89bb22e7ad7ec0f6e.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\a06bb29952757ab89bb22e7ad7ec0f6e.exe
    "C:\Users\Admin\AppData\Local\Temp\a06bb29952757ab89bb22e7ad7ec0f6e.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4340

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.a-0001.a-msedge.net

g-bing-com.a-0001.a-msedge.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=3690F6E44445600C23C9E2C845FE610C; domain=.bing.com; expires=Mon, 17-Mar-2025 19:42:02 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F90F22F98A48412A8046CD645E583CCB Ref B: LON04EDGE0810 Ref C: 2024-02-21T19:42:02Z
date: Wed, 21 Feb 2024 19:42:01 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3690F6E44445600C23C9E2C845FE610C

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=gWZj1OqPZwcrJMuV9OgdXW0zJBLYmpii13mYhsDvP5k; domain=.bing.com; expires=Mon, 17-Mar-2025 19:42:02 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 662740FE1C3D48CE871EFF7F487941E2 Ref B: LON04EDGE0810 Ref C: 2024-02-21T19:42:02Z
date: Wed, 21 Feb 2024 19:42:01 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

Remote address:

204.79.197.200:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3690F6E44445600C23C9E2C845FE610C; MSPTC=gWZj1OqPZwcrJMuV9OgdXW0zJBLYmpii13mYhsDvP5k

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F6113CB13AC74D549294467033005233 Ref B: LON04EDGE0810 Ref C: 2024-02-21T19:42:02Z
date: Wed, 21 Feb 2024 19:42:01 GMT
DNS

25.63.96.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

25.63.96.20.in-addr.arpa

IN PTR

Response
DNS

23.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.159.190.20.in-addr.arpa

IN PTR

Response
DNS

41.110.16.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.110.16.96.in-addr.arpa

IN PTR

Response

41.110.16.96.in-addr.arpa

IN PTR

a96-16-110-41deploystaticakamaitechnologiescom
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

241.154.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.154.82.20.in-addr.arpa

IN PTR

Response
DNS

238.186.251.186.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.186.251.186.in-addr.arpa

IN PTR

Response
DNS

62.161.28.156.in-addr.arpa

Remote address:

8.8.8.8:53

Request

62.161.28.156.in-addr.arpa

IN PTR

Response
DNS

62.161.28.156.in-addr.arpa

Remote address:

8.8.8.8:53

Request

62.161.28.156.in-addr.arpa

IN PTR

Response
DNS

62.161.28.156.in-addr.arpa

Remote address:

8.8.8.8:53

Request

62.161.28.156.in-addr.arpa

IN PTR
DNS

130.107.245.164.in-addr.arpa

Remote address:

8.8.8.8:53

Request

130.107.245.164.in-addr.arpa

IN PTR

Response
DNS

100.132.43.218.in-addr.arpa

Remote address:

8.8.8.8:53

Request

100.132.43.218.in-addr.arpa

IN PTR

Response

100.132.43.218.in-addr.arpa

IN PTR

p204100-ipngn200502osakachuoosakaocnnejp
DNS

100.132.43.218.in-addr.arpa

Remote address:

8.8.8.8:53

Request

100.132.43.218.in-addr.arpa

IN PTR
DNS

100.132.43.218.in-addr.arpa

Remote address:

8.8.8.8:53

Request

100.132.43.218.in-addr.arpa

IN PTR
DNS

100.132.43.218.in-addr.arpa

Remote address:

8.8.8.8:53

Request

100.132.43.218.in-addr.arpa

IN PTR
DNS

21.118.216.205.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.118.216.205.in-addr.arpa

IN PTR

Response
DNS

33.221.118.136.in-addr.arpa

Remote address:

8.8.8.8:53

Request

33.221.118.136.in-addr.arpa

IN PTR

Response
DNS

22.202.44.74.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.202.44.74.in-addr.arpa

IN PTR

Response

22.202.44.74.in-addr.arpa

IN PTR

74-44-202-22dsl1ekgvcafrontiernetnet
DNS

145.6.160.163.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.6.160.163.in-addr.arpa

IN PTR

Response
DNS

145.6.160.163.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.6.160.163.in-addr.arpa

IN PTR

Response
DNS

246.21.173.197.in-addr.arpa

Remote address:

8.8.8.8:53

Request

246.21.173.197.in-addr.arpa

IN PTR

Response
DNS

37.130.176.240.in-addr.arpa

Remote address:

8.8.8.8:53

Request

37.130.176.240.in-addr.arpa

IN PTR

Response
DNS

150.57.49.90.in-addr.arpa

Remote address:

8.8.8.8:53

Request

150.57.49.90.in-addr.arpa

IN PTR

Response

150.57.49.90.in-addr.arpa

IN PTR

lfbn-nan-1-210-150w90-49abowanadoofr
DNS

187.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

187.178.17.96.in-addr.arpa

IN PTR

Response

187.178.17.96.in-addr.arpa

IN PTR

a96-17-178-187deploystaticakamaitechnologiescom
DNS

22.120.218.176.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.120.218.176.in-addr.arpa

IN PTR

Response
DNS

22.163.230.226.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.163.230.226.in-addr.arpa

IN PTR

Response
DNS

28.128.243.108.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.128.243.108.in-addr.arpa

IN PTR

Response

28.128.243.108.in-addr.arpa

IN PTR

108-243-128-28 lightspeedknvltn sbcglobalnet
DNS

120.228.108.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

120.228.108.192.in-addr.arpa

IN PTR

Response
DNS

120.228.108.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

120.228.108.192.in-addr.arpa

IN PTR

Response
DNS

120.228.108.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

120.228.108.192.in-addr.arpa

IN PTR
DNS

197.178.250.41.in-addr.arpa

Remote address:

8.8.8.8:53

Request

197.178.250.41.in-addr.arpa

IN PTR

Response
DNS

9.122.101.210.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.122.101.210.in-addr.arpa

IN PTR

Response
DNS

112.190.175.167.in-addr.arpa

Remote address:

8.8.8.8:53

Request

112.190.175.167.in-addr.arpa

IN PTR

Response
DNS

199.31.97.166.in-addr.arpa

Remote address:

8.8.8.8:53

Request

199.31.97.166.in-addr.arpa

IN PTR

Response
DNS

199.31.97.166.in-addr.arpa

Remote address:

8.8.8.8:53

Request

199.31.97.166.in-addr.arpa

IN PTR

Response
DNS

10.225.25.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.225.25.87.in-addr.arpa

IN PTR

Response

10.225.25.87.in-addr.arpa

IN PTR

host-87-25-225-10business telecomitaliait
DNS

5.143.204.158.in-addr.arpa

Remote address:

8.8.8.8:53

Request

5.143.204.158.in-addr.arpa

IN PTR

Response
DNS

36.253.1.62.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.253.1.62.in-addr.arpa

IN PTR

Response

36.253.1.62.in-addr.arpa

IN PTR

62125336dsldynforthnetgr
DNS

36.253.1.62.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.253.1.62.in-addr.arpa

IN PTR
DNS

91.153.229.193.in-addr.arpa

Remote address:

8.8.8.8:53

Request

91.153.229.193.in-addr.arpa

IN PTR

Response

91.153.229.193.in-addr.arpa

IN PTR

kb91u4heldialkolumbusfi
DNS

224.178.7.111.in-addr.arpa

Remote address:

8.8.8.8:53

Request

224.178.7.111.in-addr.arpa

IN PTR

Response
DNS

48.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.229.111.52.in-addr.arpa

IN PTR

Response
DNS

222.181.206.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

222.181.206.2.in-addr.arpa

IN PTR

Response

222.181.206.2.in-addr.arpa

IN PTR

dslb-002-206-181-222002206poolsvodafone-ipde
DNS

6.201.226.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

6.201.226.91.in-addr.arpa

IN PTR

Response

6.201.226.91.in-addr.arpa

IN PTR

dns1xatnetua
DNS

6.201.226.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

6.201.226.91.in-addr.arpa

IN PTR

Response

6.201.226.91.in-addr.arpa

IN PTR

dns1xatnetua
DNS

247.220.224.178.in-addr.arpa

Remote address:

