3.5
中危
64 个模型检测该样本为恶意！
重新分析
更多

05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8

05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe

分析耗时

134s

最近分析

397天前

文件大小

85.6KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WINSXSBOT 更多 WIN32 TROJAN WORM GENERICKDZ
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.75
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Agent-URR [Trj] 20200213 18.4.3895.0
Baidu Win32.Worm.Agent.fj 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200213 2013.8.14.323
McAfee W32/Generic.worm.f 20200213 6.0.6.653
Tencent Worm.Win32.Agent.b 20200213 1.0.0.1
静态指标
查询计算机名称 (6 个事件)
Time & API Arguments Status Return Repeated
1727545329.250125
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545329.266125
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545329.266125
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545329.282125
GetComputerNameW
computer_name: TU-PC
success 1 0
1727545331.547125
GetComputerNameA
computer_name: TU-PC
success 1 0
1727545331.563125
GetComputerNameA
computer_name: TU-PC
success 1 0
一个或多个进程崩溃 (2 个事件)
Time & API Arguments Status Return Repeated
1727545375.563125
__exception__
exception.address: 0x73db7853
exception.instruction: mov dx, word ptr [eax]
exception.instruction_r: 66 8b 10 40 40 66 85 d2 75 f6 2b c7 d1 f8 5f 75
exception.symbol: WNetClearConnections+0x2de0 WNetCancelConnectionW-0x84 mpr+0x7853
exception.exception_code: 0xc0000005
registers.eax: 0
registers.ecx: 0
registers.edx: 0
registers.ebx: 1637363
registers.esp: 1637000
registers.ebp: 1637012
registers.esi: 1637152
registers.edi: 2
stacktrace: 
WNetEnumResourceW+0x5b5 WNetGetProviderNameW-0x133 mpr+0x360d @ 0x73db360d
WNetEnumResourceW+0x533 WNetGetProviderNameW-0x1b5 mpr+0x358b @ 0x73db358b
WNetEnumResourceW+0x500 WNetGetProviderNameW-0x1e8 mpr+0x3558 @ 0x73db3558
WNetClearConnections+0x2e5b WNetCancelConnectionW-0x9 mpr+0x78ce @ 0x73db78ce
WNetCancelConnection2W+0x15 WNetRestoreSingleConnectionW-0x322 mpr+0x8ce6 @ 0x73db8ce6
WNetCancelConnection2A+0x3c WNetCancelConnectionA-0x22 mpr+0xad8c @ 0x73dbad8c
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x2c10 @ 0x402c10
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x19e4 @ 0x4019e4
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x1a5e @ 0x401a5e
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x1b7a @ 0x401b7a
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x1c73 @ 0x401c73
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x4cd6 @ 0x404cd6
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

 success 0 0
1727545394.969125
__exception__
exception.address: 0x73db7853
exception.instruction: mov dx, word ptr [eax]
exception.instruction_r: 66 8b 10 40 40 66 85 d2 75 f6 2b c7 d1 f8 5f 75
exception.symbol: WNetClearConnections+0x2de0 WNetCancelConnectionW-0x84 mpr+0x7853
exception.exception_code: 0xc0000005
registers.eax: 0
registers.ecx: 0
registers.edx: 0
registers.ebx: 1637363
registers.esp: 1637004
registers.ebp: 1637016
registers.esi: 1637156
registers.edi: 2
stacktrace: 
WNetEnumResourceW+0x5b5 WNetGetProviderNameW-0x133 mpr+0x360d @ 0x73db360d
WNetEnumResourceW+0x533 WNetGetProviderNameW-0x1b5 mpr+0x358b @ 0x73db358b
WNetEnumResourceW+0x500 WNetGetProviderNameW-0x1e8 mpr+0x3558 @ 0x73db3558
WNetClearConnections+0x2e5b WNetCancelConnectionW-0x9 mpr+0x78ce @ 0x73db78ce
WNetCancelConnection2W+0x15 WNetRestoreSingleConnectionW-0x322 mpr+0x8ce6 @ 0x73db8ce6
WNetCancelConnection2A+0x3c WNetCancelConnectionA-0x22 mpr+0xad8c @ 0x73dbad8c
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x2b13 @ 0x402b13
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x1a0f @ 0x401a0f
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x1a5e @ 0x401a5e
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x1b7a @ 0x401b7a
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x1c73 @ 0x401c73
05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8+0x4cd6 @ 0x404cd6
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

