Malware Analysis Report

2024-11-13 14:01

Sample ID 240407-26rmzshd3x
Target 8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224
SHA256 8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224
Tags
upx persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224

Threat Level: Known bad

The file 8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224 was found to be: Known bad.

Malicious Activity Summary

upx persistence spyware stealer

UPX dump on OEP (original entry point)

UPX dump on OEP (original entry point)

Detects executables containing possible sandbox analysis VM usernames

UPX packed file

Reads user/profile data of web browsers

Checks computer location settings

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:11

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:11

Reported

2024-04-07 23:14

Platform

win7-20231129-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\british xxx girls hairy .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese cum sperm several models .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\danish kicking horse masturbation traffic .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian nude xxx [milf] black hairunshaved .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\System32\DriverStore\Temp\tyrkish gang bang trambling [free] hole .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\lingerie full movie pregnant .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\IME\shared\fucking public .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish cum hardcore uncut YEâPSè& (Britney,Sarah).mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\IME\shared\xxx hot (!) cock bondage .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\xxx voyeur (Melissa).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Journal\Templates\black action gay full movie cock YEâPSè& .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\danish cumshot lingerie [free] (Liz).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\porn sperm sleeping feet shoes .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\brasilian handjob xxx voyeur cock traffic (Melissa).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\tyrkish beastiality hardcore [bangbus] .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\beast hot (!) hole upskirt .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\DVD Maker\Shared\sperm lesbian feet (Sonja,Karin).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black horse blowjob girls blondie (Kathrin,Curtney).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian horse trambling [bangbus] .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\lesbian public glans lady (Tatjana).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\beast [bangbus] lady .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\nude hardcore public hole .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Google\Temp\japanese cum gay [free] YEâPSè& (Christine,Janette).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\american gang bang hardcore sleeping hole circumcision (Curtney).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\indian cumshot bukkake [free] cock young .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\gang bang gay [milf] cock sm .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\cum xxx sleeping titts .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\japanese action lesbian licking hole sweet (Sylvia).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\cum lingerie [free] .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\gay full movie .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\asian blowjob full movie feet .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\lesbian sleeping hole leather .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\spanish bukkake big hole .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\beastiality gay sleeping glans femdom (Janette).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\Temp\swedish nude beast big glans .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\mssrv.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\italian fetish trambling full movie fishy (Gina,Sylvia).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\british fucking [milf] feet .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\fetish fucking [milf] .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\italian porn sperm girls hole lady (Melissa).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\british xxx voyeur (Janette).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\danish kicking sperm big cock .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\german horse girls latex (Kathrin,Janette).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\trambling masturbation fishy .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\black beastiality trambling voyeur hole wifey (Samantha).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\german trambling [free] (Jade).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\lesbian hot (!) blondie .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\asian blowjob public hole (Anniston,Karin).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\black handjob gay [bangbus] glans .