Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 19:38
Behavioral task
behavioral1
Sample
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe
Resource
win10v2004-20240226-en
General
-
Target
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe
-
Size
1.1MB
-
MD5
c0a17426219b6b74662e7668300f1869
-
SHA1
9db8f9d4516e674edf88de0ee2b8f8c3578d662e
-
SHA256
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae
-
SHA512
8f2b0ebceb307048a1a0e8cf43ad9edb51acb947771899add854ab9393ca461384a74a2840cfefb8d152ad850e409c1e3d6cd9fce9269612bcc6081eb064572e
-
SSDEEP
24576:bHq4rhlwEJlJLGqIZTIBw5op6MlDVhIHIU6g8yD1xkBzZD1C7a:jq4//N57dpZ7irE2GBNma
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1592-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian kicking beast lesbian .avi.exe UPX behavioral2/memory/1416-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4484-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3968-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1592-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian kicking beast lesbian .avi.exe upx behavioral2/memory/1416-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-29-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exedescription ioc process File opened (read-only) \??\I: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\K: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\P: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\U: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\H: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\L: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\M: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\R: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\X: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\Y: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\B: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\O: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\Q: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\S: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\T: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\V: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\E: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\G: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\J: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\N: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\W: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\Z: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File opened (read-only) \??\A: 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe -
Drops file in System32 directory 12 IoCs
Processes:
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exedescription ioc process File created C:\Windows\System32\DriverStore\Temp\horse public girly .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\FxsTmp\japanese cum lesbian lesbian cock (Anniston,Liz).rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\horse girls feet mature (Janette).mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\config\systemprofile\gay full movie .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\FxsTmp\russian handjob xxx several models feet beautyfull .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\black nude beast catfight mature (Ashley,Janette).mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\trambling full movie feet bedroom .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\config\systemprofile\xxx catfight hairy .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\IME\SHARED\gay lesbian cock latex (Janette).rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\swedish cum lingerie licking hole bedroom (Melissa).rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\xxx [free] glans .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SysWOW64\IME\SHARED\hardcore licking cock circumcision .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe -
Drops file in Program Files directory 19 IoCs
Processes:
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\danish action beast hidden .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files (x86)\Google\Temp\danish cum lingerie full movie ejaculation .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\lesbian several models pregnant .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\lingerie uncut .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\trambling hidden (Tatjana).zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian nude bukkake hidden .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\russian cum lesbian hot (!) hairy .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files (x86)\Google\Update\Download\american animal horse licking .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\Common Files\microsoft shared\xxx hidden feet .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\fucking full movie boots .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\Microsoft Office\Updates\Download\lingerie masturbation femdom .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\gay [milf] (Jade).mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{1FAC69E2-6A78-4418-8957-20DE7094BB95}\EDGEMITMP_86547.tmp\bukkake girls cock .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\italian beastiality hardcore [free] .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\dotnet\shared\trambling big swallow .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\Microsoft Office\root\Templates\italian fetish gay sleeping young .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian kicking beast lesbian .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\beast [free] .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Program Files (x86)\Microsoft\Temp\black gang bang horse girls pregnant .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe -
Drops file in Windows directory 64 IoCs
Processes:
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\asian beast [milf] redhair .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\german fucking hot (!) hole .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\norwegian gay girls glans .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\blowjob [free] (Curtney).zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SoftwareDistribution\Download\indian kicking trambling [milf] titts .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\norwegian bukkake hot (!) (Janette).rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\horse xxx uncut swallow (Anniston,Janette).zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\fetish gay [milf] cock .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\cumshot lesbian big (Tatjana).zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\porn horse masturbation traffic .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\japanese cumshot trambling hot (!) titts .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\african xxx [bangbus] feet upskirt .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\mssrv.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\security\templates\swedish kicking blowjob [bangbus] titts .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\beast big titts stockings .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\danish gang bang beast hot (!) girly .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\action xxx public ejaculation (Christine,Karin).mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\malaysia horse sleeping hotel .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\gay several models .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\russian kicking sperm uncut hole .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\british lesbian full movie hairy .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\german beast [free] glans ejaculation .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\asian sperm licking circumcision .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\porn fucking big YEâPSè& .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish handjob lingerie hidden (Liz).mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\fucking lesbian cock .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\malaysia xxx sleeping .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\black action beast lesbian .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\bukkake hot (!) leather .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\chinese trambling big 40+ .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\animal trambling hidden .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\assembly\temp\swedish fetish blowjob hot (!) cock redhair (Tatjana).mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\black handjob gay several models hairy .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\american gang bang hardcore girls boots .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\canadian xxx licking sweet .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\german sperm [milf] (Melissa).avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\black nude fucking big feet pregnant (Jade).mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\american handjob xxx voyeur .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\tyrkish cumshot horse uncut hole boots .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\cum blowjob big titts .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\african fucking [bangbus] hole mistress .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\italian porn lesbian hidden (Janette).avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\french trambling public (Jade).rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\gang bang lesbian public cock hotel (Sarah).rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\british trambling voyeur swallow .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\american nude xxx [bangbus] shower (Britney,Sarah).mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\horse fucking full movie (Jade).rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\norwegian fucking licking circumcision .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\malaysia sperm [bangbus] Ôï .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\french xxx girls feet swallow .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\nude gay hidden (Tatjana).mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\japanese fetish bukkake full movie glans .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\danish beastiality blowjob public .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\sperm several models cock beautyfull .avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\nude xxx [bangbus] cock upskirt (Tatjana).rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\nude gay big (Sylvia).mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\swedish porn horse catfight hole balls (Sarah).mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\british gay masturbation latex .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\spanish blowjob voyeur .mpg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\norwegian horse several models glans .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\danish fetish lesbian hidden glans hotel (Sarah).avi.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\assembly\tmp\black handjob blowjob hot (!) blondie .zip.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\horse several models cock .rar.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\indian beastiality lesbian masturbation .mpeg.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exepid process 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 3968 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 4484 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exedescription pid process target process PID 1592 wrote to memory of 1416 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe PID 1592 wrote to memory of 1416 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe PID 1592 wrote to memory of 1416 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe PID 1592 wrote to memory of 4484 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe PID 1592 wrote to memory of 4484 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe PID 1592 wrote to memory of 4484 1592 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe PID 1416 wrote to memory of 3968 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe PID 1416 wrote to memory of 3968 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe PID 1416 wrote to memory of 3968 1416 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe 29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe"C:\Users\Admin\AppData\Local\Temp\29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe"C:\Users\Admin\AppData\Local\Temp\29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe"C:\Users\Admin\AppData\Local\Temp\29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
-
-
C:\Users\Admin\AppData\Local\Temp\29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe"C:\Users\Admin\AppData\Local\Temp\29949187e0b05a4327ae2c65d2214eff1ca2ff2e9adf22be38d721fe98f106ae.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:81⤵PID:2992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian kicking beast lesbian .avi.exe
Filesize653KB
MD50cf8f6a5a6b94aee9977144bfb646de3
SHA15ec0a382a6d295446f2477d9e664d66bba35d953
SHA256bab7aa782318d279745474ed230dd91ee6b4b1556498e90511800b8581464fa1
SHA512e8b904cb5669da34ac3385d54ce9fc3e241471f202a4d1b32e7311dd1dc47e67010fb0b98942fde7f20aece6ec4b497cc9cc8083d6a32138490a135f0bdecb37