Malware Analysis Report

2024-11-15 06:33

Sample ID 240614-c4mtksscrc
Target ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a
SHA256 ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a
Tags
persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a

Threat Level: Known bad

The file ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a was found to be: Known bad.

Malicious Activity Summary

persistence spyware stealer

Detects executables containing possible sandbox analysis VM usernames

Detects executables containing possible sandbox analysis VM usernames

Reads user/profile data of web browsers

Checks computer location settings

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 02:37

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 02:37

Reported

2024-06-14 02:40

Platform

win7-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish cum xxx big swallow .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\trambling lesbian (Sylvia).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\tyrkish nude fucking public mistress .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\hardcore [milf] cock femdom .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\System32\DriverStore\Temp\xxx masturbation hotel .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\lesbian several models titts .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\IME\shared\american porn fucking hot (!) ejaculation .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\black nude gay hot (!) .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\fucking voyeur (Liz).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\IME\shared\lesbian big (Melissa).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\japanese horse blowjob several models feet (Jenna,Liz).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\japanese nude horse uncut ìï .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\xxx masturbation blondie .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\black animal bukkake big 50+ .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sperm catfight .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\blowjob licking stockings .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\beast masturbation feet (Jenna,Janette).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\lingerie full movie titts .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\blowjob several models hole gorgeoushorny (Samantha).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\swedish animal hardcore full movie (Sylvia).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\hardcore masturbation .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Windows Journal\Templates\american kicking trambling licking latex .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\black horse trambling uncut feet .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Google\Temp\american nude lingerie hot (!) glans shower .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\tyrkish action lesbian [bangbus] ìï .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\fucking public glans blondie (Janette).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\PLA\Templates\russian animal horse masturbation upskirt .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\asian xxx public cock pregnant .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\british fucking [bangbus] glans 50+ (Sarah).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\french lingerie masturbation .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\blowjob several models traffic .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\tmp\swedish cumshot blowjob [free] hairy .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\horse sleeping (Janette).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\nude hardcore sleeping .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\indian fetish lingerie several models 50+ .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\black nude lesbian [milf] high heels (Sonja,Jade).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\canadian xxx catfight .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\handjob hardcore sleeping glans .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\handjob sperm voyeur hole beautyfull (Tatjana).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\brasilian fetish hardcore girls .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\russian animal gay hot (!) (Liz).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\asian fucking hidden glans pregnant .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\african sperm [milf] hole ash .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\american nude sperm girls black hairunshaved .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm uncut hole swallow .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\horse hardcore hot (!) pregnant .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\german blowjob [milf] cock castration (Sarah).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\bukkake public cock boots (Samantha).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\spanish gay licking .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\german xxx public redhair (Sandy,Sarah).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\handjob fucking lesbian feet .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\japanese horse sperm lesbian hole wifey (Janette).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\beast [milf] .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\Downloaded Program Files\brasilian beastiality beast lesbian (Tatjana).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\animal trambling hot (!) latex .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\lingerie several models pregnant (Sonja,Tatjana).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\malaysia beast several models .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\brasilian fetish trambling [milf] stockings (Sonja,Liz).mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian beastiality sperm hot (!) feet .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\american fetish sperm hot (!) titts 50+ (Liz).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\trambling [bangbus] cock .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\italian action gay voyeur glans .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\black gang bang gay uncut glans latex .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\beast catfight hotel .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\mssrv.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\black cum sperm full movie .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\canadian sperm public titts .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\kicking trambling hot (!) cock .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\lesbian [free] .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\Downloads\japanese fetish xxx big shoes .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\african bukkake [bangbus] .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\british xxx [free] feet fishy .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\asian bukkake masturbation .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\black cum lesbian hidden mature .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\black animal sperm voyeur .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\temp\russian cum bukkake hidden feet .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\chinese trambling licking titts .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\cumshot lesbian uncut latex .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\nude blowjob full movie (Sylvia).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\porn blowjob hidden glans sm .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\canadian sperm big femdom .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\tyrkish fetish sperm hot (!) .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\InstallTemp\gang bang blowjob sleeping .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\handjob hardcore [free] .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\xxx licking hole blondie .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\gay masturbation penetration .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\american fetish sperm big 50+ .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\danish beastiality hardcore catfight .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\british bukkake licking cock redhair .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 836 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 836 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 836 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 836 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 2548 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 2548 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 2548 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 2548 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.63.140.24.in-addr.arpa udp
US 8.8.8.8:53 29.212.157.200.in-addr.arpa udp
US 8.8.8.8:53 169.56.123.3.in-addr.arpa udp
US 8.8.8.8:53 9.147.93.20.in-addr.arpa udp
US 8.8.8.8:53 147.44.221.148.in-addr.arpa udp
US 8.8.8.8:53 152.232.49.78.in-addr.arpa udp
US 8.8.8.8:53 210.224.188.226.in-addr.arpa udp
US 8.8.8.8:53 163.81.169.118.in-addr.arpa udp
US 8.8.8.8:53 197.170.166.16.in-addr.arpa udp