 success 0 0
行为判定
动态指标
在文件系统上创建可执行文件 (50 out of 76 个事件)
file C:\ProgramData\Templates\american horse lingerie hot (!) (Janette).zip.exe
file C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay masturbation (Samantha).rar.exe
file C:\360Downloads\brasilian fetish xxx sleeping sweet .mpg.exe
file C:\Windows\ServiceProfiles\NetworkService\Downloads\lesbian sleeping redhair .zip.exe
file C:\Users\Administrator\Downloads\xxx sleeping hole .zip.exe
file C:\ProgramData\Microsoft\Windows\Templates\bukkake public redhair (Sonja,Curtney).rar.exe
file C:\Windows\System32\config\systemprofile\japanese kicking sperm [bangbus] glans .zip.exe
file C:\Users\All Users\Templates\sperm licking hairy .mpeg.exe
file C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\vv2221l6.default-esr\storage\temporary\horse voyeur titts .mpg.exe
file C:\Users\Public\Downloads\black gang bang bukkake several models mature .rar.exe
file C:\Windows\System32\FxsTmp\russian action lesbian hidden hole sm .zip.exe
file C:\Windows\PLA\Templates\italian fetish lesbian lesbian upskirt .avi.exe
file C:\Windows\Temp\black cumshot gay voyeur glans (Sonja,Jade).mpg.exe
file C:\Program Files\Windows Journal\Templates\danish nude sperm girls titts ash .zip.exe
file C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\beast public 40+ .rar.exe
file C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie hidden hotel (Sonja,Melissa).mpeg.exe
file C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\hardcore sleeping glans .avi.exe
file C:\360Downloads\360驱动大师目录\下载保存目录\SeachDownload\tyrkish gang bang lingerie big .mpg.exe
file C:\Users\Administrator\AppData\Local\Temp\fucking public titts (Sandy,Samantha).mpg.exe
file C:\Windows\Downloaded Program Files\russian gang bang beast uncut hole .rar.exe
file C:\Program Files (x86)\Common Files\microsoft shared\bukkake licking femdom (Ashley,Janette).rar.exe
file C:\Windows\assembly\tmp\xxx [free] .rar.exe
file C:\Windows\mssrv.exe
file C:\Windows\SoftwareDistribution\Download\brasilian fetish hardcore uncut cock femdom .mpeg.exe
file C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\lingerie hot (!) shower .mpeg.exe
file C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian licking 40+ .avi.exe
file C:\Users\tu\Downloads\bukkake [milf] cock .zip.exe
file C:\ProgramData\Microsoft\Search\Data\Temp\japanese cum beast [milf] (Karin).rar.exe
file C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\beast masturbation .mpeg.exe
file C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\gay sleeping .mpg.exe
file C:\Users\tu\AppData\Local\Temporary Internet Files\swedish porn horse full movie hole redhair (Melissa).avi.exe
file C:\Users\All Users\Microsoft\Windows\Templates\bukkake public titts .rar.exe
file C:\Users\Default\AppData\Local\Temp\american fetish fucking full movie hole hotel .mpg.exe
file C:\Users\tu\AppData\Roaming\Microsoft\Windows\Templates\xxx full movie titts latex .rar.exe
file C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\swedish action bukkake [bangbus] .rar.exe
file C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\lesbian masturbation (Sarah).mpeg.exe
file C:\Users\All Users\Microsoft\Search\Data\Temp\beast public .mpeg.exe
file C:\ProgramData\Microsoft\RAC\Temp\brasilian beastiality fucking licking (Liz).mpeg.exe
file C:\Users\tu\Templates\hardcore [milf] .mpg.exe
file C:\Windows\System32\IME\shared\brasilian beastiality blowjob [bangbus] shoes .mpg.exe
file C:\Program Files\DVD Maker\Shared\beast uncut .rar.exe
file C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\vv2221l6.default-esr\datareporting\glean\tmp\black action lingerie several models (Sarah).mpeg.exe
file C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\swedish handjob sperm hidden hole boots .rar.exe
file C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\tyrkish handjob gay hot (!) hole shoes .mpg.exe
file C:\Windows\System32\LogFiles\Fax\Incoming\lingerie public feet beautyfull (Melissa).avi.exe
file C:\Program Files\Windows Sidebar\Shared Gadgets\japanese beastiality blowjob several models (Tatjana).zip.exe
file C:\Windows\winsxs\InstallTemp\brasilian gang bang hardcore sleeping .mpg.exe
file C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish kicking beast hidden castration .zip.exe
file C:\Windows\security\templates\lesbian [free] feet .rar.exe
file C:\Users\tu\AppData\Local\Temp\tmp79750.WMC\chinese lingerie licking latex .rar.exe
将可执行文件投放到用户的 AppData 文件夹 (19 个事件)
file C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\swedish porn xxx hot (!) bondage .mpg.exe
file C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay masturbation (Samantha).rar.exe
file C:\Users\tu\AppData\Roaming\Microsoft\Windows\Templates\xxx full movie titts latex .rar.exe
file C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\vv2221l6.default-esr\storage\temporary\horse voyeur titts .mpg.exe
file C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\blowjob masturbation femdom .mpg.exe
file C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\vv2221l6.default-esr\datareporting\glean\tmp\black action lingerie several models (Sarah).mpeg.exe
file C:\Users\tu\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish porn horse full movie hole redhair (Melissa).avi.exe
file C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\hardcore full movie feet .zip.exe
file C:\Users\tu\AppData\Roaming\Microsoft\Windows\Templates\hardcore [milf] .mpg.exe
file C:\Users\tu\AppData\Local\Temp\danish porn lesbian [milf] latex (Gina,Jade).avi.exe
file C:\Users\tu\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm sleeping (Liz).avi.exe
file C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian kicking lesbian hot (!) feet fishy .mpeg.exe
file C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\american beastiality lesbian several models (Curtney).rar.exe
file C:\Users\Default\AppData\Local\Temp\american fetish fucking full movie hole hotel .mpg.exe
file C:\Users\tu\AppData\Local\Temp\tmp79750.WMC\chinese lingerie licking latex .rar.exe
file C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\american kicking beast [bangbus] .rar.exe
file C:\Users\Administrator\AppData\Local\Temp\fucking public titts (Sandy,Samantha).mpg.exe
file C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\trambling licking boots (Christine,Curtney).mpg.exe
file C:\Users\Administrator\AppData\Local\Temp\{5612CBE7-9CDF-4014-9454-1A3AE75C0CEE}.tmp\hardcore uncut .avi.exe
搜索运行中的进程，可能用于识别沙箱规避、代码注入或内存转储的进程 (2 个事件)
重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器 (50 out of 174 个事件)
Time & API Arguments Status Return Repeated
1727545302.422125
Process32NextW
snapshot_handle: 0x00000134
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 3012
failed 0 0
1727545304.891125
Process32NextW
snapshot_handle: 0x000002b8
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 3052
failed 0 0
1727545307.094125
Process32NextW
snapshot_handle: 0x00000280
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545309.094125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545311.094125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545313.094125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545315.094125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545317.110125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545319.125125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545321.125125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545323.125125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545325.141125
Process32NextW
snapshot_handle: 0x000002a8
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545327.157125
Process32NextW
snapshot_handle: 0x000002a8
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545329.172125
Process32NextW
snapshot_handle: 0x00000280
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545331.172125
Process32NextW
snapshot_handle: 0x000002d4
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545333.172125
Process32NextW
snapshot_handle: 0x00000368
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545335.172125
Process32NextW
snapshot_handle: 0x00000368
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545337.219125
Process32NextW
snapshot_handle: 0x0000031c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545339.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545341.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545343.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545345.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545347.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545349.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545351.219125
Process32NextW
snapshot_handle: 0x00000364
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545353.219125
Process32NextW
snapshot_handle: 0x00000364
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545355.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545357.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545359.219125
Process32NextW
snapshot_handle: 0x00000360
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545361.219125
Process32NextW
snapshot_handle: 0x0000029c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545363.219125
Process32NextW
snapshot_handle: 0x0000029c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545365.219125
Process32NextW
snapshot_handle: 0x0000029c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545367.219125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545369.219125
Process32NextW
snapshot_handle: 0x00000234
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545371.219125
Process32NextW
snapshot_handle: 0x0000029c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545373.235125
Process32NextW
snapshot_handle: 0x000002b0
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545375.235125
Process32NextW
snapshot_handle: 0x00000288
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545377.235125
Process32NextW
snapshot_handle: 0x000002c4
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545379.250125
Process32NextW
snapshot_handle: 0x000002b0
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545381.266125
Process32NextW
snapshot_handle: 0x000002b0
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545383.282125
Process32NextW
snapshot_handle: 0x000002c4
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545385.297125
Process32NextW
snapshot_handle: 0x0000031c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545387.297125
Process32NextW
snapshot_handle: 0x0000031c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545389.313125
Process32NextW
snapshot_handle: 0x0000031c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545391.313125
Process32NextW
snapshot_handle: 0x0000031c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545393.328125
Process32NextW
snapshot_handle: 0x000002dc
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545395.328125
Process32NextW
snapshot_handle: 0x00000324
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545397.328125
Process32NextW
snapshot_handle: 0x0000032c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545399.328125
Process32NextW
snapshot_handle: 0x0000032c
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
1727545401.328125
Process32NextW
snapshot_handle: 0x00000258
process_name: 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe
process_identifier: 1464
failed 0 0
网络通信
与未执行 DNS 查询的主机进行通信 (9 个事件)
host 114.114.114.114
host 45.126.244.216
host 8.8.8.8
host 19.199.244.138
host 99.249.194.154
host 150.161.105.138
host 214.204.54.94
host 179.120.100.219
host 223.87.37.130
一个进程试图延迟分析任务。 (1 个事件)
description 05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe 试图睡眠 1240.54 秒，实际延迟分析时间 1240.54 秒
枚举服务，可能用于反虚拟化 (50 out of 9144 个事件)
Time & API Arguments Status Return Repeated
1727545300.422125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.422125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.422125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.422125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.438125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.453125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.469125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.485125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.485125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.485125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
1727545300.485125
EnumServicesStatusA
service_handle: 0x005bc828
service_type: 48
service_status: 1
failed 0 0
在 Windows 启动时自我安装以实现自动运行 (1 个事件)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 reg_value C:\Windows\mssrv.exe€ÿ@P?\ÿÜ@@°8YèÙ[šl[wèÙ[P?\n°8YH=\ÄYèúTÍø;z8ûxÿÍ_wé^%þÿÿÿz8[wr4[wH=\no@=\0ü¿évYH=\Ã@\ýÜÞH=\Øþâ@
创建已知的 WinSxsBot/Sfone Worm 文件、注册表项和/或互斥体 (1 个事件)
mutex mutex666
生成一些 ICMP 流量
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意 (50 out of 64 个事件)
ALYac Trojan.GenericKDZ.52373
APEX Malicious
AVG Win32:Agent-URR [Trj]
Acronis suspicious
Ad-Aware Trojan.GenericKDZ.52373
AhnLab-V3 Worm/Win32.Agent.R233959
Antiy-AVL Worm/Win32.Agent.cp
Arcabit Trojan.Generic.DCC95
Avast Win32:Agent-URR [Trj]
Avira TR/Spy.Gen
Baidu Win32.Worm.Agent.fj
BitDefender Trojan.GenericKDZ.52373
BitDefenderTheta Gen:NN.ZexaF.34090.fmX@aiU8KBe
CAT-QuickHeal Worm.Sfone.A3
CMC Worm.Win32.Agent!O
ClamAV Win.Malware.Sfone-6763601-0
Comodo Worm.Win32.Agent.CP@42tt
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.ebbd53
Cylance Unsafe
Cyren W32/Worm.KOKR-0749
DrWeb Win32.HLLW.Siggen.1607
ESET-NOD32 Win32/Agent.CP
Emsisoft Trojan.GenericKDZ.52373 (B)
Endgame malicious (high confidence)
F-Prot W32/Worm.BLGI
F-Secure Trojan.TR/Spy.Gen
FireEye Generic.mg.d0cb5d0ebbd53fc0
Fortinet W32/Agent.CP!worm
GData Trojan.GenericKDZ.52373
Ikarus Worm.Win32.Agent.cp
Invincea heuristic
Jiangmin Worm/Agent.te
K7AntiVirus Trojan ( 00008f2e1 )
K7GW Trojan ( 00008f2e1 )
Kaspersky Worm.Win32.Agent.cp
MAX malware (ai score=80)
Malwarebytes Worm.Sform
MaxSecure Trojan.Malware.300983.susgen
McAfee W32/Generic.worm.f
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.mh
MicroWorld-eScan Trojan.GenericKDZ.52373
Microsoft Worm:Win32/Sfone.A
NANO-Antivirus Trojan.Win32.Agent.hakuu
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM20.1.36DD.Malware.Gen
Rising Worm.Agent!1.BDD2 (RDMK:cmRtazr0awrSRYqV4afE6Dm5UMo0)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/Agent-AGQR
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2006-03-03 01:50:37