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\russian beastiality hardcore lesbian .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\InstallTemp\cum bukkake [bangbus] blondie .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\bukkake licking titts .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\gang bang lesbian girls 40+ .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\british horse licking ash .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\tyrkish cum xxx [bangbus] .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\spanish trambling [free] .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\black animal bukkake sleeping feet swallow .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\sperm catfight cock 50+ (Jade).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\indian gang bang bukkake [bangbus] hole .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\handjob fucking hot (!) cock gorgeoushorny .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\french blowjob voyeur glans bondage .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\lingerie catfight feet .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\temp\russian cum horse masturbation hole .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\blowjob [bangbus] cock sm .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\british lesbian hidden titts leather .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\canadian lingerie girls glans lady .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\italian beastiality bukkake sleeping hole YEâPSè& .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\lesbian several models traffic .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\tyrkish handjob lesbian full movie hole .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\american fetish bukkake licking titts mature .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\british hardcore hidden hole ìï .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\japanese action gay masturbation (Janette).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\gay several models girly .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\british hardcore hidden feet .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\porn hardcore sleeping .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\Downloaded Program Files\tyrkish kicking sperm sleeping titts penetration .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SoftwareDistribution\Download\tyrkish fetish lesbian full movie traffic .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\blowjob catfight .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\british xxx licking .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\fetish beast girls glans .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\hardcore uncut glans .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\black fetish horse sleeping (Karin).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\german hardcore hot (!) .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\bukkake lesbian (Tatjana).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\PLA\Templates\sperm big hole .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\lesbian [free] traffic .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\kicking lingerie full movie (Samantha).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\tyrkish nude trambling licking glans .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\british trambling hidden penetration (Christine,Curtney).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2316 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 2316 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 2316 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 2316 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 2760 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 2760 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 2760 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 2760 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 26.64.169.24.in-addr.arpa udp
US 8.8.8.8:53 109.57.111.107.in-addr.arpa udp
US 8.8.8.8:53 73.181.241.179.in-addr.arpa udp
US 8.8.8.8:53 106.188.93.160.in-addr.arpa udp
US 8.8.8.8:53 159.236.212.248.in-addr.arpa udp
US 8.8.8.8:53 14.215.128.3.in-addr.arpa udp
US 8.8.8.8:53 66.20.133.254.in-addr.arpa udp
US 8.8.8.8:53 186.6.143.180.in-addr.arpa udp
US 8.8.8.8:53 65.115.151.211.in-addr.arpa udp
US 8.8.8.8:53 57.203.141.77.in-addr.arpa udp
US 8.8.8.8:53 89.24.70.123.in-addr.arpa udp
US 8.8.8.8:53 72.27.162.156.in-addr.arpa udp
US 8.8.8.8:53 20.47.101.20.in-addr.arpa udp
US 8.8.8.8:53 161.235.6.87.in-addr.arpa udp
US 8.8.8.8:53 225.134.195.241.in-addr.arpa udp
US 8.8.8.8:53 172.111.99.32.in-addr.arpa udp
US 8.8.8.8:53 95.197.78.85.in-addr.arpa udp
US 8.8.8.8:53 19.93.146.136.in-addr.arpa udp
US 8.8.8.8:53 185.25.123.113.in-addr.arpa udp
US 8.8.8.8:53 233.14.114.92.in-addr.arpa udp
US 8.8.8.8:53 216.148.223.226.in-addr.arpa udp
US 8.8.8.8:53 73.203.191.5.in-addr.arpa udp
US 8.8.8.8:53 69.82.161.34.in-addr.arpa udp
US 8.8.8.8:53 236.162.250.251.in-addr.arpa udp
US 8.8.8.8:53 103.226.31.104.in-addr.arpa udp
US 8.8.8.8:53 152.104.189.70.in-addr.arpa udp
US 8.8.8.8:53 94.134.132.37.in-addr.arpa udp
US 8.8.8.8:53 33.244.19.163.in-addr.arpa udp
US 8.8.8.8:53 206.179.112.1.in-addr.arpa udp

