Malware Analysis Report

2024-11-13 14:01

Sample ID 240407-3dnajahf41
Target 9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85
SHA256 9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85
Tags
upx persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85

Threat Level: Known bad

The file 9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85 was found to be: Known bad.

Malicious Activity Summary

upx persistence spyware stealer

UPX dump on OEP (original entry point)

UPX dump on OEP (original entry point)

Detects executables containing possible sandbox analysis VM usernames

Checks computer location settings

Reads user/profile data of web browsers

UPX packed file

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:24

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:24

Reported

2024-04-07 23:26

Platform

win7-20240221-en

Max time kernel

158s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\LogFiles\Fax\Incoming\trambling action public (Janette).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\horse catfight cock .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\japanese porn uncut blondie .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\danish blowjob sleeping .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\canadian nude animal sleeping .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\american animal voyeur .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\IME\shared\animal [bangbus] vagina .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\System32\DriverStore\Temp\italian sperm catfight legs .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\IME\shared\gang bang horse full movie .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay girls glans .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Office\Templates\horse masturbation feet ash .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Windows Journal\Templates\beast horse [milf] ìï .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\russian hardcore bukkake catfight mature .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\brasilian sperm voyeur .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Google\Temp\nude voyeur ash upskirt .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\russian sperm porn uncut feet blondie .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\russian nude hidden tÛ .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\spanish cumshot cum [milf] .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\DVD Maker\Shared\black trambling cum several models .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\american beastiality big .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\british fetish hot (!) boobs .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\xxx [bangbus] glans .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\horse full movie .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\tyrkish beastiality licking 50+ (Curtney).avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\malaysia porn [free] ìï .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\bukkake masturbation glans .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\italian trambling [free] nipples .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\beast lesbian .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\gay [bangbus] titts (Anniston).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\chinese blowjob sperm sleeping .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\asian kicking [milf] .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\american gay licking (Karin).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\canadian blowjob fucking [milf] boobs YEâPSè& .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\Downloads\swedish fetish masturbation bondage (Christine,Ashley).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\french hardcore gay public mature (Sylvia,Jenna).rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\hardcore beast [bangbus] .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\german bukkake lesbian .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\malaysia cum fetish sleeping vagina upskirt (Melissa,Britney).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\danish blowjob sleeping .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\spanish gay kicking masturbation bedroom (Janette,Britney).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\blowjob horse big .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\russian sperm cum [bangbus] castration .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\danish gay public young .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\bukkake sleeping ash pregnant (Sonja).avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\sperm hot (!) blondie .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\german nude [bangbus] .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\swedish horse bukkake [bangbus] mature (Christine,Gina).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\tyrkish kicking masturbation .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\indian fucking cumshot public lady .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\horse [bangbus] .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\swedish nude catfight .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\russian beast gang bang [bangbus] circumcision .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\horse gay girls glans mistress .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\fucking [bangbus] fishy .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\horse porn hot (!) shoes .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\spanish sperm kicking full movie penetration .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\black horse sleeping ejaculation .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\gay licking .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\canadian blowjob fucking licking .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\german gay beast several models hairy (Ashley,Sonja).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\canadian animal nude voyeur boobs (Sonja,Jenna).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SoftwareDistribution\Download\cumshot sleeping glans .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\xxx licking femdom (Tatjana,Sarah).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\InstallTemp\beast blowjob [bangbus] blondie .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\indian fucking masturbation latex .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\chinese horse girls penetration (Ashley,Karin).rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\chinese horse big .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\danish porn cumshot sleeping redhair .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\italian kicking beast sleeping .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\tyrkish cum sleeping lady .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\fucking voyeur hole black hairunshaved .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\security\templates\horse [milf] black hairunshaved (Liz).rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\spanish bukkake several models .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\german hardcore full movie (Sylvia).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\hardcore lingerie licking (Sonja,Melissa).avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\american porn [milf] (Sarah).rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\fucking porn big sm .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\cum voyeur gorgeoushorny .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\bukkake horse licking .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\tyrkish hardcore uncut .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\danish sperm blowjob masturbation .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\swedish blowjob full movie swallow (Sarah,Samantha).avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\american handjob hidden boots .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\american blowjob voyeur wifey .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\russian horse full movie shoes .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\spanish beastiality masturbation .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\asian kicking trambling several models (Gina,Sandy).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\italian animal hot (!) cock .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\chinese gay several models mistress .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2168 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 2168 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 2168 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 2168 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 2404 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 2404 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 2404 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 2404 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.222.188.134.in-addr.arpa udp
US 8.8.8.8:53 78.201.243.127.in-addr.arpa udp
US 8.8.8.8:53 206.204.238.232.in-addr.arpa udp
US 8.8.8.8:53 143.173.218.192.in-addr.arpa udp
US 8.8.8.8:53 174.233.103.211.in-addr.arpa udp
US 8.8.8.8:53 7.173.81.181.in-addr.arpa udp
US 8.8.8.8:53 104.52.194.218.in-addr.arpa udp
US 8.8.8.8:53 163.129.130.197.in-addr.arpa udp
US 8.8.8.8:53 225.233.237.226.in-addr.arpa udp
US 8.8.8.8:53 168.242.136.63.in-addr.arpa udp
US 8.8.8.8:53 144.153.244.104.in-addr.arpa udp
US 8.8.8.8:53 2.191.21.172.in-addr.arpa udp
US 8.8.8.8:53 51.97.82.57.in-addr.arpa udp
US 8.8.8.8:53 106.203.7.198.in-addr.arpa udp

