Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 21:55
Behavioral task
behavioral1
Sample
69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe
Resource
win10v2004-20240226-en
General
-
Target
69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe
-
Size
1.4MB
-
MD5
07518ffec1a4b56a39aed78e503def54
-
SHA1
062eadcf1c898309835f97a258eac0c50e36d960
-
SHA256
69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325
-
SHA512
76ae4389ed73870e8608b08797d3d5581fcbdc3b448897fe9a81429fc8adebaf947a831d2ca7f03ecca7093d6dbc662da382a8d57f4ff97f6c6711b37703bd10
-
SSDEEP
24576:0HuXs7cIerg+zDtC/ns25BmpP9DpmtCjTsSNYSV1DxRizNK:icssg+zs/s2Lm59DprESqAD0NK
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 15 IoCs
resource yara_rule behavioral2/memory/2488-11-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3016-17-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-18-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2488-34-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3016-70-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2940-71-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-75-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-76-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-159-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-164-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-168-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-188-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-209-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-213-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3204-217-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral2/memory/3204-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/files/0x000700000002323c-5.dat UPX behavioral2/memory/2488-11-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3016-17-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-18-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2488-34-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3016-70-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2940-71-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-75-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-76-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-159-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-164-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-168-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-188-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-209-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-213-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3204-217-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3204-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x000700000002323c-5.dat upx behavioral2/memory/2488-11-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3016-17-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-18-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2488-34-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3016-70-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2940-71-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-75-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-76-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-159-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-164-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-168-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-209-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-213-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3204-217-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\U: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\Y: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\Z: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\I: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\P: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\O: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\T: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\W: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\M: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\N: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\K: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\L: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\X: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\A: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\G: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\H: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\J: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\Q: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\S: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\V: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\B: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File opened (read-only) \??\E: 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lingerie [bangbus] .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\config\systemprofile\trambling girls .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\System32\DriverStore\Temp\xxx full movie traffic .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\FxsTmp\american porn xxx licking hotel (Anniston,Tatjana).avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\american beastiality sperm catfight glans castration (Liz).mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\IME\SHARED\russian porn xxx hidden YEâPSè& .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\danish kicking gay [milf] .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\IME\SHARED\tyrkish handjob sperm [free] 40+ .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\horse lesbian .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish beastiality fucking masturbation femdom .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\config\systemprofile\indian horse trambling hot (!) .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SysWOW64\FxsTmp\american horse trambling girls (Melissa).mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\lingerie public .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\Microsoft Office\root\Templates\bukkake [milf] swallow .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese nude blowjob licking .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\russian handjob bukkake hot (!) cock wifey (Jade).rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\Microsoft Office\Updates\Download\trambling hot (!) titts .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\swedish kicking lingerie uncut .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\russian fetish blowjob full movie .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\lesbian public titts .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files (x86)\Microsoft\Temp\fucking licking (Curtney).mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\japanese horse blowjob [free] feet .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\dotnet\shared\brasilian beastiality beast sleeping titts femdom (Sarah).zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\cum trambling licking cock gorgeoushorny .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\american fetish bukkake hidden penetration .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files (x86)\Google\Temp\american horse hardcore several models glans bedroom .zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\hardcore lesbian balls .zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\russian beastiality sperm licking cock wifey .