Malware Analysis Report

2024-11-13 13:57

Sample ID 240407-zvczcaeg33
Target 5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7
SHA256 5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7
Tags
upx persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7

Threat Level: Known bad

The file 5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7 was found to be: Known bad.

Malicious Activity Summary

upx persistence spyware stealer

UPX dump on OEP (original entry point)

Detects executables containing possible sandbox analysis VM usernames

UPX dump on OEP (original entry point)

UPX packed file

Checks computer location settings

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 21:01

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 21:01

Reported

2024-04-07 21:04

Platform

win7-20240221-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\IME\shared\black blowjob catfight glans mistress (Anniston).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\trambling public traffic .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\System32\LogFiles\Fax\Incoming\british cumshot voyeur gorgeoushorny .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\fucking uncut vagina 50+ (Janette).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian nude [free] .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\IME\shared\british porn big 40+ .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\british nude hardcore masturbation mature .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\fetish porn voyeur mature (Melissa,Anniston).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\System32\DriverStore\Temp\horse catfight legs (Samantha).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\horse porn several models boots .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Temp\american xxx [free] titts .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\bukkake lesbian legs .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\spanish beast [bangbus] glans .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\gay uncut hole ash .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\DVD Maker\Shared\gay voyeur .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Windows Journal\Templates\indian beast full movie ejaculation .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\fucking full movie (Karin).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\norwegian porn kicking hot (!) hole hotel .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\malaysia sperm handjob girls (Sonja).avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\russian action several models .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\tyrkish fucking beastiality sleeping titts .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\brasilian blowjob cum catfight hole (Sonja).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\bukkake gang bang uncut feet gorgeoushorny .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\beastiality [free] vagina blondie .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\norwegian bukkake big ash .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\handjob beast sleeping .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\brasilian horse [bangbus] titts mistress .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\fetish [milf] .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\bukkake gang bang public .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\asian gay gang bang public .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\fucking fetish [free] .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\tyrkish kicking [milf] 50+ (Jade).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\tyrkish cum sperm uncut (Samantha,Sonja).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\handjob hot (!) .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\InstallTemp\trambling lesbian .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\blowjob kicking [bangbus] vagina swallow (Tatjana).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\chinese beast horse catfight traffic (Kathrin,Janette).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\fucking hidden lady .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\spanish nude porn catfight .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\beastiality cum girls hole latex .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\african cum handjob voyeur titts traffic .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\kicking sperm licking balls (Sandy,Liz).avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\hardcore big ash .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\xxx fetish public (Curtney,Ashley).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\animal public hole .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\spanish fetish fetish masturbation glans .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\swedish trambling big nipples fishy .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\spanish lingerie lesbian several models (Sarah,Sonja).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\xxx hot (!) cock swallow (Kathrin,Melissa).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish trambling girls ash .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\norwegian cum catfight ejaculation .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\porn fucking [bangbus] hole gorgeoushorny .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\asian horse catfight vagina .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\black horse [bangbus] traffic .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\Downloads\american gang bang lesbian high heels .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\horse masturbation hotel .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\tyrkish cumshot bukkake [free] feet swallow .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\fetish sperm [free] mistress .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\german cum lingerie lesbian hotel (Sandy,Janette).avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\kicking licking YEâPSè& .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\british lingerie [milf] .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\black gang bang porn uncut blondie .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\asian horse hot (!) 40+ .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\fetish cum licking upskirt .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\swedish beast voyeur .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\spanish bukkake fucking girls 40+ (Melissa,Sandy).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\fucking fucking [bangbus] femdom (Sylvia).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\bukkake fucking sleeping blondie (Jenna).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SoftwareDistribution\Download\african hardcore trambling [milf] .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\fucking voyeur cock penetration .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\brasilian lesbian voyeur titts .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\swedish beastiality catfight legs balls .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\horse porn uncut .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\bukkake [bangbus] .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\PLA\Templates\hardcore hot (!) sm .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\porn fetish catfight ìï .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\canadian xxx uncut .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\bukkake [milf] gorgeoushorny (Tatjana).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\cumshot sperm masturbation young .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\Downloads\italian fetish girls ejaculation .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\canadian cum porn lesbian legs high heels (Samantha).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\temp\african hardcore [free] feet (Jade,Janette).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\gay public .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\bukkake masturbation ash .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\handjob lingerie [milf] black hairunshaved .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\action handjob masturbation .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\tyrkish beast [milf] stockings .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\action horse full movie (Samantha).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\italian beastiality action girls .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1440 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 1440 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 1440 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 1440 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 2612 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 2612 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 2612 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 2612 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 1440 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 1440 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 1440 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 1440 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 174.255.169.11.in-addr.arpa udp
US 8.8.8.8:53 135.60.82.80.in-addr.arpa udp
US 8.8.8.8:53 40.195.44.165.in-addr.arpa udp
US 8.8.8.8:53 74.192.199.99.in-addr.arpa udp
US 8.8.8.8:53 55.186.55.219.in-addr.arpa udp
US 8.8.8.8:53 99.149.240.208.in-addr.arpa udp
US 8.8.8.8:53 240.175.26.25.in-addr.arpa udp
US 8.8.8.8:53 31.95.42.245.in-addr.arpa udp
US 8.8.8.8:53 162.224.32.124.in-addr.arpa udp
US 8.8.8.8:53 224.81.89.139.in-addr.arpa udp
US 8.8.8.8:53 28.251.171.222.in-addr.arpa udp
US 8.8.8.8:53 58.89.59.80.in-addr.arpa udp
US 8.8.8.8:53 8.144.231.49.in-addr.arpa udp
US 8.8.8.8:53 13.141.109.82.in-addr.arpa udp
US 8.8.8.8:53 209.46.42.98.in-addr.arpa udp
US 8.8.8.8:53 158.145.33.99.in-addr.arpa udp
US 8.8.8.8:53 105.91.141.117.in-addr.arpa udp
US 8.8.8.8:53 202.152.90.22.in-addr.arpa udp
US 8.8.8.8:53 215.49.136.94.in-addr.arpa udp
US 8.8.8.8:53 37.244.192.174.in-addr.arpa udp
US 8.8.8.8:53 94.193.176.176.in-addr.arpa udp

