5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
Size

1.2MB
MD5

8ce09d1d06c5e42af44bcf51f7165b16
SHA1

229691ad8ae8b30bb23cf9505b9222a5ee9e3909
SHA256

5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd
SHA512

9cf8b93e0c723672d594e3b384958527d1445d6d55c7ac4607b84f0ff585a6a06ace58a10dd9b4a16217398c6e0e5b9418746001f310d28a97e4d9fbc3f3a5b7
SSDEEP

24576:gYZanOvd7xD8Xx2OnPQbO0Tjhd6suLXBlXSsOW8MVV:X9vLoXxrPgTjnmLXraMX

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 17 IoCs

resource	yara_rule
behavioral1/memory/2808-54-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-90-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2808-93-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2828-102-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-103-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-108-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-111-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-114-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-119-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-122-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-125-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-128-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-131-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-134-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-137-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-140-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2084-143-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 20 IoCs

resource	yara_rule
behavioral1/memory/2084-0-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/files/0x0007000000014dae-5.dat	UPX
behavioral1/memory/2808-54-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2828-88-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-90-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2808-93-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2828-102-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-103-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-108-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-111-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-114-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-119-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-122-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-125-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-128-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-131-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-134-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-137-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-140-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2084-143-0x0000000000400000-0x0000000000420000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2084-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x0007000000014dae-5.dat	upx
behavioral1/memory/2808-54-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2828-88-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-90-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2808-93-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2828-102-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-103-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-108-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-111-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-114-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-119-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-122-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-125-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-128-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-131-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-134-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-137-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-140-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2084-143-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\Y:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\Z:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\E:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\N:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\O:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\R:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\V:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\H:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\Q:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\U:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\A:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\J:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\K:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\M:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\S:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\T:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\W:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\B:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\G:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\I:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\L:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File opened (read-only)	\??\P:	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\LogFiles\Fax\Incoming\indian nude beast public mistress .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SysWOW64\config\systemprofile\american action xxx public gorgeoushorny .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish horse beast [bangbus] lady .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SysWOW64\FxsTmp\lingerie girls boots .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian cum blowjob big cock circumcision (Tatjana).mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\System32\DriverStore\Temp\sperm several models cock .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SysWOW64\FxsTmp\beast full movie titts upskirt .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SysWOW64\IME\shared\american cum hardcore sleeping titts .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SysWOW64\config\systemprofile\american gang bang lesbian public cock sweet .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SysWOW64\IME\shared\lesbian voyeur .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Templates\african lesbian [bangbus] traffic .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files\DVD Maker\Shared\sperm [milf] (Liz).rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files\Windows Journal\Templates\lingerie girls .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\american handjob trambling voyeur traffic (Christine,Curtney).zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\swedish beastiality hardcore uncut cock mistress (Karin).mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Google\Temp\trambling catfight .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian kicking lingerie [free] YEâPSè& (Britney,Janette).rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files\Common Files\Microsoft Shared\swedish handjob sperm masturbation (Samantha).mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\blowjob voyeur (Sylvia).mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\russian beastiality hardcore girls titts redhair .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\black fetish fucking licking .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Google\Update\Download\american horse bukkake licking titts sweet .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\danish animal fucking uncut beautyfull .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\horse [bangbus] hole young .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\italian cum lesbian several models penetration .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\InstallTemp\german fucking several models hole balls .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\Downloaded Program Files\swedish porn sperm [free] titts .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\security\templates\black handjob gay uncut glans .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\tmp\danish porn fucking [milf] traffic (Ashley,Samantha).zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\italian cum xxx masturbation (Sarah).mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\tyrkish beastiality horse hidden black hairunshaved .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\animal gay catfight glans traffic .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\lingerie lesbian pregnant (Sonja,Samantha).zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\lingerie public hole pregnant (Sarah).mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese cumshot beast voyeur (Samantha).mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\fucking public feet (Sandy,Samantha).avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\lingerie [milf] cock .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\horse voyeur hole blondie .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\indian gang bang beast hot (!) cock boots .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\blowjob public YEâPSè& .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\brasilian beastiality sperm [free] .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\sperm public titts high heels (Karin).zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\SoftwareDistribution\Download\hardcore several models titts boots (Karin).mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\russian nude lingerie girls sm .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\action hardcore several models .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\beast sleeping (Samantha).zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\sperm big .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\american horse gay several models .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\indian cumshot beast public hole .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\swedish cum fucking uncut 50+ .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\nude bukkake hot (!) .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\french sperm several models glans .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\african bukkake big feet shoes .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\japanese beastiality lesbian uncut glans .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish cum sperm big hole castration (Sylvia).mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\indian cum gay several models glans .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\norwegian xxx uncut .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\norwegian fucking catfight high heels .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\brasilian nude bukkake [free] .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\italian beastiality lesbian public cock (Gina,Jade).rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\tyrkish cumshot horse several models girly .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\indian cum sperm sleeping glans beautyfull .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\horse voyeur .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\tyrkish handjob xxx [bangbus] .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\black horse lesbian voyeur hole .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\blowjob hidden glans .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\bukkake full movie titts 50+ .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\horse hot (!) titts .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\african hardcore uncut 40+ (Kathrin,Tatjana).mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\xxx uncut ejaculation .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\PLA\Templates\hardcore catfight cock .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\french sperm masturbation titts high heels .zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\indian kicking blowjob girls young .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian cum blowjob girls titts ash (Sylvia).zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\black cum xxx voyeur .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\kicking hardcore girls hotel .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\french gay sleeping ash .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\russian action bukkake [milf] girly .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\russian cum lesbian uncut boots .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\german beast masturbation cock black hairunshaved .mpg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\action horse licking YEâPSè& .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\bukkake [free] (Tatjana).zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\tyrkish action sperm hot (!) titts .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\african gay big circumcision .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\british gay [bangbus] glans fishy .avi.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\american handjob beast hot (!) hole fishy (Tatjana).zip.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\african lingerie licking .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\british bukkake hidden cock .rar.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\french bukkake lesbian sweet .mpeg.exe	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
2828	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2808	2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe	28
PID 2084 wrote to memory of 2808	2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe	28
PID 2084 wrote to memory of 2808	2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe	28
PID 2084 wrote to memory of 2808	2084	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe	28
PID 2808 wrote to memory of 2828	2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe	29
PID 2808 wrote to memory of 2828	2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe	29
PID 2808 wrote to memory of 2828	2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe	29
PID 2808 wrote to memory of 2828	2808	5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe	29

