Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 22:02
Behavioral task
behavioral1
Sample
5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe
-
Size
1.2MB
-
MD5
c2e0e391222548e1bdfb703753fdc42e
-
SHA1
1b8e3fc5fa54d82ec9a145fedc01a9ba88a2b744
-
SHA256
5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9
-
SHA512
4b21c85d15677ea6f6d9590e55e375f93e11b72c4a639baec144ab536a1a9f37f74b6ccc9449a1f947b02ec5e714c82fcc91b2641a8c78f0ff380b13d86dd080
-
SSDEEP
24576:Vq8vOhhU94+WEbmNoliED4Oc0HBVo3zz5vM06u+o4RHE/eGMrU2wV:UnhhUSELc0o3z1M06JVRGMrA
Score
9/10
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral1/memory/2300-11-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2356-53-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-85-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2300-86-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-88-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-93-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-96-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-109-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-112-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-115-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-118-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-123-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-126-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-129-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-132-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-135-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/1084-138-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral1/memory/1084-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/files/0x000700000001560a-5.dat UPX behavioral1/memory/2300-11-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2356-53-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-85-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2300-86-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-88-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-93-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-96-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-109-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-112-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-115-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-118-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-123-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-126-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-129-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-132-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-135-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/1084-138-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1084-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/files/0x000700000001560a-5.dat upx behavioral1/memory/2300-11-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2356-53-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-85-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2300-86-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-88-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-93-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-96-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-109-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-112-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-115-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-118-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-123-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-126-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-129-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-132-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-135-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1084-138-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\R: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\T: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\A: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\B: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\I: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\M: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\O: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\S: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\V: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\X: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\G: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\J: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\K: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\Y: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\W: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\E: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\L: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\N: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\Z: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\H: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\Q: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File opened (read-only) \??\U: 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie licking hole beautyfull .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\SysWOW64\FxsTmp\african horse lesbian feet femdom (Samantha).mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish beastiality horse licking glans .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\SysWOW64\FxsTmp\trambling full movie hole .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\SysWOW64\IME\shared\xxx sleeping .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\SysWOW64\config\systemprofile\xxx licking shower (Gina,Sylvia).zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\System32\DriverStore\Temp\japanese action bukkake big glans ash .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\SysWOW64\IME\shared\italian action horse masturbation .rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\black nude bukkake public 50+ .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\SysWOW64\config\systemprofile\black fetish hardcore big cock wifey .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\japanese action lingerie hot (!) (Liz).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Common Files\microsoft shared\lingerie masturbation titts .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files\DVD Maker\Shared\bukkake public titts upskirt (Melissa).avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files\Windows Journal\Templates\american gang bang xxx lesbian cock femdom .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Google\Temp\bukkake lesbian glans (Sonja,Karin).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\beast voyeur (Janette).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\trambling [bangbus] cock .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lesbian sleeping .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files\Common Files\Microsoft Shared\beast hidden .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\beast sleeping feet circumcision .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Google\Update\Download\italian cum trambling [milf] 50+ .rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\blowjob catfight glans traffic .rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Microsoft Office\Templates\danish horse sperm uncut .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\american animal trambling [milf] fishy .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\sperm public (Curtney).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\lingerie hidden cock mistress (Samantha).avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\norwegian sperm voyeur sm (Anniston,Curtney).rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\Temp\italian animal sperm public hole (Kathrin,Liz).rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\hardcore [bangbus] titts leather .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\indian kicking bukkake [bangbus] black hairunshaved .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\horse blowjob girls mistress (Jenna,Curtney).zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\german hardcore [free] cock (Sonja,Jade).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\malaysia horse lesbian cock .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\canadian xxx girls titts .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\american beastiality bukkake big (Jade).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\InstallTemp\horse trambling licking beautyfull .rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\russian porn lingerie masturbation castration .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\indian gang bang beast catfight feet .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\malaysia beast catfight circumcision .rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\malaysia sperm voyeur .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\brasilian nude trambling several models .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\horse licking feet ash .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\lesbian big beautyfull .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay [milf] titts fishy .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\chinese lingerie girls (Sylvia).mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\SoftwareDistribution\Download\beast lesbian ìï .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\russian gang bang beast catfight feet 50+ .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\chinese gay [bangbus] glans traffic .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\asian sperm catfight leather .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\russian porn gay lesbian cock Ôë (Curtney).rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\norwegian trambling licking balls .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\french bukkake big glans .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\japanese animal sperm full movie (Liz).avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\cumshot gay voyeur feet .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\indian action lingerie big titts .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\norwegian beast masturbation .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\sperm voyeur glans .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\russian horse sperm sleeping hole ¼ç .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\japanese cum fucking sleeping feet latex .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\russian animal hardcore masturbation high heels .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\danish kicking horse licking titts (Jenna,Liz).zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\blowjob licking titts (Sonja,Tatjana).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\canadian blowjob girls .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\fucking [milf] cock (Christine,Sarah).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\norwegian bukkake catfight (Samantha).rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\security\templates\horse several models .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\sperm public .avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\kicking fucking lesbian feet beautyfull (Samantha).zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\spanish xxx girls (Jade).mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\chinese fucking girls swallow .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\indian cum xxx full movie .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\blowjob hidden castration .mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\xxx [milf] beautyfull .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\trambling several models swallow .zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\indian nude lesbian uncut blondie (Jenna,Sylvia).avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\beastiality beast sleeping (Tatjana).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\japanese porn xxx [bangbus] beautyfull (Sonja,Jade).zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\nude xxx [milf] feet beautyfull (Samantha).zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\italian gang bang lingerie full movie wifey (Gina,Tatjana).mpg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\brasilian kicking trambling several models bondage (Sonja,Janette).rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\xxx uncut granny .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\handjob sperm uncut penetration (Sonja,Karin).avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\porn gay voyeur glans (Sandy,Jade).zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\animal fucking [bangbus] glans fishy (Sylvia).avi.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\japanese handjob gay uncut glans .rar.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\canadian blowjob girls black hairunshaved (Jenna,Janette).mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\kicking xxx sleeping (Curtney).mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\tyrkish nude horse several models titts (Ashley,Karin).zip.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\french gay sleeping .mpeg.exe 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2356 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1084 wrote to memory of 2300 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 28 PID 1084 wrote to memory of 2300 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 28 PID 1084 wrote to memory of 2300 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 28 PID 1084 wrote to memory of 2300 1084 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 28 PID 2300 wrote to memory of 2356 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 29 PID 2300 wrote to memory of 2356 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 29 PID 2300 wrote to memory of 2356 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 29 PID 2300 wrote to memory of 2356 2300 5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe"C:\Users\Admin\AppData\Local\Temp\5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe"C:\Users\Admin\AppData\Local\Temp\5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe"C:\Users\Admin\AppData\Local\Temp\5d9fc9650d9e913434a8662e36c75032d7a67e764f5fa25da2e52aaafe76ccc9.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
801KB
MD5fab470a1f2d7445588179023fe82834d
SHA13199f180bbfe521e81259bb0a07681ef652e52f2
SHA25612d808014bb09970e4e0020796802bf86478173526825eb1e9b2f194ebbc212e
SHA51234ef08259f302d8917388d75b1a48060602a5ff48816434eab05cc1040370f3bed4ae745dda5f51b5036886fe6b5c8feee91422b8f3f5a59e00cbc0488930ba9