8.8.8.8:53

Request

247.220.224.178.in-addr.arpa

IN PTR

Response
DNS

44.142.165.211.in-addr.arpa

Remote address:

8.8.8.8:53

Request

44.142.165.211.in-addr.arpa

IN PTR

Response
DNS

81.14.224.114.in-addr.arpa

Remote address:

8.8.8.8:53

Request

81.14.224.114.in-addr.arpa

IN PTR

Response
DNS

234.98.186.254.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.98.186.254.in-addr.arpa

IN PTR

Response
DNS

234.98.186.254.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.98.186.254.in-addr.arpa

IN PTR
DNS

46.99.102.7.in-addr.arpa

Remote address:

8.8.8.8:53

Request

46.99.102.7.in-addr.arpa

IN PTR

Response
DNS

254.100.170.109.in-addr.arpa

Remote address:

8.8.8.8:53

Request

254.100.170.109.in-addr.arpa

IN PTR

Response
DNS

169.175.80.161.in-addr.arpa

Remote address:

8.8.8.8:53

Request

169.175.80.161.in-addr.arpa

IN PTR

Response

169.175.80.161.in-addr.arpa

IN CNAME

255.255.80.161.in-addr.arpa

255.255.80.161.in-addr.arpa

IN PTR

unassignedepagov
DNS

136.231.37.213.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.231.37.213.in-addr.arpa

IN PTR

Response

136.231.37.213.in-addr.arpa

IN PTR

21337231136dynuseronocom
DNS

36.76.114.222.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.76.114.222.in-addr.arpa

IN PTR

Response
DNS

88.109.210.145.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.109.210.145.in-addr.arpa

IN PTR

Response

88.109.210.145.in-addr.arpa

IN PTR

145210EARLY-REGISTRATIONofSURFnetinvalid
DNS

192.3.37.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

192.3.37.40.in-addr.arpa

IN PTR

Response
DNS

192.3.37.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

192.3.37.40.in-addr.arpa

IN PTR

Response
DNS

99.202.209.33.in-addr.arpa

Remote address:

8.8.8.8:53

Request

99.202.209.33.in-addr.arpa

IN PTR

Response
DNS

28.239.85.11.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.239.85.11.in-addr.arpa

IN PTR

Response
DNS

179.41.62.84.in-addr.arpa

Remote address:

8.8.8.8:53

Request

179.41.62.84.in-addr.arpa

IN PTR

Response

179.41.62.84.in-addr.arpa

IN PTR

dslb-084-062-041-179084062poolsvodafone-ipde
DNS

99.178.217.60.in-addr.arpa

Remote address:

8.8.8.8:53

Request

99.178.217.60.in-addr.arpa

IN PTR

Response
DNS

105.152.98.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

105.152.98.52.in-addr.arpa

IN PTR

Response
DNS

220.8.35.76.in-addr.arpa

Remote address:

8.8.8.8:53

Request

220.8.35.76.in-addr.arpa

IN PTR

Response

220.8.35.76.in-addr.arpa

IN PTR

076-035-008-220infspectrumcom
DNS

96.248.147.225.in-addr.arpa

Remote address:

8.8.8.8:53

Request

96.248.147.225.in-addr.arpa

IN PTR

Response
DNS

236.21.186.235.in-addr.arpa

Remote address:

8.8.8.8:53

Request

236.21.186.235.in-addr.arpa

IN PTR

Response
DNS

81.217.158.196.in-addr.arpa

Remote address:

8.8.8.8:53

Request

81.217.158.196.in-addr.arpa

IN PTR

Response
DNS

224.23.113.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

224.23.113.199.in-addr.arpa

IN PTR

Response
DNS

113.176.82.118.in-addr.arpa

Remote address:

