Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
Resource
win10v2004-20240226-en
General
-
Target
0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
-
Size
425KB
-
MD5
1d18f9631b672a1ae46add784f948ad2
-
SHA1
865fb09938eb0d0448b64e4f9dfdd4f660bd5c22
-
SHA256
0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930
-
SHA512
ed3576b54774db6ac61a3b7b2011c8cede65b9e5b01b3983e5c52dc48ab5704b020120e3437e0ca0951950dede542c8764fb6898c3bb677e25c3e95c24a2868c
-
SSDEEP
6144:aDOxZXrSHXUTsmYAWPrY+03KuC2gFb7zD/vQMzqWkCEAydaHZ3kFe5RimDoD5Zrb:lXa8sKWPZvhDAJWFry85ue7iSoDrkS1f
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 18 IoCs
resource yara_rule behavioral2/memory/3384-11-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3292-12-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2336-41-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-42-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-126-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4252-130-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3292-132-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-159-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-176-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-180-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-186-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-204-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-209-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-212-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-216-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-220-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-224-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3384-229-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral2/memory/3384-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/files/0x00020000000227ea-5.dat UPX behavioral2/memory/3384-11-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3292-12-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2336-41-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-42-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-126-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/4252-130-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3292-132-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-159-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-176-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-180-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-186-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-204-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-209-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-212-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-216-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-220-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-224-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3384-229-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\X: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\I: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\J: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\M: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\R: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\L: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\P: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\Q: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\T: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\Y: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\A: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\B: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\N: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\W: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\O: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\U: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\V: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\Z: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\E: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\G: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\H: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File opened (read-only) \??\K: 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\fucking lesbian glans 50+ (Ashley).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beast [free] blondie .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\hardcore blowjob [bangbus] (Sylvia,Christine).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\config\systemprofile\action lesbian granny .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\norwegian animal lingerie uncut titts YEâPSè& (Karin,Janette).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\lesbian masturbation feet stockings .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\config\systemprofile\beastiality action sleeping ¼ë .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\FxsTmp\kicking full movie granny (Ashley).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\IME\SHARED\spanish horse nude girls ash .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\spanish lingerie [bangbus] bondage .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\FxsTmp\french blowjob cum girls titts 50+ .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SysWOW64\IME\SHARED\spanish beast full movie .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\malaysia animal cum [bangbus] traffic .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Google\Temp\canadian sperm bukkake [free] young .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Google\Update\Download\russian gang bang public YEâPSè& (Sonja).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Common Files\microsoft shared\spanish horse beastiality uncut vagina blondie .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Microsoft Office\Updates\Download\xxx full movie titts circumcision .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\blowjob uncut upskirt (Britney,Samantha).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\indian beastiality lesbian .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\nude action voyeur (Ashley).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Microsoft Office\root\Templates\chinese horse catfight .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish hardcore masturbation mistress .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\porn sleeping feet granny .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\indian blowjob sperm [milf] .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\handjob lesbian big .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Microsoft\Temp\bukkake gang bang voyeur hole latex .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian cumshot hardcore [bangbus] feet .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\dotnet\shared\tyrkish horse trambling [milf] stockings (Melissa).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\nude beast sleeping (Britney).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\tyrkish nude fetish public wifey (Melissa).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\american lingerie bukkake girls circumcision (Jenna).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\asian kicking hot (!) feet high heels .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\InputMethod\SHARED\african beast gang bang sleeping blondie .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\chinese beast hot (!) redhair .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\animal beastiality catfight .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\french fucking horse hidden boobs .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\spanish kicking public wifey .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\trambling hardcore several models sm .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\italian bukkake gang bang hot (!) lady (Samantha,Tatjana).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\nude hot (!) bondage .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\kicking [milf] lady .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\bukkake licking pregnant (Sandy,Samantha).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\american hardcore [milf] .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\gay cumshot hot (!) .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\kicking fetish masturbation ash .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\action [milf] shoes .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\russian animal [milf] boobs .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\porn kicking [free] pregnant (Britney).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\french sperm animal several models shower (Tatjana,Sylvia).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\fucking full movie penetration .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\fucking trambling [free] (Christine,Samantha).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\fucking sperm [milf] .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\japanese porn animal [free] high heels .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\french horse hidden .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\spanish bukkake public shoes .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\malaysia lesbian fucking catfight .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\black hardcore girls shower (Sonja).zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SoftwareDistribution\Download\bukkake fetish girls blondie .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\beastiality full movie bedroom .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\norwegian horse hot (!) titts circumcision .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\lingerie kicking masturbation hairy .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\temp\lesbian animal licking ash shower .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\danish porn lesbian boobs penetration .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\fetish big latex .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\british trambling public (Melissa).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\trambling girls femdom .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\brasilian sperm blowjob catfight 50+ .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\horse action [free] ash .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\british porn hardcore hidden gorgeoushorny .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\tyrkish blowjob beast sleeping .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\sperm lingerie lesbian .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\blowjob trambling sleeping .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\horse uncut nipples mature .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\fetish hardcore sleeping hole .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\italian action hidden sm .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\chinese gay porn licking .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\japanese kicking big hotel .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\fetish hidden vagina 50+ .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\beast nude [milf] sweet .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\cumshot handjob full movie (Sylvia,Curtney).mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\danish trambling bukkake sleeping 40+ .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\malaysia fetish horse public .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\assembly\tmp\norwegian cumshot public wifey .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\brasilian horse lesbian shoes .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\canadian trambling [free] bondage .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\chinese sperm full movie boobs hotel .avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\german kicking hot (!) hole (Jade).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\horse lesbian uncut legs wifey .mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\cum kicking [bangbus] .mpg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\porn lingerie catfight (Jenna).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\german nude blowjob full movie bedroom (Kathrin).mpeg.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\lesbian lesbian public granny (Liz,Kathrin).rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\lesbian public mature .zip.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\italian nude licking titts (Gina).avi.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\spanish nude horse several models .rar.exe 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 3292 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 4252 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3384 wrote to memory of 2336 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 96 PID 3384 wrote to memory of 2336 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 96 PID 3384 wrote to memory of 2336 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 96 PID 3384 wrote to memory of 4252 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 97 PID 3384 wrote to memory of 4252 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 97 PID 3384 wrote to memory of 4252 3384 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 97 PID 2336 wrote to memory of 3292 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 98 PID 2336 wrote to memory of 3292 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 98 PID 2336 wrote to memory of 3292 2336 0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
-
-
C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵PID:4308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish hardcore masturbation mistress .mpeg.exe
Filesize888KB
MD5570c8d81d9598a005d5161de45d8c03d
SHA19cf94f481bfb4522cbbabed7eeca803da9d6c63b
SHA256f6bcaac2584d7ceae9564ac94ff2999912e8f7b755c337a7ac2d0b672d3b6ce7
SHA5129d47560e089c4f5cffd1e44adcb06715401be8a207e6d35bd29e4a09b136de66f15dc038839cafa34c495316fb1478e290145f72ae0c64599f4416a2791e5cbc