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files (x86)\Google\Update\Download\gay licking feet granny (Tatjana).zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\indian porn xxx [free] femdom .zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\indian action horse several models gorgeoushorny .zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\japanese porn sperm public glans traffic (Melissa).mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\russian handjob xxx hot (!) (Curtney).avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\horse girls mature .zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\Downloaded Program Files\indian cumshot horse masturbation latex .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm hidden feet ¤ç (Melissa).mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\russian animal hardcore uncut feet Œã (Sylvia).avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\british sperm sleeping titts .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\spanish hardcore big cock (Ashley,Janette).rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\tyrkish action fucking lesbian shoes .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\german horse [milf] glans .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\asian blowjob girls feet .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\security\templates\danish porn hardcore [bangbus] ejaculation .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\indian cumshot beast full movie sm .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SoftwareDistribution\Download\lingerie masturbation hotel .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\american kicking beast public feet redhair (Janette).avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\black horse hardcore sleeping cock (Ashley,Tatjana).mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\brasilian animal xxx several models bedroom .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\german lingerie full movie .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\PLA\Templates\gay uncut feet beautyfull .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\norwegian lingerie [milf] (Liz).zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\danish action gay public traffic .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\japanese porn horse voyeur titts .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\brasilian cum gay hidden blondie .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\chinese blowjob hot (!) redhair .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\lesbian sleeping feet traffic (Jade).rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\canadian beast [free] fishy .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\asian gay full movie feet sm (Janette).zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\horse masturbation blondie .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\malaysia trambling [bangbus] .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\nude lingerie big glans femdom .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\beastiality beast [free] circumcision .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\trambling [milf] titts .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\kicking lingerie girls gorgeoushorny .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\indian handjob beast [bangbus] glans .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\american animal xxx girls latex .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\french fucking lesbian .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\gay big circumcision .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\italian cumshot blowjob [free] (Sylvia).zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\assembly\tmp\trambling several models cock (Sonja,Tatjana).rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\CbsTemp\tyrkish kicking sperm several models .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\black beastiality horse public feet young (Sylvia).mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\swedish nude trambling catfight (Jade).mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\chinese bukkake catfight hole .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\cum xxx [milf] (Jade).mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\animal gay sleeping glans Ôï .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\mssrv.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\tyrkish action horse [milf] titts fishy .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\lingerie girls glans .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\xxx big glans redhair .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\german blowjob full movie (Jade).avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\british horse [milf] .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\gang bang xxx catfight hole gorgeoushorny .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\brasilian gang bang lingerie full movie titts pregnant .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\fucking full movie leather .rar.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\italian beastiality blowjob hot (!) .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\lesbian girls hotel (Sonja,Liz).avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\blowjob catfight .mpeg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\horse fucking voyeur shoes .mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\assembly\temp\japanese cumshot xxx public boots .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\russian cumshot horse catfight (Karin).mpg.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\beastiality sperm several models (Jade).zip.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\italian cumshot bukkake [free] bondage .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\canadian lingerie public mistress .avi.exe 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2940 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 3016 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3204 wrote to memory of 2488 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 88 PID 3204 wrote to memory of 2488 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 88 PID 3204 wrote to memory of 2488 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 88 PID 3204 wrote to memory of 3016 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 89 PID 3204 wrote to memory of 3016 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 89 PID 3204 wrote to memory of 3016 3204 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 89 PID 2488 wrote to memory of 2940 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 90 PID 2488 wrote to memory of 2940 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 90 PID 2488 wrote to memory of 2940 2488 69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe"C:\Users\Admin\AppData\Local\Temp\69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe"C:\Users\Admin\AppData\Local\Temp\69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe"C:\Users\Admin\AppData\Local\Temp\69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940
-
-
-
C:\Users\Admin\AppData\Local\Temp\69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe"C:\Users\Admin\AppData\Local\Temp\69a01a503edbf8c251c09e0ee928547aff40eb6751ef0fea3c69b88d2bbda325.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese nude blowjob licking .avi.exe
Filesize985KB
MD5a0b1a631f61fa240432fc51d95b23bda
SHA155b79d42584b3e1ff7ddbd33787a6e33196b5a03
SHA256b78c59846c041aa8776a000d83eb79841e1bab4d918a12206e82dab6ebd45ad6
SHA512f0d96cf265a6c4b8fcb6db14faab29388c47b8fe968b27d1e605481f9bbd65b4d83e0b9b4d8c14dd5b8d52530de54b1ef85643342b7e272972d0c71dbe9ddc07