Files

C:\Program Files\Windows Sidebar\Shared Gadgets\black horse trambling uncut feet .rar.exe

MD5 99135478ef6b6e6f05a0b17610758b85
SHA1 a51b0eb85de185d018737907e0a89710fa4cfd19
SHA256 5cf5459e322baccb9d4e59aa7d44abeae4e9b4233648f62497b15004fa11d880
SHA512 95764fc2333837fced3873eb60ac70dae89593b045ed304b90b10fa44a52b0e10109012a8f13dc7db3c392acad31c861c73ec7263facafbb0c0a2132ecdaa015

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 02:37

Reported

2024-06-14 02:40

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

Signatures

Detects executables containing possible sandbox analysis VM usernames

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\LogFiles\Fax\Incoming\malaysia hardcore beast hidden .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\asian trambling nude big .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\beast horse catfight .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\american bukkake girls upskirt .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\System32\DriverStore\Temp\malaysia porn [free] cock (Samantha,Melissa).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\american animal licking ash (Samantha).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\action girls .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\blowjob lesbian catfight castration .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\FxsTmp\kicking [free] legs femdom .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\chinese animal licking swallow (Anniston,Jenna).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\handjob bukkake hot (!) legs .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\african nude [bangbus] .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\italian handjob hardcore [milf] .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\german horse public black hairunshaved (Janette).mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Google\Temp\black handjob licking legs black hairunshaved (Karin).mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\canadian horse licking vagina stockings .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\german bukkake cum catfight .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\blowjob catfight mistress .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\animal porn masturbation sm .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\tyrkish fucking hot (!) (Karin).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\spanish lingerie [free] (Melissa,Sarah).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\gang bang public .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Google\Update\Download\handjob nude [bangbus] bondage .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\malaysia action licking legs swallow (Samantha,Tatjana).mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\dotnet\shared\tyrkish animal fetish catfight hotel .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\spanish fetish sperm [bangbus] feet YEâPSè& .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\malaysia lesbian sperm [free] ash (Sarah,Kathrin).mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\american lesbian [milf] .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Download\black lingerie action licking feet .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\brasilian animal voyeur girly (Kathrin).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\horse trambling girls .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\asian fetish catfight YEâPSè& .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\fucking beastiality uncut .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\african gang bang full movie pregnant (Tatjana,Christine).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\french gay xxx hidden titts bedroom .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\animal sperm catfight circumcision .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\cumshot girls ash black hairunshaved .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\norwegian hardcore bukkake girls legs shoes .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\xxx fucking girls traffic .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\xxx action hot (!) upskirt .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\handjob trambling voyeur gorgeoushorny (Jade,Kathrin).mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\british beastiality cumshot several models glans ejaculation (Tatjana,Anniston).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\spanish sperm horse licking .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\norwegian beast animal [free] lady .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\canadian handjob sleeping cock latex .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\horse lesbian catfight vagina YEâPSè& (Christine).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\black nude [free] glans fishy (Sonja,Jade).mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\cumshot hidden (Ashley,Sonja).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\french blowjob animal big .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\british blowjob gang bang [milf] wifey .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\gang bang fetish lesbian wifey .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\brasilian action masturbation leather (Janette,Tatjana).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\russian cum fucking full movie (Ashley,Britney).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\cum [milf] feet ejaculation (Britney,Janette).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\gang bang animal several models (Kathrin).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\british beastiality uncut pregnant (Tatjana).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\italian fucking action full movie girly .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\horse gang bang public .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\beast lesbian public young .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\horse blowjob [bangbus] (Liz).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\swedish cum animal catfight .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\swedish bukkake cum [bangbus] boobs blondie (Janette).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\spanish action [bangbus] ash .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\spanish cum catfight bondage (Britney,Sylvia).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\xxx hidden 40+ .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\lingerie [bangbus] titts .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\japanese gay [free] (Sonja,Jenna).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\tyrkish hardcore animal lesbian castration .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\beast licking latex .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\kicking [milf] (Sonja).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\african horse gang bang voyeur glans .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\animal hot (!) balls .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\japanese handjob voyeur (Sonja,Christine).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\african trambling beastiality [milf] ejaculation .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\horse porn public lady .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\assembly\temp\horse hardcore catfight latex .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\cumshot horse full movie .rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\african animal hidden leather .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\italian nude uncut penetration (Tatjana).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\italian bukkake hidden nipples castration (Jade,Karin).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\german lingerie gang bang girls (Liz,Christine).avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\japanese fetish masturbation stockings .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\kicking lesbian uncut shoes .mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\african horse catfight .avi.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\indian blowjob fetish full movie (Melissa,Samantha).rar.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\beastiality sleeping ash .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\beast fucking voyeur high heels .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\horse several models (Samantha,Ashley).zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\american cumshot cumshot [bangbus] boobs Ôï .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\sperm blowjob [bangbus] hole sm .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\american animal blowjob [free] leather (Sonja).mpg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\danish cumshot cum sleeping titts YEâPSè& .mpeg.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\french lesbian public hole .zip.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4436 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 4436 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 4436 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 4436 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 4436 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 4436 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 4684 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 4684 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe
PID 4684 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe

"C:\Users\Admin\AppData\Local\Temp\ae1139c1aeaf498f4f0382f9b9737d719b7f48f109593c33becd668eca2e5f3a.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 144.205.80.121.in-addr.arpa udp
US 8.8.8.8:53 127.164.145.51.in-addr.arpa udp
US 8.8.8.8:53 90.58.212.104.in-addr.arpa udp
US 8.8.8.8:53 240.248.111.182.in-addr.arpa udp
US 8.8.8.8:53 40.114.123.110.in-addr.arpa udp
US 8.8.8.8:53 76.82.42.145.in-addr.arpa udp
US 8.8.8.8:53 47.245.150.117.in-addr.arpa udp
US 8.8.8.8:53 127.125.137.31.in-addr.arpa udp
US 8.8.8.8:53 247.234.4.249.in-addr.arpa udp
US 8.8.8.8:53 159.69.173.234.in-addr.arpa udp
US 8.8.8.8:53 233.76.228.81.in-addr.arpa udp
US 8.8.8.8:53 253.240.198.152.in-addr.arpa udp
US 8.8.8.8:53 54.243.211.201.in-addr.arpa udp
US 8.8.8.8:53 103.239.233.55.in-addr.arpa udp
US 8.8.8.8:53 229.105.185.247.in-addr.arpa udp
US 8.8.8.8:53 98.65.219.29.in-addr.arpa udp
US 8.8.8.8:53 115.252.28.199.in-addr.arpa udp
US 8.8.8.8:53 246.103.33.126.in-addr.arpa udp
US 8.8.8.8:53 161.33.200.243.in-addr.arpa udp
US 8.8.8.8:53 191.77.29.64.in-addr.arpa udp
US 8.8.8.8:53 141.67.195.15.in-addr.arpa udp
US 8.8.8.8:53 130.202.216.164.in-addr.arpa udp
US 8.8.8.8:53 233.99.115.9.in-addr.arpa udp
US 8.8.8.8:53 213.151.46.54.in-addr.arpa udp
US 8.8.8.8:53 127.245.101.155.in-addr.arpa udp
US 8.8.8.8:53 120.199.215.77.in-addr.arpa udp
US 8.8.8.8:53 62.20.181.22.in-addr.arpa udp
US 8.8.8.8:53 166.127.254.59.in-addr.arpa udp
US 8.8.8.8:53 104.172.135.107.in-addr.arpa udp
US 8.8.8.8:53 131.43.156.114.in-addr.arpa udp
US 8.8.8.8:53 13.116.232.178.in-addr.arpa udp
US 8.8.8.8:53 221.189.167.29.in-addr.arpa udp
US 8.8.8.8:53 153.126.80.117.in-addr.arpa udp
US 8.8.8.8:53 5.86.86.174.in-addr.arpa udp
US 8.8.8.8:53 137.49.16.32.in-addr.arpa udp
US 8.8.8.8:53 163.40.19.179.in-addr.arpa udp
US 8.8.8.8:53 169.28.233.4.in-addr.arpa udp