Files

memory/2168-0-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\brasilian sperm voyeur .mpeg.exe

MD5 4c547e667e0a0b2df1a1e8c0b045ab3c
SHA1 cc26db97bb64f91f42ff973eac586ef62f335374
SHA256 d4c4956553d8a3072a457aefbfdb841c7b10e0f0bf741555486ddee897a7daa1
SHA512 ed3f417fcbf24915a1d8aaa8418ac5b25aea2754824a1aea1702a4a82726cf4e09736a64ca338dee1ca05254ebc7957b7592856a85df26f2a046e12cba4befa4

memory/2404-13-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2404-49-0x0000000004900000-0x000000000491E000-memory.dmp

memory/2936-50-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2168-79-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2404-90-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2404-91-0x0000000004900000-0x000000000491E000-memory.dmp

memory/2936-93-0x0000000000400000-0x000000000041E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:24

Reported

2024-04-07 23:26

Platform

win10v2004-20240226-en

Max time kernel

160s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\horse beast several models fishy (Melissa).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\System32\DriverStore\Temp\spanish horse sleeping black hairunshaved .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\asian bukkake lesbian lesbian blondie .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\bukkake hardcore [milf] legs ash .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\asian fucking public glans mistress .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish bukkake lesbian licking (Kathrin).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\italian gay xxx sleeping girly .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\System32\LogFiles\Fax\Incoming\bukkake trambling lesbian vagina .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\kicking beast licking mistress .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\french fetish hot (!) granny .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\kicking public .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\german trambling kicking girls bondage .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\Microsoft Shared\tyrkish horse blowjob [bangbus] boobs gorgeoushorny .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\beastiality cumshot public .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\tyrkish fetish xxx uncut 50+ .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\danish handjob sperm public femdom .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\norwegian bukkake hidden feet (Curtney).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\swedish lingerie xxx big high heels .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\lesbian gay sleeping nipples leather .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\beastiality masturbation ash .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{1FAC69E2-6A78-4418-8957-20DE7094BB95}\EDGEMITMP_86547.tmp\tyrkish animal hidden leather .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Common Files\microsoft shared\indian animal hot (!) wifey (Samantha).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\tyrkish trambling trambling full movie leather (Jade,Tatjana).rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\french horse licking .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\canadian lesbian [free] mistress .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Google\Temp\black porn full movie sweet .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\cumshot handjob masturbation Ôï (Sylvia).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\dotnet\shared\canadian horse [free] stockings (Kathrin,Karin).avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\german horse several models stockings .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Download\horse sperm masturbation ash (Tatjana,Jade).avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\xxx cum hidden vagina sweet .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\british xxx horse catfight boots .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\canadian beastiality big .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\black fetish uncut .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\cumshot hidden ash (Sonja).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\japanese lingerie sperm sleeping (Ashley).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\italian beastiality voyeur nipples balls .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\french handjob xxx [milf] lady .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\nude uncut boobs castration (Ashley).rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\brasilian handjob lingerie licking balls (Sonja,Christine).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\african cumshot hardcore lesbian .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\fucking voyeur .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\norwegian kicking catfight legs upskirt .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\indian fetish sleeping feet circumcision .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\hardcore hidden .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\sperm [bangbus] fishy .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\italian sperm hardcore several models gorgeoushorny (Sonja).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\indian lesbian lesbian .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\fetish [free] mistress .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\japanese sperm [milf] YEâPSè& .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\xxx several models lady .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\fucking sleeping .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\asian fetish girls .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\canadian nude hidden leather .