Files

memory/2316-0-0x0000000000400000-0x000000000041C000-memory.dmp

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black horse blowjob girls blondie (Kathrin,Curtney).rar.exe

MD5 a736b53d93408140432a1ae0cf2128c3
SHA1 7fa3bce2ab8675278f06561e0795f8e3094ae15e
SHA256 d449e1c5cdb9f0c2b08dd2403e508ab161b1eaf9517185c08c618d87df926e4c
SHA512 50d1262f7a920623f55dc05611232184174ad8693fd3681a79ad4cba9f97d62b2f36945320fcfcf6a1a99bbf0f2af9658b8557a727cb445ea4ad012b1db15648

memory/2316-63-0x0000000004DC0000-0x0000000004DDC000-memory.dmp

memory/2760-64-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2760-87-0x0000000004540000-0x000000000455C000-memory.dmp

memory/1956-88-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-90-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1956-102-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-103-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-106-0x0000000004DC0000-0x0000000004DDC000-memory.dmp

memory/2760-107-0x0000000004540000-0x000000000455C000-memory.dmp

memory/2316-108-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-111-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-114-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-119-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-122-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-125-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-128-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-131-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-134-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-137-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-140-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2316-143-0x0000000000400000-0x000000000041C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:11

Reported

2024-04-07 23:14

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\LogFiles\Fax\Incoming\beastiality blowjob hidden 50+ .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\gay cumshot lesbian (Sarah,Sonja).mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\cum horse several models castration .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\horse licking legs (Karin).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\horse uncut boobs balls (Curtney,Christine).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\System32\DriverStore\Temp\malaysia kicking catfight young .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\trambling lingerie uncut bedroom .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\italian horse [free] .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\chinese handjob [bangbus] (Jade).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\blowjob blowjob licking penetration .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\lesbian sleeping penetration .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\cumshot licking feet .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\british animal xxx [milf] (Samantha).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\fucking lesbian glans .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\horse catfight (Samantha,Janette).mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\german porn hot (!) vagina .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sperm [free] femdom .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude gay lesbian high heels .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Download\porn animal uncut .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\african horse [free] feet mistress .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Google\Temp\brasilian cumshot [free] .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\malaysia porn several models YEâPSè& .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\swedish horse horse public .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\american horse sperm uncut sm .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\african kicking beast uncut circumcision .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\spanish fucking nude uncut young (Britney,Ashley).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\dotnet\shared\beastiality sleeping .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\beastiality beastiality licking traffic .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\fetish action catfight penetration .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\indian fucking nude public .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\xxx masturbation redhair .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\african fucking catfight ash YEâPSè& .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\porn [free] ash .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\japanese bukkake sleeping .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\CbsTemp\chinese gang bang licking redhair (Christine,Melissa).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\horse [bangbus] hole .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\asian blowjob gay [milf] vagina castration .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\japanese lesbian public (Anniston).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\british hardcore sperm voyeur black hairunshaved (Liz).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\asian kicking masturbation boots (Gina).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\chinese lingerie lesbian legs beautyfull .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\italian beast catfight legs Ôï (Britney).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\sperm bukkake full movie .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\spanish xxx porn licking legs (Sonja).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\canadian horse full movie redhair (Janette,Gina).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\bukkake voyeur gorgeoushorny (Sylvia).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\horse blowjob several models gorgeoushorny (Gina).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\Downloads\trambling hot (!) girly .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\black nude [milf] cock .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\japanese fetish full movie titts .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\african nude uncut sm .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\french lingerie fetish [bangbus] vagina traffic .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\italian horse kicking hot (!) (Sandy,Melissa).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\swedish sperm porn several models ash .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\nude kicking voyeur granny .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\nude xxx [milf] .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\porn big .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\hardcore uncut (Sandy,Sylvia).rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\indian nude hot (!) .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\norwegian horse gay several models .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\chinese fetish gang bang catfight nipples wifey .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\animal hot (!) bondage .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\kicking gang bang several models .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\black bukkake bukkake public wifey .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\trambling xxx voyeur vagina .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\horse hidden titts balls .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\brasilian handjob licking granny (Sonja).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\hardcore beast lesbian penetration .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\Temp\gay licking titts (Sylvia,Gina).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\danish bukkake fucking catfight Ôï (Melissa).zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\malaysia trambling beastiality hot (!) titts shower (Christine,Melissa).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\indian trambling cum masturbation young (Jenna,Britney).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\SoftwareDistribution\Download\japanese blowjob porn lesbian nipples shoes .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\gang bang [milf] upskirt .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\beastiality porn [free] feet .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\norwegian lesbian lesbian .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\french kicking several models .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\malaysia sperm cumshot licking pregnant .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\chinese gang bang lingerie uncut .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\nude fucking big .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\tyrkish hardcore hardcore [bangbus] .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\norwegian nude fucking licking 40+ .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\british hardcore beastiality licking ash .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\lingerie horse uncut .avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\brasilian bukkake fetish masturbation leather (Jenna,Liz).avi.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\beastiality uncut .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\handjob nude public .mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\cumshot hot (!) boots .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\xxx big traffic (Christine).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\kicking full movie legs high heels (Sarah).mpg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\italian cumshot kicking masturbation swallow (Jade,Christine).mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\beastiality animal girls pregnant .mpeg.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\beast fucking voyeur sm .zip.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\norwegian fetish lesbian lesbian glans pregnant .rar.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 3028 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 3028 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 3028 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 3028 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 3028 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 4952 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 4952 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe
PID 4952 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe

"C:\Users\Admin\AppData\Local\Temp\8c3945782e4a134b5be7f5a3d8480c904b3accbdce48c8be15a74a0cbdccf224.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 178.109.69.21.in-addr.arpa udp
US 8.8.8.8:53 223.138.184.62.in-addr.arpa udp
US 8.8.8.8:53 157.202.6.158.in-addr.arpa udp
US 8.8.8.8:53 163.163.250.7.in-addr.arpa udp
US 8.8.8.8:53 191.22.120.212.in-addr.arpa udp
US 8.8.8.8:53 251.141.14.181.in-addr.arpa udp
US 8.8.8.8:53 211.255.155.215.in-addr.arpa udp
US 8.8.8.8:53 75.108.76.42.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 125.66.143.100.in-addr.arpa udp
US 8.8.8.8:53 123.228.124.211.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 142.142.56.82.in-addr.arpa udp
US 8.8.8.8:53 189.97.164.167.in-addr.arpa udp
US 8.8.8.8:53 53.87.8.191.in-addr.arpa udp
US 8.8.8.8:53 186.104.229.121.in-addr.arpa udp
US 8.8.8.8:53 249.249.178.45.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 158.71.26.34.in-addr.arpa udp
US 8.8.8.8:53 149.8.153.100.in-addr.arpa udp
US 8.8.8.8:53 16.211.54.247.in-addr.arpa udp
US 8.8.8.8:53 76.185.162.137.in-addr.arpa udp
US 8.8.8.8:53 126.23.231.104.in-addr.arpa udp
US 8.8.8.8:53 229.14.2.91.in-addr.arpa udp
US 8.8.8.8:53 81.19.167.235.in-addr.arpa udp
US 8.8.8.8:53 142.8.90.123.in-addr.arpa udp
US 8.8.8.8:53 238.198.88.210.in-addr.arpa udp
US 8.8.8.8:53 132.111.150.194.in-addr.arpa udp
US 8.8.8.8:53 197.48.48.48.in-addr.arpa udp
US 8.8.8.8:53 113.164.48.235.in-addr.arpa udp
US 8.8.8.8:53 122.215.125.119.in-addr.arpa udp
US 8.8.8.8:53 222.132.93.191.in-addr.arpa udp
US 8.8.8.8:53 85.138.171.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 17.204.171.50.in-addr.arpa udp
US 8.8.8.8:53 70.100.107.189.in-addr.arpa udp
US 8.8.8.8:53 108.113.243.238.in-addr.arpa udp
US 8.8.8.8:53 192.178.230.89.in-addr.arpa udp
US 8.8.8.8:53 131.143.169.254.in-addr.arpa udp
US 8.8.8.8:53 164.150.204.101.in-addr.arpa udp
US 8.8.8.8:53 209.144.210.231.in-addr.arpa udp
US 8.8.8.8:53 141.4.210.83.in-addr.arpa udp
US 8.8.8.8:53 112.17.83.240.in-addr.arpa udp
US 8.8.8.8:53 218.133.108.50.in-addr.arpa udp
US 8.8.8.8:53 18.91.56.217.in-addr.arpa udp
US 8.8.8.8:53 123.126.115.70.in-addr.arpa udp
US 8.8.8.8:53 186.168.170.94.in-addr.arpa udp
US 8.8.8.8:53 245.136.82.208.in-addr.arpa udp
US 8.8.8.8:53 95.90.213.35.in-addr.arpa udp
US 8.8.8.8:53 240.175.73.160.in-addr.arpa udp
US 8.8.8.8:53 237.115.62.209.in-addr.arpa udp
US 8.8.8.8:53 83.42.107.203.in-addr.arpa udp
US 8.8.8.8:53 236.206.76.220.in-addr.arpa udp
US 8.8.8.8:53 40.159.215.213.in-addr.arpa udp
US 8.8.8.8:53 63.11.117.255.in-addr.arpa udp
US 8.8.8.8:53 155.224.248.219.in-addr.arpa udp
US 8.8.8.8:53 19.60.219.203.in-addr.arpa udp
US 8.8.8.8:53 200.41.60.131.in-addr.arpa udp
US 8.8.8.8:53 187.117.116.50.in-addr.arpa udp
US 8.8.8.8:53 67.89.163.122.in-addr.arpa udp
US 8.8.8.8:53 28.222.209.30.in-addr.arpa udp
US 8.8.8.8:53 65.42.32.98.in-addr.arpa udp
US 8.8.8.8:53 172.246.208.77.in-addr.arpa udp
US 8.8.8.8:53 218.248.40.4.in-addr.arpa udp
US 8.8.8.8:53 67.8.234.160.in-addr.arpa udp
US 8.8.8.8:53 208.152.177.189.in-addr.arpa udp
US 8.8.8.8:53 122.10.44.20.in-addr.arpa udp

Files

memory/3028-0-0x0000000000400000-0x000000000041C000-memory.dmp

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\nude gay lesbian high heels .avi.exe

MD5 9f73ee8c4f8758888882873fe36ab8a1
SHA1 1c2f21f91eea2f0ff3d38e18389447e8ace03bdc
SHA256 55b0c008c355bb95fca215b7eab950986cc2e4da35f8e881ddb8de39cf21ae5a
SHA512 1778e9f23a9c675f5d59a0ce06704ae3335235603a5812ffc2939e946c14db27de73aab0968875ea6562ebc5278b9ed0d5cdf1754616cdfdcb12c705c9bf0785

memory/4952-118-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1520-161-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2672-162-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-180-0x0000000000400000-0x000000000041C000-memory.dmp

memory/4952-181-0x0000000000400000-0x000000000041C000-memory.dmp

memory/1520-182-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-185-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-191-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-201-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-205-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-210-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-214-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-218-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-222-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-226-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-230-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-234-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-238-0x0000000000400000-0x000000000041C000-memory.dmp

memory/3028-242-0x0000000000400000-0x000000000041C000-memory.dmp