8.8.8.8:53

Request

113.176.82.118.in-addr.arpa

IN PTR

Response
DNS

131.36.125.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

131.36.125.23.in-addr.arpa

IN PTR

Response

131.36.125.23.in-addr.arpa

IN PTR

23-125-36-131 lightspeedclmboh sbcglobalnet
DNS

192.60.147.137.in-addr.arpa

Remote address:

8.8.8.8:53

Request

192.60.147.137.in-addr.arpa

IN PTR

Response

192.60.147.137.in-addr.arpa

IN PTR

cpe-137-147-60-192 bpjl-r-037lonvicbigpondnetau
DNS

79.98.40.139.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.98.40.139.in-addr.arpa

IN PTR

Response
DNS

213.138.89.98.in-addr.arpa

Remote address:

8.8.8.8:53

Request

213.138.89.98.in-addr.arpa

IN PTR

Response
DNS

78.128.251.227.in-addr.arpa

Remote address:

8.8.8.8:53

Request

78.128.251.227.in-addr.arpa

IN PTR

Response
DNS

73.218.163.200.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.218.163.200.in-addr.arpa

IN PTR

Response

73.218.163.200.in-addr.arpa

IN PTR

200-163-218-73user3p brasiltelecomnetbr

204.79.197.200:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

tls, http2

2.0kB
9.2kB
21
19

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=2f46589f05eb4d26997677a042bcea1c&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

HTTP Response

204

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

g.bing.com

dns

56 B
158 B
1
1

DNS Request

g.bing.com

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

25.63.96.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

25.63.96.20.in-addr.arpa
8.8.8.8:53

23.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

23.159.190.20.in-addr.arpa
8.8.8.8:53

41.110.16.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

41.110.16.96.in-addr.arpa
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

200.197.79.204.in-addr.arpa
8.8.8.8:53

241.154.82.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.154.82.20.in-addr.arpa
8.8.8.8:53

