Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 01:07
Behavioral task
behavioral1
Sample
aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe
-
Size
1.9MB
-
MD5
d93845030bc22186288a1de23543ff47
-
SHA1
e3e0cf819f8e49094e1c6c22e497ae82c7e78c3f
-
SHA256
aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d
-
SHA512
7d09c0a955192e59c4b3ed5949242b33706de9b0cdb2d8597eac280e64bd74da666bbc8a368a5f5c5f3f09e3535a17a1104c85805d1564b797d6e8949d77f967
-
SSDEEP
49152:+FqliZ/wFntPHsj8I/bu2euB//cd/sOX19di0bb6bBU5:+miZ/2tfsj8iXBHUX13MBi
Score
9/10
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 16 IoCs
resource yara_rule behavioral1/memory/2952-92-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2432-95-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2652-104-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-105-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-110-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-113-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-116-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-121-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-124-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-127-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-130-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-133-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-136-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-139-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-142-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2952-145-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral1/memory/2952-0-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/files/0x00070000000155e3-5.dat UPX behavioral1/memory/2432-55-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2652-90-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-92-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2432-95-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2652-104-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-105-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-110-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-113-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-116-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-121-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-124-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-127-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-130-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-133-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-136-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-139-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-142-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2952-145-0x0000000000400000-0x000000000041B000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2952-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/files/0x00070000000155e3-5.dat upx behavioral1/memory/2432-55-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2652-90-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-92-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2432-95-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2652-104-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-105-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-110-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-113-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-116-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-121-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-124-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-127-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-130-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-133-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-136-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-139-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-142-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2952-145-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\L: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\P: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\U: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\X: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\E: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\I: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\O: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\S: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\V: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\Z: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\G: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\N: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\K: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\M: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\R: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\Y: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\B: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\H: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\T: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\W: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\A: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\Q: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\beast uncut (Sylvia).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\FxsTmp\spanish lesbian hot (!) .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\IME\shared\danish fetish lingerie catfight 40+ .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian uncut hole gorgeoushorny .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\IME\shared\brasilian animal lingerie uncut beautyfull .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\config\systemprofile\russian fetish hardcore public cock hotel .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\System32\DriverStore\Temp\beast big (Curtney).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\american cumshot hardcore [milf] feet shoes .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\config\systemprofile\italian beastiality trambling hidden (Tatjana).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\FxsTmp\fucking voyeur stockings (Gina,Karin).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\russian beastiality bukkake [milf] boots .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian beastiality horse hidden titts .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Google\Update\Download\hardcore [bangbus] 40+ .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\black beastiality xxx [milf] feet .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\beast [milf] cock boots (Karin).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\sperm hidden cock leather (Sylvia).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Google\Temp\tyrkish nude lingerie sleeping titts .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Windows Journal\Templates\tyrkish porn bukkake catfight (Sarah).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\sperm big feet .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian kicking trambling [milf] .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\black cum beast sleeping cock blondie .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Microsoft Office\Templates\danish animal horse full movie titts bondage .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\DVD Maker\Shared\blowjob [free] ash (Sandy,Liz).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\danish horse hardcore [free] gorgeoushorny .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian cum sperm hot (!) glans .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\hardcore girls hole ejaculation .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\blowjob sleeping titts (Jenna,Liz).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\chinese gay girls (Melissa).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\horse [milf] hole gorgeoushorny .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\french blowjob [free] cock circumcision .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\russian fetish lingerie uncut balls .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\beastiality hardcore licking .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\norwegian sperm several models hole .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\beast hidden (Sarah).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\horse fucking uncut young .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\canadian lesbian hot (!) wifey .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\beastiality lesbian lesbian sm .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\nude beast [free] glans penetration .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\danish cumshot horse big (Karin).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\black action sperm voyeur wifey .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\brasilian gang bang xxx big boots .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\french sperm several models boots (Christine,Curtney).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\russian fetish trambling big glans .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\lesbian [bangbus] titts .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\british fucking uncut shower (Gina,Tatjana).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\swedish cum beast public titts beautyfull .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\xxx voyeur titts shoes .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\german bukkake voyeur .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\indian horse gay hot (!) YEâPSè& .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\InstallTemp\nude bukkake public feet .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\lingerie licking cock .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\canadian horse full movie cock (Sonja,Tatjana).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\fucking lesbian boots .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\american gang bang beast public glans .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\swedish fetish sperm masturbation traffic (Britney,Samantha).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\malaysia horse public hairy .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\spanish beast voyeur .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian horse trambling hidden hairy .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SoftwareDistribution\Download\tyrkish kicking sperm uncut glans .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\swedish beastiality gay girls glans upskirt (Karin).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\gang bang lesbian hot (!) hole beautyfull (Curtney).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\russian kicking xxx licking sm (Anniston,Tatjana).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\german xxx lesbian hole gorgeoushorny (Curtney).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\brasilian cumshot hardcore [milf] cock castration .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\german gay catfight .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\lesbian catfight cock young .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\cumshot sperm several models bondage (Jenna,Curtney).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\horse xxx [free] feet lady .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\nude trambling sleeping glans .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\danish nude horse hidden granny .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\mssrv.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\swedish cumshot sperm girls high heels .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\danish animal lesbian voyeur .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\spanish fucking voyeur feet .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian horse lingerie big (Curtney).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\italian porn xxx big glans .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\british bukkake uncut .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\swedish beastiality sperm public cock .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\norwegian xxx licking .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\bukkake [free] swallow (Anniston,Jade).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\sperm full movie ash .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian kicking fucking sleeping hole gorgeoushorny (Janette).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\malaysia sperm voyeur hole (Anniston,Tatjana).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\kicking lingerie lesbian leather .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\japanese gang bang horse voyeur ejaculation .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\Temp\danish beastiality fucking masturbation pregnant .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\swedish handjob lesbian uncut titts (Anniston,Tatjana).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\cum beast full movie (Samantha).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\blowjob licking .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2652 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2432 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 28 PID 2952 wrote to memory of 2432 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 28 PID 2952 wrote to memory of 2432 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 28 PID 2952 wrote to memory of 2432 2952 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 28 PID 2432 wrote to memory of 2652 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 29 PID 2432 wrote to memory of 2652 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 29 PID 2432 wrote to memory of 2652 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 29 PID 2432 wrote to memory of 2652 2432 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5ee8d371bc8a57dee58a9238b04825287
SHA1d4a86ed675fa89a95f27329bc623d1a1f88b16a2
SHA256f31eebe0d0584825265e15a31fa2b2318396c00d7f203e08447cbb206a4e61ea
SHA5127798450bb4b7c6ec878632c65a7fa98e522d52bc0720720f7097cecba420de8023b4031e357a49b40e8891a56039ae893a5ed8c9e370e0280824a1dbf33d9b5d