PE Imphash

6c1be0fe5089acb4fbc378d42c6bbc3e

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000a566 0x0000a600 6.445971934672953
.rdata 0x0000c000 0x00006504 0x00006600 5.172291893343914
.data 0x00013000 0x000041c0 0x00004000 4.861337923221944

Imports

Library KERNEL32.DLL:
• 0x416704 GetDriveTypeA
• 0x41670c GetComputerNameA
• 0x416710 GetLastError
• 0x416714 Sleep
• 0x416718 GetModuleFileNameA
• 0x41671c GetLocalTime
• 0x416720 CreateThread
• 0x416724 OpenMutexA
• 0x416728 ReleaseMutex
• 0x41672c CreateMutexA
• 0x416730 CloseHandle
• 0x416734 GetVersionExA
• 0x416738 CreateFileA
• 0x41673c CreateFileMappingA
• 0x416740 MapViewOfFile
• 0x416744 WriteFile
• 0x416748 SetFilePointer
• 0x41674c FindFirstFileA
• 0x416750 FindNextFileA
• 0x416754 FindClose
• 0x416758 OpenProcess
• 0x41675c TerminateProcess
• 0x416764 Process32First
• 0x416768 Process32Next
• 0x41676c LoadLibraryA
• 0x416770 GetProcAddress
• 0x416774 FreeLibrary
• 0x416780 GetStartupInfoA
• 0x416784 GetModuleHandleA
• 0x416788 VirtualAlloc
• 0x41678c VirtualQuery
• 0x416790 HeapCreate
• 0x416794 HeapDestroy
• 0x416798 HeapAlloc
• 0x41679c HeapReAlloc
• 0x4167a0 HeapFree
• 0x4167a4 HeapSize
• 0x4167a8 HeapValidate
• 0x4167ac ExitProcess
• 0x4167b0 RtlUnwind
• 0x4167b4 GetFileType
• 0x4167b8 GetStdHandle
• 0x4167bc GetCurrentProcess
• 0x4167c0 DuplicateHandle
• 0x4167c4 SetHandleCount
• 0x4167c8 GetCommandLineA
• 0x4167dc SetStdHandle
• 0x4167e0 DeleteFileA
• 0x4167e4 ReadFile
• 0x4167e8 SetEndOfFile
Library ADVAPI32.dll:
• 0x41669c RegOpenKeyExA
• 0x4166a0 RegQueryValueExA
• 0x4166a4 RegCloseKey
• 0x4166a8 RegSetValueExA
• 0x4166ac RegConnectRegistryA
• 0x4166b0 OpenSCManagerA
• 0x4166b4 LockServiceDatabase
• 0x4166b8 OpenServiceA
• 0x4166c0 StartServiceA
• 0x4166c4 CloseServiceHandle
• 0x4166cc EnumServicesStatusA
• 0x4166d0 ControlService
• 0x4166d4 DeleteService
Library MPR.dll:
• 0x4166e8 WNetAddConnection2A
• 0x4166f0 WNetOpenEnumA
• 0x4166f4 WNetEnumResourceA
• 0x4166f8 WNetCloseEnum
• 0x4166fc WNetGetConnectionA
Library SHELL32.dll:
• 0x4166dc FindExecutableA
• 0x4166e0 ShellExecuteA
Library USER32.dll:
• 0x4167f0 GetWindowTextA
• 0x4167f8 EnumWindows
Library WS2_32.dll:
• 0x416800 socket
• 0x416804 htonl
• 0x416808 htons
• 0x41680c bind
• 0x416810 recvfrom
• 0x416814 sendto
• 0x416818 WSAStartup
• 0x41681c WSACleanup
• 0x416820 inet_addr
• 0x416824 gethostbyname
• 0x416828 gethostbyaddr
L!This program cannot be run in DOS mode.
`.rdata
@.data
UlSVW}
uXndQ)
SVWM1E
PEPEPP?
Y1_^[]
U4SVW]
EPEPEPEP`
EPEPEPEPh
YtTEPEPEP<
)EPEPEP
PRYEPY1
uTCAE|
u=CAEPPEP
PYl_^[]
uU9r[]
U SVWE
EtFtB1
EPVSEP
9|<t8=
YEPhY@
PEPhO@
YEPhY@
PEPhE@
SVW}'@
YEPhY@
PEPhE@
PPPj$Pj
PPP$PVj
tfj k$
U$SVW]
U(SVW]
UPSVW}d
uX_^[]
UPSVW}
uX_^[]
uX_^[]
U(SVW}
uX_^[]
UDSVW}
uX_^[]
U`SVW}
uX_^[]
uX_^[]
U,SVW]
~%EP|YEPS
(EPYEPS
EP[YEPS
~%EPYEPSc
~%EP1YEPS&
:EPvYEPS
ULSVW}|
|EPUEP
u11#D$
CFIu1^[
U SVWE
9w60ZA
EEE7@ZA
EEEEPZA
Eu+]]PZA
E@EECUZUZEC
U4SVW1
9w60ZA
EEE7@ZA
EEEEELZA
9E}BLZA
[E9u9s
|9s"VaY
9Ew90ZA
CE9u8E
CE9u8E
U4SVW]
E9}rHE)E
EEE7@ZA
9Ew90ZA
FE9u8E
FE9u8E
9sV;5[A
YL;5[A
uEPSW^
U SVM]
EEE7@ZA
EEEEEE@EEU9u8E
|9E@EUEBUEBEU
9w60ZA
EEE7@ZA
EEEEE9E
CE9u8E
|3CEUEBUEBE
Eu%]]E
E@EECUZUZEC
EU);Eu
Ek(PQX
C<t"C<PC
C<PYC<
CHC,CHC
CHC0CHC
C(C _^[
u+=hZA
PSVWeh
9rSY(E
EEPEP#
YM_^[Md
BAKuD$
EbC0}lu
|PEP'
CHC,CHC
CHC0CHC
}"S Y1
}E_^[]
E9|+uU
UPSVW]
EHE\Et
EPVSEP1
U)_^[]
)U1_^[]
s01_^[]
VC20XC00U
USVWUj
t1;t$$t+4v
EUEURPj
UdSVWh
E;}|1pA
URPEPEP
>"u>F;t
FA>\t>"uU
YEPEPE
uE@P>Y
Et$E@E=
x:lt$E
BfEfEfEfE
x:luU
YIM]GU
M]M]M]M]M]M]
@,EEEEUB
+C +C$+C(EfC8
~OuF v
~Os F v
~0C$PC
~Os(F v
~LuC v
+WSV2(
PEPP,oA
PEPP,oA
U SVW]
uA>0u<
F>0t1u
PgfffX
uXPQX
dt }#PQX
EE_^[]
u0CPhY
^[]USV]
EPE@PO
*EEPEPE
U(SVW]
C,EEPN
EEPgfffX
PVEPEPE
E+E_^[]
9rtKSh
SVW0D$
UdSVW]
EPsYEu
MY9}|TC
EPJYE_^[]
ULSVW}
t0EHEEM
MRPSQM
MRPSQ
EUEHEEU
u}SQWVp
P8fP81E
fEf~VU
@,@EEfE
EfEfEf
fMEHEU
XfEf~O
EUEHEU0
0EHE}E
MfMEE80t
EfEfEf
fMEHEU
U9t}9u
U<SVW]
EPEPEPEPEPE
VY'EHu
CNu1^[]
1u;(u&j
Y1_^[]
PgfffX
9E}'E@E=
WVS1D$
EEU^[]U
ft,Ft'gt
P,JP,}
D89s/~
} fEfC
EEU^[]S\$
mssrv.exe
mssrv32
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mssrv32
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mssrv32
_:\*.*
mutex666
%i.%i.%i.%i
Error:
Administrator
freeftp.exe
explorer.exe
IE9setup.exe
pgp9.exe
undelete.exe
unformat.exe
defrag.exe
word.exe
soccer.exe
summergames.exe
defrag64.exe
speedup.exe
rundll64.exe
safetyserver.exe
drwatson32.exe
hdcleaner.exe
deinstall.exe
uninstall.exe
screensaver.scr
game3d.exe
driver.exe
install32.exe
start.exe
edit.exe
setup.exe
notes.txt.exe
readme.txt.exe
install.exe
\mssrv.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
incoming
download
C:\password.txt
%s -> %i
%s -> %s
%H:%M:%S
C:\debug.txt
Messenger
BIT-DEFENDER
BITDEFENDER
PROCESS VIEWER
MCAFEE
VET-REC
VETMSGNT
VETMONNT
VET-FILT
VETEFILE
VETEBOOT
CAISAFE
KAPERSKY
ANTIVIR
ZLCLIENT
ZONEALARM
ZONALM
ZAUINST
ZATUTOR
ZAPSETUP3001
XPF202EN
WSBGATE
WRCTRL
WRADMIN
WINRECON
WHOSWATCHINGME
WEBSCANX
WATCHDOG
W32DSM89
VSWINPERSE
VSWINNTSE
VSWIN9XE
VSSTAT
VSMAIN
VSISETUP
VSHWIN32
VSECOMR
VSCENU6
VPTRAY
VPFW30S
VNPC3000
VNLAN300
VFSETUP
VCSETUP
VBWINNTW
VBWIN9X
VBCONS
VBCMSERV
UPDATE
UNDOBOOT
TROJANTRAP
TRJSETUP
TRJSCAN
TRACERT
TITANINXP
TITANIN
TDS2-NT
TAUSCAN
TAUMON
TASKMON
TASKMGR
SYSEDIT
SYMPROXYSVC
SUPPORTER5
SUPFTRL
SS3EDIT
SPHINX
SHELLSPYINSTALL
AVSERVE
SGSSFW32
SETUPVAMEEVAL
SBSERV
SAFEWEB
RULAUNCH
RTVSCN95
RSHELL
RRGUARD
RESCUE32
RESCUE
RAV8WIN32ENG
QSERVER
QCONSOLE
PROTECTX
PROPORT
PROCEXPLORERV
PPVSTOP
PPINUPDT
PORTDETECTIVE
POPSCAN
POPROXY
PINGSCAN
PFWADMIN
PERSFW
PERISCOPE
PDSETUP
PCFWALLICON
PCDSETUP
PCCIOMON
PAVPROXY
PANIXK
PADMIN
OUTPOSTPROINSTALL
OUTPOSTINSTALL
OUTPOST
OSTRONET
NWTOOL16
NWINST4
NVARCH16
NUPGRADE
NSCHED32
NPROTECT
NPFMESSENGER
NORTON
NISSERV
NETSTAT
NETSPYHUNTER
NETSCANPRO
NETMON
NETINFO
NETARMOR
NEOMONITOR
NCINST4
NC2000
NAVW32
NAVSTUB
NAVAPW32
NAV80TRY
MSINFO32
MSCONFIG
MRFLUX
MOOLIVE
MINILOG
MFWENG3
MFW2EN
MCUPDATE
MCAGENT
LUINIT
LUCOMSERVER
LSETUP
LOCKDOWN
KILLPROCESS
KAVPERS
KAVLITE
JAMMER
IPARMOR
IFW2000
ICSUPPNT
ICSUPP95
ICSSUPPNT
ICLOADNT
ICLOAD95
IAMSERV
IAMAPP
HACKTRACERSETUP
GBPOLL
GBMENU
FSAV95
FSAV53
F-PROT
FP-WIN_TRIAL
FLOWPROTECTOR
FIREWALL
ESCANV95
ETrust
ESCANHNT
ESCANH95
DRWEBUPW
DRWATSON
DPFSETUP
DEPUTY
DEFWATCH
D3DUPDATE
CWNTDWMO
CWNB181
CPFNT206
CPF9X206
CMON016
CMGRDIAN
CLEANPC
CLEANER3
CLEANER
CFINET32
CFINET
CFIAUDIT
CFIADMIN
CFGWIZ
BOOTWARN
BLACKICE
BLACKD
BIPCPEVALSETUP
BIDSERVER
BD_PROFESSIONAL
AVWUPSRV
AVprotect9X
AVXQUAR
AVWUPD32
AVSYNMGR
AVPUPD
AVLTMAIN
AVGSERV9
AVCONSOL
AUTOUPDATE
AUTOTRACE
AUTODOWN
AUPDATE
AVGUARD
ATWATCH
ATUPDATER
ATRO55EN
ATGUARD
APVXDWIN
APLICA32
APIMONITOR
ANTIVIRUS
ANTI-TROJAN
AGENTSVR
000000
000007
007007
098765
100000
101010
111111
111222
112233
121212
123123