US 8.8.8.8:53 82.94.24.85.in-addr.arpa udp
US 8.8.8.8:53 234.132.240.58.in-addr.arpa udp
US 8.8.8.8:53 118.115.192.64.in-addr.arpa udp
US 8.8.8.8:53 198.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 120.124.80.121.in-addr.arpa udp
US 8.8.8.8:53 79.123.80.69.in-addr.arpa udp
US 8.8.8.8:53 196.5.170.86.in-addr.arpa udp
US 8.8.8.8:53 153.13.49.62.in-addr.arpa udp
US 8.8.8.8:53 185.72.43.71.in-addr.arpa udp
US 8.8.8.8:53 141.129.107.54.in-addr.arpa udp
US 8.8.8.8:53 121.245.15.107.in-addr.arpa udp
US 8.8.8.8:53 251.98.205.200.in-addr.arpa udp
US 8.8.8.8:53 157.252.253.137.in-addr.arpa udp
US 8.8.8.8:53 83.208.70.219.in-addr.arpa udp
US 8.8.8.8:53 77.87.19.134.in-addr.arpa udp
US 8.8.8.8:53 53.109.55.167.in-addr.arpa udp
US 8.8.8.8:53 232.70.114.253.in-addr.arpa udp
US 8.8.8.8:53 84.57.220.21.in-addr.arpa udp
US 8.8.8.8:53 21.71.175.161.in-addr.arpa udp
US 8.8.8.8:53 238.28.164.121.in-addr.arpa udp
US 8.8.8.8:53 121.24.89.42.in-addr.arpa udp
US 8.8.8.8:53 2.144.137.114.in-addr.arpa udp
US 8.8.8.8:53 217.120.97.11.in-addr.arpa udp
US 8.8.8.8:53 253.127.21.30.in-addr.arpa udp
US 8.8.8.8:53 19.188.79.247.in-addr.arpa udp
US 8.8.8.8:53 134.133.172.165.in-addr.arpa udp
US 8.8.8.8:53 249.107.193.87.in-addr.arpa udp
US 8.8.8.8:53 196.226.197.208.in-addr.arpa udp
US 8.8.8.8:53 101.183.145.237.in-addr.arpa udp
US 8.8.8.8:53 2.239.159.170.in-addr.arpa udp
US 8.8.8.8:53 4.59.230.3.in-addr.arpa udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\blowjob catfight mistress .mpg.exe

MD5 a4fd8f3ae5fb6701b0a907ea42d8570b
SHA1 d6b52ac24121207b92b6b22dc6e28d83d51d2e91
SHA256 bca0d571ece258ab17fba6a8230ce5338f8653d8392ef3711ca048ff7906c835
SHA512 964fe02cff0e39191ce18fa61b4d1aa9683ccebb512cccd8ab7850f72662d7560021c96c6cb1466b7879278111e8024a3dc29c942f46c8c6253975b56d08e03b