Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 19:34
Static task
static1
Behavioral task
behavioral1
Sample
266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe
Resource
win10v2004-20240611-en
General
-
Target
266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe
-
Size
1.1MB
-
MD5
3d6ca644d58bc8e63da093998096ab6f
-
SHA1
5d5e435947cc258797243cffd083b17a907c98a2
-
SHA256
266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d
-
SHA512
e74513d7577b1a520c0f93ad8e86502ebdb226aaaaa466cd80b62c07fe8187842f912fd0aba2b4337131ea921f7f3189a4236144c3f5ca42e0d11d98aa5a992a
-
SSDEEP
24576:Qdl2YYUENpK6oPGG6AsPY1HBRTap1UuE2Gnl:Qdl2YYHNk6oPvcURTapmuKl
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023370-4.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\J: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\M: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\P: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\X: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\Y: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\G: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\L: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\Q: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\W: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\A: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\B: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\O: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\S: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\Z: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\H: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\I: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\K: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\N: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\R: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\T: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\U: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File opened (read-only) \??\V: 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\fucking uncut high heels (Sandy,Liz).rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian animal gay full movie boots .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\italian handjob sperm several models hole swallow (Sarah).mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\System32\DriverStore\Temp\japanese cumshot lesbian voyeur cock (Ashley,Sarah).rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\IME\SHARED\swedish fetish lesbian full movie glans .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\hardcore licking granny .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\config\systemprofile\african blowjob licking hole gorgeoushorny (Tatjana).zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\IME\SHARED\american beastiality fucking public boots .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese gang bang blowjob several models .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\FxsTmp\nude blowjob [bangbus] cock (Sandy,Tatjana).mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\hardcore catfight feet traffic .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\brasilian animal lesbian big cock .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\tyrkish nude hardcore lesbian titts .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\Microsoft Office\root\Templates\gay sleeping boots .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\bukkake licking .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files (x86)\Google\Temp\brasilian action lingerie uncut cock .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\dotnet\shared\tyrkish cumshot horse hidden (Samantha).zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\tyrkish horse gay voyeur stockings .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\gay [free] shower .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\Microsoft Office\Updates\Download\hardcore sleeping swallow (Sonja,Sylvia).mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\russian horse beast hot (!) ejaculation .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\japanese fetish sperm [milf] girly .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\fucking full movie 40+ .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files (x86)\Google\Update\Download\swedish kicking beast full movie latex .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\beast lesbian titts circumcision (Karin).mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\japanese animal trambling lesbian (Liz).avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\horse girls (Liz).avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\norwegian sperm big .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\brasilian porn horse masturbation titts femdom (Liz).mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\gay [free] .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\handjob horse [free] latex .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\black nude trambling catfight .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\spanish lesbian full movie .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\spanish lesbian girls titts hairy .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\gang bang xxx masturbation .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\porn beast catfight .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\xxx public .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\french bukkake sleeping shoes (Sonja,Karin).mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\gang bang horse full movie sweet .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\russian action hardcore lesbian cock ejaculation .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\horse beast catfight lady .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\italian gang bang gay masturbation glans .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\italian horse xxx public bondage .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\cumshot beast lesbian .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\cum lesbian [milf] bondage .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\german horse hot (!) 40+ .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\brasilian cumshot fucking public .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\asian lingerie [free] mistress .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\indian cum fucking hidden cock (Christine,Samantha).zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\lingerie catfight titts .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\brasilian horse gay hot (!) femdom (Britney,Karin).avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\danish handjob trambling [bangbus] feet traffic .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\black kicking bukkake masturbation black hairunshaved .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\norwegian blowjob full movie .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\InstallTemp\sperm catfight balls .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\tyrkish cumshot horse hidden black hairunshaved .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\spanish lesbian hot (!) .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\norwegian trambling licking lady .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\brasilian gang bang xxx public .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\brasilian cum horse [bangbus] pregnant .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\horse masturbation lady .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\horse lesbian full movie feet hairy (Sylvia).mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\chinese blowjob hot (!) .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\japanese kicking lesbian full movie glans .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\gang bang lesbian catfight .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\french gay several models glans .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\norwegian fucking masturbation feet femdom .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\blowjob hot (!) titts ¤ç (Melissa).avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\hardcore sleeping .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\sperm several models .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\animal bukkake lesbian (Melissa).avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\french lingerie hidden shower .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\blowjob voyeur glans .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\danish beastiality lesbian hidden granny .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\japanese beastiality lingerie sleeping (Sylvia).zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\action lingerie sleeping hole YEâPSè& .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\swedish action fucking hot (!) YEâPSè& .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\russian action beast hot (!) .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\porn blowjob [milf] YEâPSè& .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\japanese handjob lingerie hot (!) feet .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\british xxx hidden sweet .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\indian gang bang fucking full movie glans bondage .avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\norwegian lesbian public leather .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\cumshot xxx uncut titts .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\swedish action gay [bangbus] granny .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\canadian bukkake voyeur lady .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\action blowjob lesbian (Melissa).rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\trambling licking ejaculation .mpg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\asian hardcore [bangbus] .mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\swedish porn blowjob sleeping cock bedroom (Samantha).mpeg.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\porn horse hot (!) circumcision .zip.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\nude blowjob masturbation hole .rar.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\danish nude horse several models hole latex (Karin).avi.exe 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 4576 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4652 wrote to memory of 2468 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 86 PID 4652 wrote to memory of 2468 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 86 PID 4652 wrote to memory of 2468 4652 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 86 PID 2468 wrote to memory of 4576 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 87 PID 2468 wrote to memory of 4576 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 87 PID 2468 wrote to memory of 4576 2468 266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe"C:\Users\Admin\AppData\Local\Temp\266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe"C:\Users\Admin\AppData\Local\Temp\266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe"C:\Users\Admin\AppData\Local\Temp\266e4d98b8f1f00e13ad6eaef9c1a3ae7439c819948e67519e46cdbbc6493d5d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\beast lesbian titts circumcision (Karin).mpeg.exe
Filesize130KB
MD56c19f36164f36f5cc1df29823f229b1b
SHA191e450c19077f11b55c28d6c4e5a4ae28229f616
SHA256cef801fe8a3bfc9ad200eb54d96e12926736fc28c59f9eff1904f19b7ad4b6ac
SHA512d85c0353077870b73db2fa069bc7059b5bb35a07198ced6ea3aaebe792f986aa6214e3ccfcc31962615db29c9930bf04ef08f581ee88c63e8a5fa8ffda434ec2