123456
123abc
131313
181818
191919
1q2w3e
212121
222222
232323
242424
246810
252525
313131
323232
343434
420420
444444
454545
555555
654321
666666
696969
777777
789456
888888
987654
999999
aaaaaa
abc123
abcdef
access
accord
action
adidas
adrian
aggies
airbus
alaska
albert
alexis
alfred
alicia
alison
alpha1
alyssa
amanda
andrea
andrew
angela
angels
animal
apache
apollo
apples
archer
arlene
arnold
arthur
asdfgh
ashley
assman
astros
athena
audrey
august
austin
avalon
avatar
azerty
babies
backup
badbad
badboy
badger
bailey
bambam
banana
bandit
barbie
barney
basket
batman
baxter
bbbbbb
beagle
beauty
beaver
beavis
beetle
bennie
berlin
bernie
bertha
bigboy
bigdog
bigguy
bigmac
bigman
bigone
bigred
birdie
bishop
biteme
blades
blazer
blowme
bobbob
bobcat
bobobo
boeing
bomber
bonnie
booboo
booger
boogie
boomer
bosco1
boston
bottle
bottom
bowler
brandy
braves
brazil
breast
brenda
bridge
bronco
brooke
brooks
browns
bruins
brutus
bubba1
bubble
buddha
buddy1
budman
bugger
bullet
burger
burton
buster
butter
byteme
cactus
caesar
calvin
camaro
camera
camero
canada
cannon
carlos
carmen
carpet
carrie
carter
casino
casper
cassie
castle
cccccc
celtic
center
cessna
chacha
champs
chance
cheese
cherry
cheryl
chicks
chiefs
chopin
chubby
claire
clancy
climax
clover
coffee
cohiba
colt45
compaq
condom
condor
connie
connor
cookie
cooler
cooper
copper
corona
cosmos
cotton
cougar
COWBOY
coyote
cruise
crunch
curtis
cutter
dagger
dakota
dallas
dancer
daniel
darren
david1
davids
dddddd
debbie
deedee
delphi
denali
denise
dennis
denver
desert
design
desire
devils
dexter
diablo
diesel
digger
disney
doctor
dodger
dogboy
dogdog
doggie
dogman
dollar
domino
donald
donkey
donnie
doobie
doodle
doogie
dragon
draven
dreams
driver
drizzt
ducati
dudley
duncan
dwight
EAGLE1
eagles
edward
eeeeee
eileen
elaine
elwood
empire
energy
engine
enigma
ernest
erotic
escape
escort
eugene
exodus
fabian
falcon
family
farmer
faster
fatboy
father
fatman
fender
fenris
ferret
fetish
ffffff
ficken
filter
finger
fisher
fishes
flower
fluffy
flyboy
flyers
flying
forest
france
franco
frank1
freaky
freddy
french
friday
friend
fright
froggy
fubar1
fucked
fucker
fuckit
fuckme
future
galaxy
garcia
garden
garion
gators
geheim
gemini
geneer
george
gerald
gerard
gerrit
giants
gibson
ginger
glider
gloria
goblue
golden
goldie
golfer
goober
gordon
gracie
graham
greene
greens
grover
grumpy
guitar
gunner
hacked
hacker
hahaha
hamlet
hammer
hannah
happy1
harder
hardon
harley
harris
harvey
hawaii
hearts
heaven
hector
helena
hello1
helmet
helpme
hentai
herbie
herman
hermes
hhhhhh
hiphop
hitman
hobbes
hockey
holden
holmes
homers
hooker
hooter
hoover
hopper
hornet
horney
Horny1
horses
hotdog
hotrod
hotsex
Howard
hudson
hummer
hunter
husker
ib6ub9
iceman
iguana
illini
impala
indian
ingrid
insane
inside
island
jackie
jaguar
james1
jammer
jasper
jeeper
jenny1
jeremy
jerome
jersey
jessie
jester
jetski
jjjjjj
joanne
johnny
jordan
joseph
joshua
julian
julius
jungle
junior
Justin
justme
kahuna
kaiser
katana
keeper
kermit
killer
kissme
kitten
kkkkkk
knicks
knight
kodiak
kramer
ladies
lagnaf
lakers
lancer
Lauren
laurie
lawyer
legend
leslie
lestat
lester
licker
lickit
lickme
lights
lionel
liquid
little
lizard
lolita
london
lonely
looker
louise
loveme
lovers
lucky1
lucky7
ludwig
maddog
madmax
maggie
magnet
magnum
magnus
maiden
malibu
manson
marcel
marcus
marina
marine
marino
marion
markus
marley
marlin
martha
martin
marvin
master
matrix
mature
maxima
maxine
mayhem
member
merlin
mexico
michel
mickey
miguel
miller
milton
minnie
mirage
Mistee
mister
mmmmmm
mobile
molly1
Monday
money1
monica
monkey
monroe
mookie
mooses
morgan
morris
mother
mozart
muffin
mulder
murphy
murray
muscle
music1
nadine
nascar
nathan
nelson
newman
newton
nicola
nicole
nissan
nitram
nobody
norman
norton
nudist
nugget
oakley
ohyeah
oldman
oliver
olivia
online
openup
orange
orchid
ou8122
pacman
palace
palmer
pamela
panama
pancho
panzer
parker
parrot
pascal
paulie
peanut
peewee
pencil
people
pepper
peters
philip
philly
picard
pickle
pierre
piglet
pirate
planet
player
please
poiuyt
police
Pookie
poopie
pooter
porter
postal
POWERS
pppppp
primus
prince
psycho
purple
pussy1
pussys
putter
python
qazwsx
qqqqqq
quartz
qwaszx
qwe123
qwerty
qwertz
rabbit
racerx
Rachel
racing
raider
ramsey
ranger
Raptor
rascal
raven1
reaper
rebels
red123
reddog
redman
redrum
redsox
reflex
reggie
regina
rhonda
richie
ripper
robbie
robert
rocket
rocky1
rodman
rodney
rogers
roland
roller
rommel
Ronald
ronnie
roscoe
roxanne
rumble
runner
sabine
Sailor
saints
salmon
sammy1
samsam
samson
samuel
sandie
sandra
saturn
savage
school
Scooby
scotty
scully
second
secret
seeker
sergio
series
server
sesame
sexsex
sexual
shadow
shaggy
sharky
sharon
shazam
shelby
Shelly
sherry
shorty
showme
sidney
sierra
sigrid
silver
silvia
simone
simple
single
sinner
sister
skibum
skippy
slayer
smelly
smiley
smitty
smokey
smokin
smooth
snakes
snatch
sniper
snoopy
soccer
sommer
sonics
sooner
sophie
SPANKY
sparky
spears
speedo
speedy
spider
spirit
spooky
sports
spring
spunky
squirt
ssssss
stacey
stefan
stella
steven
sticks
stimpy
stinky
stocks
stones
stormy
street
strike
stroke
strong
stupid
sucker
suckit
suckme
summer
sunset
surfer
suzuki
sweets
swords
sydney
sylvia
system
tamara
tanker
tanner
tardis
target
tattoo
taurus
taxman
taylor
tazman
techno
temple
tennis
teresa
tester
theman
thomas
tigers
tigger
timber
tinker
tintin
titman
tomcat
tomtom
tongue
topgun
toyota
tracey
trader
trains
travel
travis
trebor
trevor
tricky
triton
trixie
trojan
trucks
tttttt
tucker
turkey
turner
turtle
tweety
united
unreal
vagina
valley
velvet
victor
viking
violet
viper1
vipers
virgin
vision
volley
voodoo
voyeur
vulcan
waldo1
walker
walnut
walrus
walter
wanker
warren
weasel
werner
wesley
whynot
wicked
wilbur
willie
willow
wilson
window
winner
winnie
winter
wizard
wolves
wombat
wonder
woodie
woody1
wright
writer
xanadu
xavier
xfiles
xxxxxx
yamaha
yankee
yellow
zaphod
zipper
zombie
zxcvbn
zzzzzz
1234567
4runner
7777777
abcdefg
alabama
allison
amadeus
amateur
america
analsex
anthony
ANTONIO
aragorn
arizona
arsenal
asshole
atlanta
babylon
banshee
barbara
barkley
bastard
beatles
bennett
bernard
bethany
beverly
bigdick
bigfoot
bigtits
blaster
blondie
blowjob
bluesky
bond007
boobies
bradley
brandon
brendan
broncos
brother
bubbles
buckeye
buffalo
buffett
bulldog
cameron
capital
captain
carolyn
cartman
catfish
caveman
central
century
charles
charlie
chelsea
chester
chicago
CHICKEN
chipper
chopper
christy
classic
claudia
clayton
clinton
coconut
colleen
connect
control
cookies
country
cowboys
cricket
crystal
cumshot
curious
CYNTHIA
cypress
deborah
destiny
diamond
digital
dilbert
dodgers
dollars
dolphin
dorothy
douglas
dragons
dreamer
drummer
eclipse
emerald
express
fantasy
farside
ferrari
fireman
fishing
fitness