238.186.251.186.in-addr.arpa

dns

74 B
134 B
1
1

DNS Request

238.186.251.186.in-addr.arpa
8.8.8.8:53

62.161.28.156.in-addr.arpa

dns

216 B
144 B
3
2

DNS Request

62.161.28.156.in-addr.arpa

DNS Request

62.161.28.156.in-addr.arpa

DNS Request

62.161.28.156.in-addr.arpa
8.8.8.8:53

130.107.245.164.in-addr.arpa

dns

74 B
149 B
1
1

DNS Request

130.107.245.164.in-addr.arpa
8.8.8.8:53

100.132.43.218.in-addr.arpa

dns

292 B
131 B
4
1

DNS Request

100.132.43.218.in-addr.arpa

DNS Request

100.132.43.218.in-addr.arpa

DNS Request

100.132.43.218.in-addr.arpa

DNS Request

100.132.43.218.in-addr.arpa
8.8.8.8:53

21.118.216.205.in-addr.arpa

dns

73 B
148 B
1
1

DNS Request

21.118.216.205.in-addr.arpa
8.8.8.8:53

33.221.118.136.in-addr.arpa

dns

73 B
73 B
1
1

DNS Request

33.221.118.136.in-addr.arpa
8.8.8.8:53

22.202.44.74.in-addr.arpa

dns

71 B
126 B
1
1

DNS Request

22.202.44.74.in-addr.arpa
8.8.8.8:53

145.6.160.163.in-addr.arpa

dns

144 B
144 B
2
2

DNS Request

145.6.160.163.in-addr.arpa

DNS Request

145.6.160.163.in-addr.arpa
8.8.8.8:53

246.21.173.197.in-addr.arpa

dns

73 B
134 B
1
1

DNS Request

246.21.173.197.in-addr.arpa
8.8.8.8:53

37.130.176.240.in-addr.arpa

dns

73 B
141 B
1
1

DNS Request

37.130.176.240.in-addr.arpa
8.8.8.8:53

150.57.49.90.in-addr.arpa

dns

71 B
125 B
1
1

DNS Request

150.57.49.90.in-addr.arpa
8.8.8.8:53

187.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

187.178.17.96.in-addr.arpa
8.8.8.8:53

22.120.218.176.in-addr.arpa

dns

73 B
133 B
1
1

DNS Request

22.120.218.176.in-addr.arpa
8.8.8.8:53

22.163.230.226.in-addr.arpa

dns

73 B
130 B
1
1

DNS Request

22.163.230.226.in-addr.arpa
8.8.8.8:53

28.128.243.108.in-addr.arpa

dns

73 B
133 B
1
1

DNS Request

28.128.243.108.in-addr.arpa
8.8.8.8:53

120.228.108.192.in-addr.arpa

dns

222 B
148 B
3
2

DNS Request

120.228.108.192.in-addr.arpa

DNS Request

120.228.108.192.in-addr.arpa

DNS Request

120.228.108.192.in-addr.arpa
8.8.8.8:53

197.178.250.41.in-addr.arpa

dns

73 B
135 B
1
1

DNS Request

197.178.250.41.in-addr.arpa
8.8.8.8:53

9.122.101.210.in-addr.arpa

dns

72 B
130 B
1
1

DNS Request

9.122.101.210.in-addr.arpa
8.8.8.8:53

112.190.175.167.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

112.190.175.167.in-addr.arpa
8.8.8.8:53

199.31.97.166.in-addr.arpa

dns

144 B
144 B
2
2

DNS Request

199.31.97.166.in-addr.arpa

DNS Request

199.31.97.166.in-addr.arpa
8.8.8.8:53

10.225.25.87.in-addr.arpa

dns

71 B
128 B
1
1

DNS Request

10.225.25.87.in-addr.arpa
8.8.8.8:53

5.143.204.158.in-addr.arpa

dns

72 B
126 B
1
1

DNS Request

5.143.204.158.in-addr.arpa
8.8.8.8:53

36.253.1.62.in-addr.arpa

dns

140 B
115 B
2
1

DNS Request

36.253.1.62.in-addr.arpa

DNS Request

36.253.1.62.in-addr.arpa
8.8.8.8:53

91.153.229.193.in-addr.arpa

dns

73 B
113 B
1
1

DNS Request

91.153.229.193.in-addr.arpa
8.8.8.8:53

224.178.7.111.in-addr.arpa

dns

72 B
154 B
1
1

DNS Request

224.178.7.111.in-addr.arpa
8.8.8.8:53

48.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

48.229.111.52.in-addr.arpa
8.8.8.8:53

222.181.206.2.in-addr.arpa

dns

72 B
135 B
1
1

DNS Request

222.181.206.2.in-addr.arpa
8.8.8.8:53

6.201.226.91.in-addr.arpa

dns

142 B
200 B
2
2

DNS Request

6.201.226.91.in-addr.arpa

DNS Request

6.201.226.91.in-addr.arpa
8.8.8.8:53

247.220.224.178.in-addr.arpa

dns