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\cumshot masturbation .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\norwegian cum beast [milf] titts swallow .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\canadian kicking catfight castration .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\spanish nude hot (!) redhair .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\beast nude [milf] hole redhair .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\beastiality full movie .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\cumshot fucking public gorgeoushorny .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\german trambling hardcore licking leather (Christine,Curtney).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\french gay girls shoes (Sonja,Tatjana).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\asian kicking horse several models .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\japanese bukkake girls ash .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\horse lesbian public .avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\brasilian kicking [free] .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\french fetish [milf] beautyfull .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\black fetish [milf] vagina lady .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\chinese lesbian girls (Britney).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\canadian fucking gay uncut titts ash .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\bukkake [bangbus] hole .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\assembly\tmp\cumshot several models .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\canadian xxx [free] bedroom (Janette,Sarah).rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\brasilian lesbian lesbian girls .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\tyrkish kicking blowjob big granny (Samantha).mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\gang bang voyeur circumcision .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian gang bang lesbian several models (Christine,Sonja).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\Downloads\tyrkish animal animal big (Christine,Jenna).avi.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\indian gay sleeping .zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\beastiality horse public (Liz).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\russian nude beast several models .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\canadian cum public swallow .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\porn girls legs balls (Sonja,Britney).mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\canadian fucking licking vagina blondie .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\danish xxx cumshot lesbian beautyfull .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\black kicking xxx hot (!) boobs (Sylvia,Sonja).zip.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\horse kicking big fishy .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\german horse beastiality public glans .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\brasilian lingerie [free] girly .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\spanish action hidden blondie .mpeg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\norwegian fetish uncut cock .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\swedish sperm girls latex .rar.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\horse lesbian [free] glans boots .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\spanish fucking hidden titts .mpg.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3160 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 3160 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 3160 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 3160 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 3160 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 3160 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 3144 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 3144 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe
PID 3144 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe

"C:\Users\Admin\AppData\Local\Temp\9102def13c0f40b898906345d88e938fbc0c69149d7e68b53343c2bf57f11a85.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3848 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
DE 142.250.184.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.184.250.142.in-addr.arpa udp
US 8.8.8.8:53 226.191.234.86.in-addr.arpa udp
US 8.8.8.8:53 23.40.142.67.in-addr.arpa udp
US 8.8.8.8:53 121.216.207.64.in-addr.arpa udp
US 8.8.8.8:53 204.45.67.179.in-addr.arpa udp
US 8.8.8.8:53 11.31.38.31.in-addr.arpa udp
US 8.8.8.8:53 15.130.58.33.in-addr.arpa udp
US 8.8.8.8:53 71.98.236.177.in-addr.arpa udp
US 8.8.8.8:53 195.49.21.222.in-addr.arpa udp
US 8.8.8.8:53 26.72.200.150.in-addr.arpa udp
US 8.8.8.8:53 106.96.105.188.in-addr.arpa udp
US 8.8.8.8:53 124.54.74.251.in-addr.arpa udp
US 8.8.8.8:53 238.145.222.58.in-addr.arpa udp
US 8.8.8.8:53 173.214.21.175.in-addr.arpa udp

Files

memory/3160-0-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\french horse licking .mpg.exe

MD5 fff6a87e8cd07b16a8c1a968372748ff
SHA1 e6574f09b651954433097b18e6618ae6acd1549e
SHA256 48392e3b3783bfbe3df6d04450531773552249f31ec416bfbb80f427d940085d
SHA512 ad00afa6f47daa6725e91eb66bd4a5946399215c08809af0acb8ed0b561b799cfeb041c246417e9326e116041c26030bb32e678dab0375fcaa34e07be24b601c

memory/3144-11-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4500-13-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1132-14-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3160-173-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3144-192-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4500-195-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1132-197-0x0000000000400000-0x000000000041E000-memory.dmp