flipper
florida
flowers
forever
formula
francis
frankie
freddie
freedom
freeman
friends
frogger
fucking
fuckyou
funtime
gandalf
gateway
general
genesis
gilbert
goforit
golfer1
gorilla
gregory
griffey
gunther
hambone
hansolo
hawkeye
heather
hendrix
herbert
history
hithere
holland
homerun
hooters
horndog
hotmail
houston
hunting
huskers
iforgot
indiana
indians
integra
ireland
ironman
jackoff
Jackson
jacques
jasmine
jeffrey
jessica
johnson
jupiter
justice
kenneth
kickass
kingdom
kristin
leather
leonard
letmein
liberty
lincoln
looking
lucifer
machine
madison
madonna
mailman
mallard
manager
marines
master1
masters
matthew
maureen
Maurice
maxwell
melanie
melissa
mercury
michael
michele
miranda
mnbvcxz
monster
montana
mustang
natalie
natasha
natural
naughty
nemesis
network
newyork
nicolas
nipples
nirvana
nothing
october
ontario
oranges
packard
packers
pandora
pantera
panther
panties
passion
patches
patrick
peaches
peanuts
pegasus
penguin
pentium
phantom
phoenix
pinhead
pioneer
pirates
plastic
playboy
polaris
pontiac
porsche
prelude
printer
private
pumpkin
pussies
pyramid
racecar
raiders
rainbow
rangers
raymond
rebecca
redhead
redneck
redwing
richard
roberts
rooster
rosebud
russell
sabrina
sailing
sampson
samurai
sandman
santana
scooter
scorpio
scottie
seattle
service
shannon
sherman
shirley
shocker
shooter
shotgun
simpson
skeeter
skipper
skydive
snapper
snowman
softail
spartan
speaker
special
spencer
stanley
station
stealth
steeler
stephen
stewart
stinger
strange
student
success
tarheel
teacher
tequila
test123
testing
thebest
therock
thumper
thunder
tiffany
timothy
titanic
titties
toshiba
transam
trinity
triumph
trooper
trouble
trucker
TRUMPET
tuesday
twister
unicorn
valerie
vampire
vanessa
vermont
victory
vikings
vincent
voyager
wallace
warlock
warrior
webster
welcome
western
whiskey
wildcat
wildman
william
windows
wingman
winston
wolfman
yankees
zachary
zxcvbnm
00000000
11111111
12345678
21122112
69696969
77777777
87654321
88888888
aardvark
abcdefgh
airborne
airforce
airplane
alexande
anderson
asdfghjk
backdoor
baseball
benjamin
bigdaddy
bitchass
blahblah
bluebird
bluemoon
bobafett
bollocks
brittany
bullseye
bullshit
butthead
caligula
cardinal
carolina
caroline
cavalier
chandler
cherokee
chevelle
christin
chuckles
cocacola
colorado
columbia
computer
corvette
courtney
creative
danielle
darkstar
database
davidson
december
dickhead
director
discover
dolphins
drowssap
drummer1
einstein
electric
elephant
engineer
explorer
firebird
florence
football
franklin
fredfred
garfield
godzilla
goldberg
golfball
guinness
hamilton
hardcore
harrison
hastings
highland
hopeless
iloveyou
infantry
infinity
internet
intrepid
jennifer
jonathan
kathleen
kimberly
lasvegas
lisalisa
lockheed
longhorn
magnolia
margaret
marlboro
marshall
maryjane
maverick
meathead
mercedes
michelle
michigan
midnight
mountain
nicholas
november
panthers
paradise
password
patricia
peekaboo
platinum
playtime
pleasure
poiuytre
poohbear
presario
princess
pussycat
qqqqqqqq
qwertyui
qwertzui
redskins
redwings
research
rolltide
rush2112
samantha
saratoga
scorpion
scotland
security
seminole
semperfi
serenity
shithead
snickers
snowball
softball
spanking
spitfire
springer
stallion
stardust
stargate
startrek
starwars
steelers
sterling
stingray
sunshine
superman
sweetpea
testtest
theodore
trustno1
victoria
Virginia
wetlands
wetpussy
whatever
wildcats
Williams
wolfgang
wolverin
woodwork
wrangler
zeppelin
sqlserver
administator
gang bang
fucking
action
lingerie
fetish
trambling
kicking
hardcore
cumshot
blowjob
handjob
bukkake
beastiality
animal
several models
[free]
hot (!)
full movie
public
[milf]
[bangbus]
lesbian
sleeping
masturbation
voyeur
hidden
licking
catfight
nipples
vagina
gorgeoushorny
beautyfull
bedroom
shower
traffic
circumcision
ejaculation
penetration
leather
upskirt
black hairunshaved
high heels
pregnant
mature
granny
stockings
femdom
castration
bondage
swallow
redhair
mistress
blondie
Ashley
Christine
Melissa
Anniston
Curtney
Britney
Samantha
Sylvia
Janette
Kathrin
Tatjana
british
indian
swedish
canadian
brasilian
spanish
italian
french
danish
norwegian
russian
malaysia
japanese
chinese
african
american
german
tyrkish
IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
ICMP.DLL
hjltzL
:AM:PM
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
|%a %b %e %T %Y|%m/%d/%y|%H:%M:%S|%I:%M:%S %p
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
Day Mon dd hh:mm:ss yyyy
TIMEZONE
(null)
00000000000000000000000000000000
:(2099)1231
:UTC:UTC:%+04.4ld
:(%04.4hu)%02.2hu%02.2hu%02.2hu
:%02.2hu%02.2hu%02.2hu+%1.1hu
:%02.2hu31%02.2hu-%1.1hu
0123456789abcdefghijklmnopqrstuvwxyz
%H:%M:%S
%Y-%m-%d
%m/%d/%y
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
0123456789abcdef
0123456789ABCDEF
0HwZ<s
0123456789ABCDEF
0123456789abcdef
-- terminating
signal #
termination request
invalid storage access
interruption
invalid executable code
arithmetic error
thisisapassword!
:EST:EDT:-0500
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegConnectRegistryA
OpenSCManagerA
LockServiceDatabase
OpenServiceA
ChangeServiceConfigA
StartServiceA
CloseServiceHandle
UnlockServiceDatabase
EnumServicesStatusA
ControlService
DeleteService
ADVAPI32.dll
FindExecutableA
ShellExecuteA
SHELL32.dll
WNetAddConnection2A
WNetCancelConnection2A
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
WNetGetConnectionA
MPR.dll
GetDriveTypeA
GetWindowsDirectoryA
GetComputerNameA
GetLastError
GetModuleFileNameA
GetLocalTime
CreateThread
OpenMutexA
ReleaseMutex
CreateMutexA
CloseHandle
GetVersionExA
CreateFileA
CreateFileMappingA
MapViewOfFile
WriteFile
SetFilePointer
FindFirstFileA
FindNextFileA
FindClose
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
GetProcAddress
FreeLibrary
KERNEL32.DLL
GetWindowTextA
GetWindowThreadProcessId
EnumWindows
USER32.dll
WS2_32.dll
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
GetStartupInfoA
GetModuleHandleA
VirtualAlloc
VirtualQuery
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
HeapValidate
ExitProcess
RtlUnwind
GetFileType
GetStdHandle
GetCurrentProcess
DuplicateHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetTimeZoneInformation
SetStdHandle
DeleteFileA
ReadFile
SetEndOfFile
`Y2Y->9
Ob$2_)%
A*2'=!d>v<'
V)%;E33h
-aJL!%%/
LH(=#PW7-
:$|'H7W
'47{92d)'f
'+Rf'c'&
j-IF0F:n&
~5P=JI?
xi|$iH%Ld$e
*^'Q27#
/3?Fu}0(K&
}/2>.N
J%,XT*?)*
|m<]x.n
]#t9mJ
m&\#q!
?$~9=4R
4?M3>J~c
f(Y*9u
%;(+$w%>
(4?'5>.
(L5,&2lL&)
Z08CW1[
9#0n(s
",=WO7:s;*<
*cT;r.
-.i:'^
E7>KZ'66i?#fC.
Q("&-Fo*]e
K6=?ph
"!/,\xL
C?*)u
RP%;}3qm
c1?'15F
z(Qa8i$
@jjjjjjj
@@@@@@@@@@@
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@
(null)
@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@
A{AsAkAcA[ASAKACA;A3A+A#A
A@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@

Process Tree

05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe, PID: 3012, Parent PID: 2236

default registry file network process services synchronisation iexplore office pdf

05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe, PID: 3052, Parent PID: 3012

default registry file network process services synchronisation iexplore office pdf

05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe, PID: 1464, Parent PID: 3012

default registry file network process services synchronisation iexplore office pdf

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 57665 114.114.114.114 53
192.168.56.101 57665 8.8.8.8 53
192.168.56.101 52215 224.0.0.252 5355
192.168.56.101 137 237.30.70.166 137
192.168.56.101 62361 114.114.114.114 53
192.168.56.101 58985 114.114.114.114 53
192.168.56.101 50075 114.114.114.114 53
192.168.56.101 50075 8.8.8.8 53
192.168.56.101 137 19.199.244.138 137
192.168.56.101 58624 114.114.114.114 53
192.168.56.101 62044 114.114.114.114 53
192.168.56.101 62044 8.8.8.8 53
192.168.56.101 137 150.161.105.138 137
192.168.56.101 62515 8.8.8.8 53
192.168.56.101 62515 114.114.114.114 53
192.168.56.101 137 214.204.54.94 137
192.168.56.101 60330 8.8.8.8 53
192.168.56.101 61322 8.8.8.8 53
192.168.56.101 61322 114.114.114.114 53
192.168.56.101 137 223.87.37.130 137