74 B
132 B
1
1

DNS Request

247.220.224.178.in-addr.arpa
8.8.8.8:53

44.142.165.211.in-addr.arpa

dns

73 B
73 B
1
1

DNS Request

44.142.165.211.in-addr.arpa
8.8.8.8:53

81.14.224.114.in-addr.arpa

dns

72 B
121 B
1
1

DNS Request

81.14.224.114.in-addr.arpa
8.8.8.8:53

234.98.186.254.in-addr.arpa

dns

146 B
141 B
2
1

DNS Request

234.98.186.254.in-addr.arpa

DNS Request

234.98.186.254.in-addr.arpa
8.8.8.8:53

46.99.102.7.in-addr.arpa

dns

70 B
138 B
1
1

DNS Request

46.99.102.7.in-addr.arpa
8.8.8.8:53

254.100.170.109.in-addr.arpa

dns

74 B
138 B
1
1

DNS Request

254.100.170.109.in-addr.arpa
8.8.8.8:53

169.175.80.161.in-addr.arpa

dns

73 B
127 B
1
1

DNS Request

169.175.80.161.in-addr.arpa
8.8.8.8:53

136.231.37.213.in-addr.arpa

dns

73 B
118 B
1
1

DNS Request

136.231.37.213.in-addr.arpa
8.8.8.8:53

36.76.114.222.in-addr.arpa

dns

72 B
133 B
1
1

DNS Request

36.76.114.222.in-addr.arpa
8.8.8.8:53

88.109.210.145.in-addr.arpa

dns

73 B
132 B
1
1

DNS Request

88.109.210.145.in-addr.arpa
8.8.8.8:53

192.3.37.40.in-addr.arpa

dns

140 B
140 B
2
2

DNS Request

192.3.37.40.in-addr.arpa

DNS Request

192.3.37.40.in-addr.arpa
8.8.8.8:53

99.202.209.33.in-addr.arpa

dns

72 B
145 B
1
1

DNS Request

99.202.209.33.in-addr.arpa
8.8.8.8:53

28.239.85.11.in-addr.arpa

dns

71 B
139 B
1
1

DNS Request

28.239.85.11.in-addr.arpa
8.8.8.8:53

179.41.62.84.in-addr.arpa

dns

71 B
134 B
1
1

DNS Request

179.41.62.84.in-addr.arpa
8.8.8.8:53

99.178.217.60.in-addr.arpa

dns

72 B
130 B
1
1

DNS Request

99.178.217.60.in-addr.arpa
8.8.8.8:53

105.152.98.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

105.152.98.52.in-addr.arpa
8.8.8.8:53

220.8.35.76.in-addr.arpa

dns

70 B
116 B
1
1

DNS Request

220.8.35.76.in-addr.arpa
8.8.8.8:53

96.248.147.225.in-addr.arpa

dns

73 B
130 B
1
1

DNS Request

96.248.147.225.in-addr.arpa
8.8.8.8:53

236.21.186.235.in-addr.arpa

dns

73 B
130 B
1
1

DNS Request

236.21.186.235.in-addr.arpa
8.8.8.8:53

81.217.158.196.in-addr.arpa

dns

73 B
134 B
1
1

DNS Request

81.217.158.196.in-addr.arpa
8.8.8.8:53

224.23.113.199.in-addr.arpa

dns

73 B
168 B
1
1

DNS Request

224.23.113.199.in-addr.arpa
8.8.8.8:53

113.176.82.118.in-addr.arpa

dns

73 B
161 B
1
1

DNS Request

113.176.82.118.in-addr.arpa
8.8.8.8:53

131.36.125.23.in-addr.arpa

dns

72 B
131 B
1
1

DNS Request

131.36.125.23.in-addr.arpa
8.8.8.8:53

192.60.147.137.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

192.60.147.137.in-addr.arpa
8.8.8.8:53

79.98.40.139.in-addr.arpa

dns

71 B
166 B
1
1

DNS Request

79.98.40.139.in-addr.arpa
8.8.8.8:53

213.138.89.98.in-addr.arpa

dns

72 B
126 B
1
1

DNS Request

213.138.89.98.in-addr.arpa
8.8.8.8:53

78.128.251.227.in-addr.arpa

dns

73 B
130 B
1
1

DNS Request

78.128.251.227.in-addr.arpa
8.8.8.8:53

73.218.163.200.in-addr.arpa

dns

73 B
129 B
1
1

DNS Request

73.218.163.200.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black fetish sperm girls titts traffic .zip.exe

Filesize
893KB

MD5
62eece5112b216b217f836441551528c

SHA1
2d0e2bc92703b67c8139751d19bd47ef7853e6dc

SHA256
270b458376ebf3db8a52f6c8f7746982c1a48826b0b674b53437b5338027fb59

SHA512
fee8feeb585b91050cee3129ba228129c49fcae3c60dd64773c0e10bc2f24aa38025a1faedccb06f3459183f3aa5c97af93099d18d44f47ee9d25da5a24166e6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request