Files

memory/1440-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Program Files\Windows Sidebar\Shared Gadgets\fucking full movie (Karin).rar.exe

MD5 bab5705b483677e9475d93107df27060
SHA1 18b0f48df159564594bce35fb13a3f93757fc40d
SHA256 2b766654ce75bda74c4969a38f3c466b56e2803862c7c1bdea92b337b20f12fa
SHA512 885462d59c4d896b7db91e9af7112d53fffb586086f0e061d0e9a6006a0a6b5de6012e384abb344469d5d6962e74ac8272596dc807bc6defaab28130331dd9d9

memory/2612-11-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1440-9-0x00000000046B0000-0x00000000046CF000-memory.dmp

memory/2612-53-0x00000000045C0000-0x00000000045DF000-memory.dmp

memory/1440-54-0x00000000046B0000-0x00000000046CF000-memory.dmp

memory/2072-55-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2888-56-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1440-95-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1440-96-0x00000000046B0000-0x00000000046CF000-memory.dmp

memory/2612-99-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2072-102-0x0000000000400000-0x000000000041F000-memory.dmp

C:\debug.txt

MD5 01cc87347c523872661602be8a5882b0
SHA1 d9f6a594eb2dfcd9bf5f20a90d6c6cc83ca6a4fe
SHA256 387ff612f7134019550cc84bddca14abcb6650b8bb69e6a37a47c8b505ea6247
SHA512 25ca49a54235cfeb0cbe09184faac2278f0c4e1358d647a581b88d9d1b716b5a75054f2d9b1c66fb27ce5023b436e4f49c1130aafdcea2668f9d39418c5f290e

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 21:01

Reported

2024-04-07 21:04

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish horse sleeping beautyfull .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\swedish handjob lingerie girls sm .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\japanese kicking public upskirt (Janette,Tatjana).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\bukkake public hole .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\danish horse gang bang licking (Samantha).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\indian nude kicking several models .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\african xxx fucking full movie (Sonja).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\System32\DriverStore\Temp\horse cumshot catfight feet ejaculation .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\japanese fetish beastiality [free] lady .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\porn girls (Karin,Tatjana).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\swedish lesbian full movie (Liz).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\italian cumshot lesbian nipples .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\fetish hot (!) balls .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\malaysia action cumshot public circumcision (Ashley,Tatjana).avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\brasilian cumshot xxx sleeping (Ashley).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\lingerie uncut .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\african fetish kicking hot (!) penetration .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Download\british horse girls ash shoes (Sylvia,Gina).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian beast voyeur .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\danish gang bang sperm [bangbus] 40+ .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\german blowjob hot (!) .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\brasilian kicking horse uncut young .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\indian animal lingerie sleeping granny (Curtney,Janette).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\british kicking catfight wifey .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian gay masturbation balls (Samantha,Sylvia).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\british sperm licking feet black hairunshaved .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Google\Temp\spanish cum gang bang [free] vagina bedroom .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\italian horse animal [bangbus] mature (Liz).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\dotnet\shared\german cum kicking [bangbus] femdom (Sandy,Anniston).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\gay fucking girls .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\american gang bang handjob public nipples .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\cum lesbian .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\canadian blowjob hot (!) circumcision .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\indian animal fetish girls latex .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\hardcore fucking [milf] ejaculation .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\Temp\canadian gay licking .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\malaysia porn beastiality several models beautyfull (Anniston,Samantha).avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\black lingerie public beautyfull .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\american hardcore fetish voyeur feet stockings (Melissa,Gina).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\PLA\Templates\tyrkish beastiality lesbian masturbation mature .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\brasilian gay action lesbian leather (Sarah,Anniston).avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\fucking big YEâPSè& .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\swedish animal blowjob masturbation (Gina).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\beastiality several models .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\brasilian sperm uncut .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\swedish porn gay hot (!) nipples high heels .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\blowjob hardcore sleeping .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\fetish [free] nipples .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\canadian horse trambling voyeur .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\russian horse lesbian bondage .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\canadian horse [free] ash young .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\cumshot hardcore full movie feet .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\spanish handjob licking hole .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\horse several models feet sweet (Gina,Sonja).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\xxx hidden .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\trambling uncut leather .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\british nude lesbian black hairunshaved .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\gang bang gay public (Liz).avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese cum masturbation upskirt .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\nude fetish lesbian latex .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\asian beastiality handjob sleeping granny (Curtney,Sylvia).avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\hardcore beast licking .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\german lesbian lesbian public shower .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\blowjob beastiality full movie boobs gorgeoushorny .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\american lesbian catfight (Sonja,Sonja).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\gay hidden (Jenna,Samantha).rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\lesbian catfight mistress .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\InputMethod\SHARED\lingerie voyeur .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\german animal sleeping granny .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\tyrkish fetish [bangbus] YEâPSè& .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\japanese fetish sleeping feet granny .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\Downloaded Program Files\fucking several models hole .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\american animal girls glans .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\cum hot (!) cock leather .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\chinese action [bangbus] glans high heels .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\horse public pregnant .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\horse [free] vagina blondie (Tatjana,Anniston).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\american trambling lesbian shoes (Britney).zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\german xxx hot (!) leather .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\brasilian hardcore animal big wifey .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\american action gang bang sleeping redhair (Jade).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\horse big wifey .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\beastiality beast big (Melissa).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\horse catfight beautyfull .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\assembly\temp\black beast horse uncut hole wifey .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\Downloads\beast cum licking castration (Sarah).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\indian bukkake sperm licking feet Ôï .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\german kicking bukkake several models (Sandy,Samantha).mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\malaysia lesbian horse catfight glans hotel .zip.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\japanese lesbian voyeur pregnant .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\nude horse several models ash .mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\action lesbian [milf] sm (Liz,Sylvia).mpg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\indian bukkake hardcore sleeping cock hairy .mpeg.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\asian beastiality hidden penetration .avi.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\handjob handjob lesbian .rar.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4468 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 4468 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 4468 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 5056 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 5056 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 5056 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 4468 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 4468 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe
PID 4468 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe

"C:\Users\Admin\AppData\Local\Temp\5103c77d87b036647faa0fb674dedab0f07ec48bd8fa9e2264a7c56e6296c2d7.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 163.134.155.121.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 105.51.227.53.in-addr.arpa udp
US 8.8.8.8:53 54.98.97.145.in-addr.arpa udp
US 8.8.8.8:53 159.209.136.12.in-addr.arpa udp
US 8.8.8.8:53 140.110.58.67.in-addr.arpa udp
US 8.8.8.8:53 216.35.137.199.in-addr.arpa udp
US 8.8.8.8:53 92.199.160.160.in-addr.arpa udp
US 8.8.8.8:53 250.168.230.232.in-addr.arpa udp
US 8.8.8.8:53 112.178.155.136.in-addr.arpa udp
US 8.8.8.8:53 107.76.17.249.in-addr.arpa udp
US 8.8.8.8:53 223.206.191.213.in-addr.arpa udp
US 8.8.8.8:53 182.80.122.110.in-addr.arpa udp
US 8.8.8.8:53 115.96.215.255.in-addr.arpa udp
US 8.8.8.8:53 152.164.180.134.in-addr.arpa udp
US 8.8.8.8:53 185.189.9.249.in-addr.arpa udp
US 8.8.8.8:53 48.7.38.211.in-addr.arpa udp
US 8.8.8.8:53 197.244.252.6.in-addr.arpa udp
US 8.8.8.8:53 32.58.33.44.in-addr.arpa udp
US 8.8.8.8:53 110.156.25.215.in-addr.arpa udp
US 8.8.8.8:53 236.157.184.38.in-addr.arpa udp
US 8.8.8.8:53 137.205.205.57.in-addr.arpa udp
US 8.8.8.8:53 132.187.96.250.in-addr.arpa udp
US 8.8.8.8:53 253.148.217.132.in-addr.arpa udp
US 8.8.8.8:53 249.47.144.188.in-addr.arpa udp
US 8.8.8.8:53 251.242.214.215.in-addr.arpa udp
US 8.8.8.8:53 31.201.97.40.in-addr.arpa udp
US 8.8.8.8:53 214.188.17.182.in-addr.arpa udp
US 8.8.8.8:53 207.141.103.46.in-addr.arpa udp
US 8.8.8.8:53 78.242.253.207.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 173.31.21.148.in-addr.arpa udp
US 8.8.8.8:53 23.213.144.92.in-addr.arpa udp
US 8.8.8.8:53 78.169.178.20.in-addr.arpa udp
US 8.8.8.8:53 211.216.109.27.in-addr.arpa udp
US 8.8.8.8:53 87.103.252.59.in-addr.arpa udp
US 8.8.8.8:53 249.20.55.24.in-addr.arpa udp
US 8.8.8.8:53 123.8.167.30.in-addr.arpa udp
US 8.8.8.8:53 178.216.226.179.in-addr.arpa udp
US 8.8.8.8:53 190.7.18.207.in-addr.arpa udp
US 8.8.8.8:53 248.149.172.216.in-addr.arpa udp
US 8.8.8.8:53 190.212.179.216.in-addr.arpa udp
US 8.8.8.8:53 136.230.243.174.in-addr.arpa udp
US 8.8.8.8:53 231.17.119.111.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 250.87.155.244.in-addr.arpa udp
US 8.8.8.8:53 120.195.87.133.in-addr.arpa udp
US 8.8.8.8:53 128.177.225.224.in-addr.arpa udp
US 8.8.8.8:53 27.56.41.134.in-addr.arpa udp
US 8.8.8.8:53 208.71.208.89.in-addr.arpa udp
US 8.8.8.8:53 169.120.246.68.in-addr.arpa udp
US 8.8.8.8:53 236.252.165.169.in-addr.arpa udp
US 8.8.8.8:53 94.46.117.188.in-addr.arpa udp
US 8.8.8.8:53 67.109.176.200.in-addr.arpa udp
US 8.8.8.8:53 223.245.32.81.in-addr.arpa udp
US 8.8.8.8:53 129.231.68.183.in-addr.arpa udp
US 8.8.8.8:53 216.213.17.152.in-addr.arpa udp
US 8.8.8.8:53 82.177.177.191.in-addr.arpa udp
US 8.8.8.8:53 231.143.18.43.in-addr.arpa udp
US 8.8.8.8:53 77.87.248.135.in-addr.arpa udp
US 8.8.8.8:53 139.215.79.188.in-addr.arpa udp
US 8.8.8.8:53 133.165.121.247.in-addr.arpa udp
US 8.8.8.8:53 98.43.84.216.in-addr.arpa udp
US 8.8.8.8:53 152.226.242.7.in-addr.arpa udp
US 8.8.8.8:53 207.57.120.204.in-addr.arpa udp
US 8.8.8.8:53 132.199.205.118.in-addr.arpa udp
US 8.8.8.8:53 49.42.238.50.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 186.203.184.147.in-addr.arpa udp
US 8.8.8.8:53 162.144.16.152.in-addr.arpa udp
US 8.8.8.8:53 85.7.176.128.in-addr.arpa udp
US 8.8.8.8:53 226.154.150.26.in-addr.arpa udp
US 8.8.8.8:53 103.12.38.227.in-addr.arpa udp
US 8.8.8.8:53 180.62.83.252.in-addr.arpa udp
US 8.8.8.8:53 60.86.61.252.in-addr.arpa udp
US 8.8.8.8:53 105.61.44.223.in-addr.arpa udp
US 8.8.8.8:53 108.225.46.185.in-addr.arpa udp
US 8.8.8.8:53 155.104.37.253.in-addr.arpa udp
US 8.8.8.8:53 18.67.61.62.in-addr.arpa udp
US 8.8.8.8:53 22.229.178.161.in-addr.arpa udp
US 8.8.8.8:53 146.204.209.82.in-addr.arpa udp
US 8.8.8.8:53 234.223.127.89.in-addr.arpa udp
US 8.8.8.8:53 213.53.147.20.in-addr.arpa udp
US 8.8.8.8:53 109.51.225.235.in-addr.arpa udp
US 8.8.8.8:53 74.114.113.47.in-addr.arpa udp
US 8.8.8.8:53 99.84.42.214.in-addr.arpa udp
US 8.8.8.8:53 162.133.32.189.in-addr.arpa udp

Files

memory/4468-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian gay masturbation balls (Samantha,Sylvia).mpg.exe

MD5 6254448306bcf32ae115dea5f79dfe34
SHA1 a26ce42587fb6d95570fac914bea22311e29336b
SHA256 0e7d80cbb83783ef13ccc8105e2aae7dbf0cc7230000164d57ab0d20d8136e37
SHA512 7db09cf732a9c936267d99fa958afbfc465b85c68a6d20188358eb550247bc5e1da4721689d2b8ab9fe89aed19082caa56f9f34820cb4db600d58de60f0c01c4

memory/5056-63-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4992-163-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2232-164-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4468-201-0x0000000000400000-0x000000000041F000-memory.dmp

memory/5056-202-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4992-204-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2232-205-0x0000000000400000-0x000000000041F000-memory.dmp