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

Source Destination ICMP Type Data
192.168.56.101 45.126.244.216 8
192.168.56.101 99.249.194.154 8
99.249.194.154 192.168.56.101 0
192.168.56.101 99.249.194.154 8
99.249.194.154 192.168.56.101 0
192.168.56.101 99.249.194.154 8
99.249.194.154 192.168.56.101 0
192.168.56.101 8.8.8.8 3
192.168.56.101 8.8.8.8 3
192.168.56.101 179.120.100.219 8

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 718b3a2d04fc9174_brasilian gang bang hardcore sleeping .mpg.exe
Filepath C:\Windows\winsxs\InstallTemp\brasilian gang bang hardcore sleeping .mpg.exe
Size 794.9KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a85ba713feba7e86b3a62d22044a7917
SHA1 ae9bfeeac3087f9085710bc31e13526bc5a416fb
SHA256 718b3a2d04fc9174eb27bf90377e7608f8ea36ec256ae94c96924704ef983549
CRC32 6AD048D6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 891ba8b86dfeb18d_swedish porn xxx hot (!) bondage .mpg.exe
Filepath C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\swedish porn xxx hot (!) bondage .mpg.exe
Size 863.3KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 61b0011b68105f6557cbce83c999ab22
SHA1 a11ed2d5bbf17ab50611a8ee91d763d3873dd4e9
SHA256 891ba8b86dfeb18de86abd23177634a448e7d708fff797a367bd114f16f7a7f4
CRC32 A59F43B0
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c45cca2c50d04a56_lesbian [free] feet .rar.exe
Filepath C:\Windows\security\templates\lesbian [free] feet .rar.exe
Size 416.2KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2dd02dd6864afb2223b7009da47c01ed
SHA1 ef455ded72a98b2c706aa1917a863b15fac1de64
SHA256 c45cca2c50d04a56a294e873886d9071bfd3ece41ce6b49cb4405b501e77cf60
CRC32 6B069C08
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 1b74a1aaee9faa85_japanese gang bang sperm uncut castration .avi.exe
Filepath C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\japanese gang bang sperm uncut castration .avi.exe
Size 1.1MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2edef64e4c6b0c2c81b5d1a6e68fb017
SHA1 1d962a6f95cd936733b93fa27a42b5f3f03309cf
SHA256 1b74a1aaee9faa85cbc3b951fe3cb59badc86e1efa10092916af043f2abc9c7a
CRC32 744CCABF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 78a4b6320c548db1_japanese handjob horse [bangbus] shoes .zip.exe
Filepath C:\Windows\SysWOW64\config\systemprofile\japanese handjob horse [bangbus] shoes .zip.exe
Size 1.3MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 42c7dceef10f6b7560289be47b350dad
SHA1 af5c6d937f465535aae7c6859deb6cf3e0587ea8
SHA256 78a4b6320c548db1e0047a5da91aaadf8431c03c00fa4086a3abb95341e169fc
CRC32 8732614D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7205d5e81bd6533f_gay masturbation (samantha).rar.exe
Filepath C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\gay masturbation (Samantha).rar.exe
Size 2.0MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2129afeae25d9485231943886df9131b
SHA1 fd4d3fbf39914b8367a1eb0fb9dfdbb988790deb
SHA256 7205d5e81bd6533f075458bc1f37cbcc255b256f00e6fe0c1d3afdb11807ae04
CRC32 E53AB242
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 9ddd86be76c10714_american horse lingerie hot (!) (janette).zip.exe
Filepath C:\ProgramData\Microsoft\Windows\Templates\american horse lingerie hot (!) (Janette).zip.exe
Size 1.9MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4786f69c89e82698f895bba2855e585d
SHA1 a3a76e1c3104b58b916c98db2be17a44374dd198
SHA256 9ddd86be76c10714906ae0ab0036996d3325c2fe388ce094db0ff58fc54f095f
CRC32 273460AD
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a578b98bcdff3ea4_lingerie hidden hotel (sonja,melissa).mpeg.exe
Filepath C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie hidden hotel (Sonja,Melissa).mpeg.exe
Size 1.6MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 915975cc73903990e3f4f50655dde9a6
SHA1 c1ce65a92a062d6b8c604a1ebebc85566737481f
SHA256 a578b98bcdff3ea46c9602f914c6a2251b3d5dbfae10dd9b728239437a64dd28
CRC32 361E8DC7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f7cf7abcfbb3b88d_xxx full movie titts latex .rar.exe
Filepath C:\Users\tu\AppData\Roaming\Microsoft\Windows\Templates\xxx full movie titts latex .rar.exe
Size 878.0KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d3597497be57a75ab0e15ab6785833bb
SHA1 780158e120a26affe88d34be948caeeebe25e938
SHA256 f7cf7abcfbb3b88dd2de84ad02b3d5c346a26a350ac7d10a69d96f87a6fee104
CRC32 D00415DE
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 25084c7e083b085d_brasilian fetish xxx sleeping sweet .mpg.exe
Filepath C:\360Downloads\brasilian fetish xxx sleeping sweet .mpg.exe
Size 1.4MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3d290e3c76ee51693dae2c13ce60f3b2
SHA1 02a00a65ef64997a89c938c70d07e2f5a5c94e8a
SHA256 25084c7e083b085de29e672bc5e2dac25e457d14d604f59c156085037fdcbc6c
CRC32 3A5F3F77
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e55e9241909e9b5f_horse voyeur titts .mpg.exe
Filepath C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\vv2221l6.default-esr\storage\temporary\horse voyeur titts .mpg.exe
Size 242.4KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7736fab9bc1df2a4f19f2749f0cb20c5
SHA1 43daef43f8584453e52783beba98da0c06e258b0
SHA256 e55e9241909e9b5fb8719f691a8ad60e1f9c59db3f82b214df4eaab91bac6905
CRC32 331A1397
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 52edc42b9c6fc7e7_swedish handjob sperm hidden hole boots .rar.exe
Filepath C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\swedish handjob sperm hidden hole boots .rar.exe
Size 989.2KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7de45d3902bc1d945905436786a2807c
SHA1 5867ae9778e46c7ee0576ddefff456f15b6849ed
SHA256 52edc42b9c6fc7e751911dba98bf915b9a943ab9d5c2d29be1829aa189398c28
CRC32 58CCB384
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 1c07108b9ebca15f_mssrv.exe
Filepath C:\Windows\mssrv.exe
Size 2.1MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9dee85b81d2ef045179b659992c1c87a
SHA1 fd5f5f092ad1b990f9aa2c6feb2ac4bf713249fc
SHA256 1c07108b9ebca15f6709bb683eef129f8eab1aec37fd86a809fca8219b38cee1
CRC32 CB0E2A4F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d86e27921a383c98_gay sleeping .mpg.exe
Filepath C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\gay sleeping .mpg.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d3005ed7f100fa627e09f7155648d845
SHA1 9a0506659168b9e42c5f999a1ccb460decefb7ff
SHA256 d86e27921a383c9824313834916fe8cd782255d398c86a113923d251c1117530
CRC32 BA9FCA89
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 794fdd4185db93a5_blowjob masturbation femdom .mpg.exe
Filepath C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\blowjob masturbation femdom .mpg.exe
Size 1.4MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 04eede3352b101737b1c38feaa6f800d
SHA1 151f986eaac0a5b28d79a67aa0aead793f7c7218
SHA256 794fdd4185db93a5ef280c16668adf8b79aa3e09cce3165cd7674dc25ef69908
CRC32 E89170C3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8d536b8c6bfa9d02_sperm several models hole pregnant .rar.exe
Filepath C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm several models hole pregnant .rar.exe
Size 241.3KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f907f60d6cd29e10f60a16c2c72befc7
SHA1 b807d9c37c325b0f2c75f6dac1dae661d1d82c3c
SHA256 8d536b8c6bfa9d029d6d7d9d6bb43d76e39779c19d7af0ea1b13123af8fb0590
CRC32 69535163
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a1b571d0cd1d7c95_black action lingerie several models (sarah).mpeg.exe
