Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 19:06
Behavioral task
behavioral1
Sample
1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe
Resource
win10v2004-20240226-en
General
-
Target
1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe
-
Size
372KB
-
MD5
350c6c97a34f7893e06c9f48b673488c
-
SHA1
3b0a97b004070bc78b877b6fd0400660599fb429
-
SHA256
1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09
-
SHA512
7222f00528ec07c9c16825f500b4ec3fe5562ed11d98400666ff4455db6ad8fecddb650ae1ee476ee5f69fe6aea7a0a99a6a1a4803de6cc909884eff6cb93f76
-
SSDEEP
6144:JjluyDM3Io5R4nM/40yJNkzj7pX2ZKjC2mzvXfbdyrE+NxRTv8lDWyIqiNlB4Rke:JEyDMhqhibpDC2mjXfZ+N3wpiNlCknI
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 18 IoCs
resource yara_rule behavioral2/memory/1272-144-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1944-164-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4804-183-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4144-184-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-185-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-186-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-190-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-203-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-208-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-212-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-218-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-228-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-232-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-236-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-240-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-244-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-249-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1272-253-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral2/memory/1272-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/files/0x000800000002322a-5.dat UPX behavioral2/memory/1272-144-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1944-164-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4804-183-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4144-184-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-185-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-186-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-190-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-203-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-208-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-212-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-218-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-228-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-232-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-236-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-240-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-244-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-249-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1272-253-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1272-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x000800000002322a-5.dat upx behavioral2/memory/1272-144-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1944-164-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4804-183-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4144-184-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-185-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-186-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-190-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-203-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-208-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-212-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-218-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-228-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-232-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-236-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-240-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-244-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-249-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1272-253-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\U: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\A: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\L: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\N: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\R: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\X: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\Y: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\B: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\J: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\K: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\Q: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\S: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\T: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\H: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\I: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\O: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\V: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\W: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\Z: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\E: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\G: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File opened (read-only) \??\M: 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\black nude blowjob girls .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\config\systemprofile\russian handjob lesbian several models hole hotel .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\System32\DriverStore\Temp\brasilian kicking blowjob [free] penetration .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\FxsTmp\russian action beast voyeur (Samantha).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\brasilian gang bang blowjob big shower .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\FxsTmp\indian kicking sperm uncut boots .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\IME\SHARED\horse uncut castration .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lingerie public hole high heels .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\IME\SHARED\american cum bukkake big (Melissa).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beast several models titts shower .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\indian animal lesbian girls (Jade).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SysWOW64\config\systemprofile\brasilian beastiality gay uncut .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\hardcore licking high heels .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Google\Update\Download\italian action lesbian [milf] cock .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\italian cumshot trambling uncut upskirt .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian animal gay hot (!) beautyfull .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Google\Temp\fucking licking (Melissa).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Microsoft Office\root\Templates\italian beastiality horse hidden hole traffic .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\blowjob big glans ash (Janette).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Microsoft Office\Updates\Download\italian handjob lesbian hidden balls .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\black kicking bukkake uncut (Samantha).mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\fetish blowjob catfight titts .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\black beastiality hardcore big glans .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\beast lesbian (Jade).mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black cum beast masturbation feet (Jenna,Sarah).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\dotnet\shared\lesbian [free] cock (Christine,Sarah).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\brasilian nude lesbian hidden hole .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Microsoft\Temp\russian handjob sperm public titts shoes .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\swedish beastiality gay uncut hole balls (Samantha).mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Program Files\Common Files\microsoft shared\japanese porn bukkake lesbian .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\horse hot (!) high heels .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\gay girls titts (Christine,Sylvia).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\spanish lesbian licking (Jade).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\chinese lingerie catfight pregnant .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse [free] ยครง .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\cum blowjob licking mistress (Gina,Karin).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\cumshot lesbian hot (!) sm .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\porn beast voyeur glans beautyfull .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\horse several models ejaculation .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\handjob lesbian [free] .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\beast [bangbus] glans .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\indian action sperm uncut mature .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\danish cum lingerie girls glans mistress (Janette).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\kicking trambling hot (!) cock .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\fetish xxx girls circumcision (Sonja,Tatjana).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\gay sleeping titts .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\InputMethod\SHARED\black animal blowjob public cock sm .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\horse horse several models feet sweet (Jade).mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\chinese lesbian licking hotel (Sandy,Curtney).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\lingerie full movie mature .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black fetish xxx [bangbus] hotel .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\japanese kicking trambling licking .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\swedish kicking hardcore licking titts .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\black gang bang fucking masturbation titts hairy .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\african lingerie hidden granny .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\norwegian lingerie uncut hole .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\canadian sperm big blondie .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\nude gay hidden upskirt .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\fetish sperm several models .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\brasilian animal hardcore lesbian feet .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\asian blowjob public feet (Kathrin,Karin).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\german beast sleeping sm .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\horse several models ejaculation .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\russian horse hardcore [milf] cock .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\malaysia lingerie public (Janette).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\swedish animal trambling [bangbus] glans (Sonja,Tatjana).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\canadian blowjob voyeur feet fishy .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\cum gay several models titts granny (Karin).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\security\templates\japanese handjob xxx [bangbus] cock traffic .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\cum beast full movie .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\cum blowjob public mistress .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\swedish animal lesbian sleeping girly (Sonja,Samantha).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\malaysia trambling uncut castration .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\cumshot bukkake sleeping hole ejaculation .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\canadian bukkake hot (!) .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\tyrkish horse gay uncut castration .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\danish beastiality sperm full movie castration (Ashley,Liz).mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\indian kicking fucking [bangbus] feet young .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\hardcore big shoes .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\brasilian horse trambling masturbation cock .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\italian cumshot beast hidden granny .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\tyrkish action xxx girls femdom .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\tyrkish handjob gay licking (Curtney).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\italian porn bukkake [milf] (Sylvia).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\african hardcore masturbation upskirt .mpg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\swedish handjob sperm public hairy .mpeg.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\action xxx [bangbus] .rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\tyrkish handjob bukkake hot (!) glans beautyfull (Melissa).zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\russian cumshot trambling hidden (Tatjana).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\beastiality fucking big hotel .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\swedish animal trambling [bangbus] titts young .zip.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\black cumshot beast several models titts ash (Janette).rar.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\british bukkake uncut .avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\handjob lingerie voyeur (Curtney).avi.exe 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4144 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 4804 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1272 wrote to memory of 1944 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 90 PID 1272 wrote to memory of 1944 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 90 PID 1272 wrote to memory of 1944 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 90 PID 1272 wrote to memory of 4804 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 91 PID 1272 wrote to memory of 4804 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 91 PID 1272 wrote to memory of 4804 1272 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 91 PID 1944 wrote to memory of 4144 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 93 PID 1944 wrote to memory of 4144 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 93 PID 1944 wrote to memory of 4144 1944 1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
-
-
C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"C:\Users\Admin\AppData\Local\Temp\1a8b2667ecef2f5c8a171705ad1573a2b4db7581ed181331f152c925491eba09.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black cum beast masturbation feet (Jenna,Sarah).mpg.exe
Filesize1.3MB
MD512f34df4f2cd5c45b99c5bf9d85df451
SHA1b4f743b74a2c24bb0f53d22d07fc8804122b6b52
SHA25640e428408947d8386bc729b82010e40c3685c69dc864e840df1e54a1bea54874
SHA5126868989e860dd4af39f113073f2102e7e903772290843d109f5fc36f0d3f12f12d605823a7d039598edb766431ea38ff3bfea4cca28c8c2a26b98a4f61706968