C:\Users\Admin\AppData\Local\Temp\5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
"C:\Users\Admin\AppData\Local\Temp\5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
  "C:\Users\Admin\AppData\Local\Temp\5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe
    "C:\Users\Admin\AppData\Local\Temp\5c655e0ba395bc926fbf152890082ffe244a72e2144b85809ecff855ce3a3bfd.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\american handjob trambling voyeur traffic (Christine,Curtney).zip.exe

Filesize
1.8MB

MD5
64c549d337f55fafd59390c8f56347b3

SHA1
036e3a994cb218d44e30835577688e6aac908ff1

SHA256
a54d3218d4adce74c5ec5773be2e800a4bb474b6d840cf22db49729c10d0d766

SHA512
75a77760294eba3e18a53eaa7487730671fd1e885c4cf7c86e99043665044ee61eda71e4326faf56e7c55c149b266a9de082d3e85fc3f9c2d9c8707048ee37fb

Download Submit
C:\debug.txt

Filesize
183B

MD5
8410a7995d088370193f516b5dc3723f

SHA1
c74522aedf35bb4e152deefaeea69d70f71b76e0

SHA256
c7feab51444fc5ccbf3e67d80f41466fa6710a797f42076b8f9f0a3f761b54d7

SHA512
a2f3fea458bdf67bca2c755be0b0e5899f972f2159deaeec55decbbda2a577dc4f6ed7962b2441cd84cf885fad7e5d5293d8654756a3e371fab7fd11a49117d3

Download Submit
memory/2084-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-90-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-111-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-108-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-106-0x0000000005B10000-0x0000000005B30000-memory.dmp

Filesize
128KB

Download
memory/2084-53-0x0000000005B10000-0x0000000005B30000-memory.dmp

Filesize
128KB

Download
memory/2084-103-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-114-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-119-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-122-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2084-128-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2808-107-0x0000000004A90000-0x0000000004AB0000-memory.dmp

Filesize
128KB

Download
memory/2808-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2808-93-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2808-87-0x0000000004A90000-0x0000000004AB0000-memory.dmp

Filesize
128KB

Download
memory/2828-102-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2828-88-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download