Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 19:04
Static task
static1
Behavioral task
behavioral1
Sample
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe
Resource
win10v2004-20240426-en
General
-
Target
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe
-
Size
1.3MB
-
MD5
3b0777b1491a27978c254162e3d53855
-
SHA1
065f2ec522740f812f3fe033dce348fb18d4dacc
-
SHA256
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08
-
SHA512
4d997bb2c17cb3a547c9a5df5e7048a9dc02d8223ce23a14a443023be66b8d4a089cadb036ce02752e8bd009a2258256c26fff7ae7cb52670bf10421bfcbb2df
-
SSDEEP
24576:oWMKGrlKohGFHWf6GFk4JsbuLbDNWrOdRv7lqM+7:VMKGrhGNWiGBouHRWqPv7lqMA
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1424-0-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish fetish lesbian catfight cock wifey .rar.exe INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3868-30-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5000-159-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2124-167-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exedescription ioc process File opened (read-only) \??\A: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\Q: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\S: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\U: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\V: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\W: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\G: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\J: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\K: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\L: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\R: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\I: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\M: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\N: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\Z: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\T: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\X: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\Y: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\B: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\E: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\H: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\O: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File opened (read-only) \??\P: 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe -
Drops file in System32 directory 12 IoCs
Processes:
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exedescription ioc process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\indian kicking gay catfight mature .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\System32\DriverStore\Temp\tyrkish kicking lesbian catfight sm .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\FxsTmp\japanese beastiality horse hot (!) cock femdom .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\danish beastiality beast [free] (Liz).mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\sperm hidden boots .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\config\systemprofile\beast sleeping hole .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\FxsTmp\black handjob blowjob hidden feet .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\IME\SHARED\russian nude gay licking (Samantha).avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\config\systemprofile\indian kicking gay [bangbus] ash .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\IME\SHARED\lesbian licking .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\xxx masturbation balls .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish kicking gay catfight cock .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe -
Drops file in Program Files directory 19 IoCs
Processes:
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\swedish animal beast uncut (Samantha).zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files (x86)\Google\Temp\sperm hot (!) cock (Anniston,Jade).mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\horse [milf] cock .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\Common Files\microsoft shared\swedish gang bang beast several models feet boots .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish fetish lesbian catfight cock wifey .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\japanese nude fucking hot (!) sm .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\swedish cum bukkake sleeping hole mistress (Samantha).zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\swedish porn gay girls hairy .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files (x86)\Microsoft\Temp\EU9470.tmp\brasilian cum gay several models .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\black nude horse [milf] glans upskirt (Curtney).zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian gang bang bukkake masturbation cock .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files (x86)\Microsoft\Temp\blowjob public hole ejaculation .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\bukkake [free] titts lady (Janette).avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\lesbian catfight cock balls (Liz).rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\Microsoft Office\Updates\Download\italian cum blowjob big feet traffic .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\dotnet\shared\swedish nude trambling [bangbus] titts shoes .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files\Microsoft Office\root\Templates\danish fetish lingerie catfight cock (Kathrin,Tatjana).mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\beast lesbian feet mature (Karin).avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Program Files (x86)\Google\Update\Download\italian animal beast public feet traffic (Samantha).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe -
Drops file in Windows directory 64 IoCs
Processes:
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exedescription ioc process File created C:\Windows\ServiceProfiles\LocalService\Downloads\gay licking leather .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\asian bukkake [free] young .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\horse hardcore [free] .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\hardcore lesbian cock (Sonja,Melissa).zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\african sperm uncut castration (Kathrin,Tatjana).avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\black animal sperm catfight pregnant .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\british beast uncut (Janette).rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\russian cumshot bukkake sleeping boots .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\french trambling hot (!) cock .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\canadian xxx girls hole boots (Sylvia).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\german blowjob uncut .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\bukkake voyeur glans femdom .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\gay [free] .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\brasilian cum fucking big .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\blowjob hot (!) titts sweet .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\african sperm uncut glans .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\italian action hardcore full movie titts lady (Liz).rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\danish cumshot blowjob [bangbus] 40+ .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\spanish sperm several models titts bedroom (Sarah).mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\kicking lesbian licking gorgeoushorny (Gina,Karin).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\tyrkish nude beast full movie glans .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\tyrkish kicking xxx [milf] feet hotel .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\american fetish lingerie [bangbus] cock 50+ .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\sperm hot (!) feet 50+ .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\horse hidden titts mistress .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\gay girls (Liz).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\french gay public hotel (Gina,Tatjana).mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\horse trambling full movie hole YEâPSè& (Jade).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\malaysia bukkake masturbation castration .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\cumshot beast uncut (Curtney).rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\gay hidden latex (Sandy,Melissa).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\german lesbian uncut glans swallow (Tatjana).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\swedish handjob trambling lesbian feet ejaculation (Melissa).rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\german blowjob girls .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\asian blowjob several models shower .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\tyrkish horse beast masturbation glans 50+ .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\swedish handjob lingerie masturbation hotel .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\kicking lesbian masturbation feet mistress .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\malaysia gay lesbian Ôï .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\italian handjob bukkake licking cock wifey .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\xxx hidden (Tatjana).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\french lingerie [milf] feet granny .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\PLA\Templates\sperm public feet .rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\indian nude hardcore girls glans circumcision .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\swedish animal fucking sleeping cock .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\blowjob masturbation cock .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\chinese trambling licking gorgeoushorny .mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\danish handjob bukkake big hole leather (Jade).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\black nude horse uncut penetration .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\norwegian horse girls cock YEâPSè& (Liz).zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\indian fetish hardcore public sm .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\swedish beastiality horse [bangbus] hairy .zip.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\fetish gay uncut (Samantha).avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\animal horse licking hole .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\french bukkake masturbation titts .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\swedish animal beast [free] .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\beastiality lesbian hidden feet upskirt (Sylvia).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\horse lingerie sleeping .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\french beast public femdom (Kathrin,Janette).mpg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\american fetish horse hot (!) cock redhair .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\african xxx [milf] .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\danish porn lesbian hot (!) cock penetration .mpeg.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\gang bang hardcore catfight traffic (Kathrin,Melissa).rar.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\action xxx licking .avi.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exepid process 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 2124 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 5000 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exedescription pid process target process PID 1424 wrote to memory of 3868 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe PID 1424 wrote to memory of 3868 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe PID 1424 wrote to memory of 3868 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe PID 1424 wrote to memory of 5000 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe PID 1424 wrote to memory of 5000 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe PID 1424 wrote to memory of 5000 1424 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe PID 3868 wrote to memory of 2124 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe PID 3868 wrote to memory of 2124 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe PID 3868 wrote to memory of 2124 3868 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe 19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe"C:\Users\Admin\AppData\Local\Temp\19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe"C:\Users\Admin\AppData\Local\Temp\19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe"C:\Users\Admin\AppData\Local\Temp\19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe"C:\Users\Admin\AppData\Local\Temp\19e16d6be2d748899068e32201a11bf37ab7f2a6dec0dc3839f44b3075eaae08.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish fetish lesbian catfight cock wifey .rar.exeFilesize
146KB
MD58897002a784c61a84d9a7fc3ca0388d9
SHA1a98e4083f6ff2a9d6b5fd12d08a618262feba524
SHA2563b0bff04d1d9566a018d3fdc49f886821b0198f05385110d55c59a22a4013da2
SHA512df21ce197e07662c4224ceeba36b248536b7af6b43ca0622db6fe6c6a8e74b9e9669d87ef83a57da85b12ddb961f06478ed716d30a6854af398d9e5b7f31011c
-
memory/1424-0-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2124-167-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3868-30-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5000-159-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB