Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 18:18
Static task
static1
Behavioral task
behavioral1
Sample
071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe
Resource
win10v2004-20240226-en
General
-
Target
071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe
-
Size
1.3MB
-
MD5
45dea3bf310ef514b1d42ba895ce4185
-
SHA1
8d3e89e604bdb74d972499ec2d4fb20840324b1e
-
SHA256
071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47
-
SHA512
68dd5bb3ee75254228e443b0d1a4d0fff4b2ca375dbbffd3cba785a283a57ff1d9b9c231071c4654f13142c59f03964eca486b838a29acb71369a4a81530c8f2
-
SSDEEP
24576:lq8WN1SHaJX2jMAs/DkWSGEmI5xov5NJlOeBKdK4di3Oo55:+Ns6cwzbkWSjHQNJCZ6O2
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 20 IoCs
resource yara_rule behavioral2/memory/4488-12-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3244-19-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-105-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4488-107-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3244-112-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4484-113-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-115-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-140-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-168-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-172-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-188-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-194-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-210-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-214-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-218-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-222-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-226-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-230-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-235-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5116-241-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral2/memory/5116-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/files/0x0007000000023219-5.dat UPX behavioral2/memory/4488-12-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3244-19-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-105-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/4488-107-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3244-112-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/4484-113-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-115-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-140-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-168-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-172-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-188-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-194-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-210-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-214-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-218-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-222-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-226-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-230-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-235-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5116-241-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\J: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\L: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\O: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\A: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\B: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\G: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\H: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\Q: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\T: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\U: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\V: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\N: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\W: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\X: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\Z: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\E: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\Y: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\S: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\K: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\M: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\P: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File opened (read-only) \??\R: 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\LogFiles\Fax\Incoming\bukkake uncut titts upskirt .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\sperm [free] upskirt .zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\config\systemprofile\indian handjob horse [bangbus] (Liz).mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\FxsTmp\black action bukkake licking (Sylvia).avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\IME\SHARED\danish handjob gay voyeur hole .mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\System32\DriverStore\Temp\swedish kicking beast public feet (Sonja,Sylvia).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\FxsTmp\french beast uncut glans (Kathrin,Karin).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\IME\SHARED\lingerie public (Sarah).mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lingerie voyeur glans castration .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\japanese fetish horse catfight feet .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\config\systemprofile\american kicking gay sleeping sm .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\indian kicking lesbian masturbation feet swallow .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Templates\bukkake lesbian titts ejaculation .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\beast [bangbus] glans penetration .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\Microsoft Office\Updates\Download\xxx sleeping cock castration (Melissa).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\american nude xxx licking hole girly .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files (x86)\Google\Update\Download\brasilian horse beast several models titts shower (Tatjana).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\xxx licking traffic (Ashley,Liz).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish cumshot gay [milf] .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\bukkake [bangbus] shower (Sonja,Tatjana).avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\horse fucking big .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files (x86)\Google\Temp\indian porn horse girls glans mature .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fucking masturbation (Sylvia).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\beast uncut stockings .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\black cum beast licking fishy (Jenna,Sarah).rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\Common Files\microsoft shared\tyrkish cumshot sperm sleeping cock .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\dotnet\shared\swedish animal sperm lesbian balls .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\swedish porn lingerie hot (!) (Sarah).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\swedish horse trambling uncut .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\cum fucking big black hairunshaved .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\russian cumshot lingerie several models fishy (Gina,Melissa).mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\canadian sperm voyeur hole .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\action xxx public mistress .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\kicking trambling several models (Melissa).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\french hardcore uncut .zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\norwegian beast [milf] ash .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\Downloaded Program Files\fucking uncut .zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\cum sperm masturbation redhair .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\japanese animal trambling public glans black hairunshaved .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\security\templates\black animal sperm uncut (Janette).avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\danish porn lingerie [bangbus] titts shoes (Melissa).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\swedish horse hardcore hidden glans .zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\african trambling public titts .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\french hardcore voyeur glans sm (Samantha).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\bukkake public .zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\african bukkake lesbian pregnant .mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\norwegian blowjob sleeping cock femdom (Tatjana).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\french bukkake girls feet .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\spanish beast uncut .zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\fetish sperm voyeur swallow .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\gang bang bukkake girls castration .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\bukkake voyeur bedroom .mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\handjob sperm public bedroom (Sandy,Karin).avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\japanese action bukkake hidden hairy (Anniston,Tatjana).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish fetish horse several models cock bondage (Janette).rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\indian fetish trambling masturbation lady .zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\porn fucking public redhair .mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\handjob bukkake lesbian (Sylvia).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\horse full movie black hairunshaved .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\porn hardcore uncut .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\indian handjob beast voyeur granny .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\sperm girls glans boots (Janette).mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\canadian trambling several models glans sweet (Liz).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\tyrkish cumshot bukkake voyeur titts castration .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\german trambling [free] traffic .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\cum trambling several models .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\japanese beastiality trambling hidden .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\PLA\Templates\xxx [milf] (Sarah).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\indian kicking lesbian girls hole mature (Sylvia).rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\russian gang bang horse catfight glans redhair (Liz).mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\horse fucking public stockings .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\chinese horse voyeur granny .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\spanish xxx public hole ash .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian nude bukkake full movie titts 40+ .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\norwegian beast catfight (Jade).mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\american porn fucking masturbation .mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\xxx uncut hole femdom .avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\french gay masturbation cock .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\animal trambling masturbation sweet .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\swedish nude bukkake hot (!) .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\trambling sleeping (Janette).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\italian horse hardcore [free] (Jade).rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian action beast hidden titts circumcision (Karin).avi.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\french trambling masturbation cock .mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\horse sleeping cock .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\beast [bangbus] .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\handjob hardcore [milf] ejaculation .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\blowjob voyeur feet hairy .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\danish horse xxx hot (!) titts castration .zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\black fetish sperm licking hole .mpg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\black action blowjob big feet sweet .rar.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\cum sperm [free] cock beautyfull .mpeg.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\tyrkish fetish fucking uncut glans young (Sylvia).zip.exe 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4484 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 3244 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5116 wrote to memory of 4488 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 88 PID 5116 wrote to memory of 4488 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 88 PID 5116 wrote to memory of 4488 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 88 PID 5116 wrote to memory of 3244 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 90 PID 5116 wrote to memory of 3244 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 90 PID 5116 wrote to memory of 3244 5116 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 90 PID 4488 wrote to memory of 4484 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 91 PID 4488 wrote to memory of 4484 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 91 PID 4488 wrote to memory of 4484 4488 071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe"C:\Users\Admin\AppData\Local\Temp\071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe"C:\Users\Admin\AppData\Local\Temp\071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe"C:\Users\Admin\AppData\Local\Temp\071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
-
C:\Users\Admin\AppData\Local\Temp\071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe"C:\Users\Admin\AppData\Local\Temp\071a6ba731e471b6c758950a6bb4cbd03e06fca60fe6bed139255f53e977fa47.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish cumshot gay [milf] .rar.exe
Filesize1.4MB
MD53cfa04cdd9d4316a31621588210b6150
SHA1498c5587030583194ef99aee29ca57d32cdb4e68
SHA25661e0a0aae92b5c291bcd5085216c7b95ac9654c8c66cf7a749b5249af01b0dbc
SHA51249547e68488278c9030243c6d26264df32742169fb4510c641300a804fe8ba065858348d7ac92e37b4b624d0521c0026e4644e9c3987895ddfd56acef5967a88