Filepath C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\vv2221l6.default-esr\datareporting\glean\tmp\black action lingerie several models (Sarah).mpeg.exe
Size 1.4MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 38b3dee249553538b5f670b27efb679f
SHA1 2f9d4cc678658825c1093159ce9a2f92d101e337
SHA256 a1b571d0cd1d7c95ee9d3a1c3590fd6032b226bc3908174fbcef324582bd2997
CRC32 4FE167D7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name be36c677866aee4a_swedish porn horse full movie hole redhair (melissa).avi.exe
Filepath C:\Users\tu\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish porn horse full movie hole redhair (Melissa).avi.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0ff579548d051f05901e7bae1e33471f
SHA1 fedb29caae4bb4d7496f316f451c1c1e238438ac
SHA256 be36c677866aee4a0c77dc5b923dac2a0d84ce7996a78a10a768eeb8792f7686
CRC32 2CABC7E6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f153e76c5a7f6d1c_beast public 40+ .rar.exe
Filepath C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\beast public 40+ .rar.exe
Size 1.9MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bbb64312b8f0ffc65385672f16bce93a
SHA1 b9d6b489c5972d564f9046aece5bb4382846b533
SHA256 f153e76c5a7f6d1c0abe6288dd0dc3093e781276e1106027434192c42c39fe7f
CRC32 AA1D3B02
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a410d9338f9329df_black gang bang bukkake several models mature .rar.exe
Filepath C:\Users\Public\Downloads\black gang bang bukkake several models mature .rar.exe
Size 1.6MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 995a4e604511dbefaf8aff71509cd2e0
SHA1 f036473d51e2cd45b7ed67b6a899aa1dd6c507ef
SHA256 a410d9338f9329dff0cf9fe2af4750280a6353d797414dc69c3770e795df03c5
CRC32 944C9861
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 86d80477864bcbf2_bukkake public titts .rar.exe
Filepath C:\ProgramData\Microsoft\Windows\Templates\bukkake public titts .rar.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e6ef4c4774f668840c044c60c149e615
SHA1 378636bd2819f1681ac305071f85d9919ecdcab4
SHA256 86d80477864bcbf2aeee4045b56cf162356a572a6f6695be85d4958348fd24ee
CRC32 3F05AD1C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 671074ac37192976_lesbian licking 40+ .avi.exe
Filepath C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian licking 40+ .avi.exe
Size 1.0MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a17d2ceb619512fcd6d0e785ce6ccd74
SHA1 65ea6709aa873924f3404353e39c7e99cf9fcb59
SHA256 671074ac371929766b4795229e6649830390393075d4066c3ea18902c3a06afa
CRC32 AD33633C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f5d7dab1a1b7191b_tyrkish handjob gay hot (!) hole shoes .mpg.exe
Filepath C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\tyrkish handjob gay hot (!) hole shoes .mpg.exe
Size 195.2KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 46be5edd77dee21676b1729690f76c6e
SHA1 7f021dbbedfd1a450fd1e09d8a9970f32c0883d2
SHA256 f5d7dab1a1b7191b4cb99f38c9a03a4f0b531b41db61a31d3467d92c36ee3295
CRC32 10C457FB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 65f29996934067cc_danish nude sperm girls titts ash .zip.exe
Filepath C:\Program Files\Windows Journal\Templates\danish nude sperm girls titts ash .zip.exe
Size 519.7KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a1c64cb382c7bab5bdfa81dbcc300298
SHA1 116e01fce5d394b8153c34d019a0c83caea7b1b0
SHA256 65f29996934067cc4871994fd83770ce8788ddf0baf85b027d4f929e03d54520
CRC32 EB135FFF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 118c29f096de44ab_italian cum lesbian [free] titts stockings .mpg.exe
Filepath C:\Windows\ServiceProfiles\LocalService\Downloads\italian cum lesbian [free] titts stockings .mpg.exe
Size 2.0MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 650adeeb0adba8dbe130a6659ac97b73
SHA1 dd95d3386329320d619c8b685b4f456b20c158ec
SHA256 118c29f096de44ab88c74e1b8882b6c2a8284e7b3bd883ae500bbe5dfe958b7a
CRC32 E519951E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 658c5843317c869c_japanese kicking sperm [bangbus] glans .zip.exe
Filepath C:\Windows\SysWOW64\config\systemprofile\japanese kicking sperm [bangbus] glans .zip.exe
Size 1.0MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 86182f66d785fc09aaa1c9502a209614
SHA1 c54fb29133300e7eb7e01432baceff905e9cc524
SHA256 658c5843317c869cf8c814b3dbdb2e95c9a6b5457dce9ec381347f43fd638e40
CRC32 57BACB15
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7000b78536e2c7c8_italian fetish lesbian lesbian upskirt .avi.exe
Filepath C:\Windows\PLA\Templates\italian fetish lesbian lesbian upskirt .avi.exe
Size 773.6KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c155e73d0e144c23ca73a01c94e5e632
SHA1 6461be18e33d3f931b5f85394806546fe399aaf0
SHA256 7000b78536e2c7c836bd0f2238c64cca369dfa71607858af2e85e7d77f82bc79
CRC32 B690A357
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0b806b3d17a55fc6_japanese beastiality blowjob several models (tatjana).zip.exe
Filepath C:\Program Files\Windows Sidebar\Shared Gadgets\japanese beastiality blowjob several models (Tatjana).zip.exe
Size 841.2KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b7d7b332f0d82b6fb0da291f0d01d80f
SHA1 36452f105806f290149d8311a427469ff0aa0c8b
SHA256 0b806b3d17a55fc6ac5bb7ab871a12b1f10d160a8656d2c4ee8e915bbad8710f
CRC32 0908B2E2
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4c4ba130a76e5cf3_japanese cum beast [milf] (karin).rar.exe
Filepath C:\ProgramData\Microsoft\Search\Data\Temp\japanese cum beast [milf] (Karin).rar.exe
Size 1.7MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ac1180636bbad83de5e637ed226a69ad
SHA1 ab05dad12964fffbbb2aa689198b2784042c1b12
SHA256 4c4ba130a76e5cf395f1dae6ed556cc099bbf664d052385aa64f0baecf8aa7db
CRC32 944B75F4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ece610899fdcb56f_italian cum trambling voyeur titts swallow (melissa).rar.exe
Filepath C:\Windows\SysWOW64\IME\shared\italian cum trambling voyeur titts swallow (Melissa).rar.exe
Size 555.6KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a870db4d62fea266a49dc1fcdd6f7795
SHA1 990a3cc7d1586a10af5cf1e218a79d9c18ce391b
SHA256 ece610899fdcb56f156ab41ff86c9d645dcca7ef959bb68d2874ea1c919a61ae
CRC32 62B6E3F6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 18621d0d5ce42dd8_lingerie hot (!) shower .mpeg.exe
Filepath C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\lingerie hot (!) shower .mpeg.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 258ad23740cdd16b1fd793bf6506378a
SHA1 b817306eea5700b75680466f79f73f905ef607d3
SHA256 18621d0d5ce42dd84f4f2434c96cfb8cec701588ff743e67c20c416df9ffc710
CRC32 60D52755
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f928da47a1262f3c_beast masturbation .mpeg.exe
Filepath C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\beast masturbation .mpeg.exe
Size 1.4MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6714a2b0ef837e52d29260579dd66f2d
SHA1 2cb765bdeda3879b9d24d60a01425b186a681bfc
SHA256 f928da47a1262f3cef9c59f31e89b3a3ebe1a20a3aa268e8065273b99807e67d
CRC32 921E8B6D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 35883c74bcc66300_hardcore full movie feet .zip.exe
Filepath C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\hardcore full movie feet .zip.exe
Size 1.4MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7bc0d4d8871fb6a39983aead865dc488
SHA1 2814b289dca5928d23432a30a4dbdde1b7d2990d
SHA256 35883c74bcc6630061e511aa63de30e655fa36249b6ab7d37e0f8686f6e2bd15
CRC32 3DD5CDA5
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 52eee3920932b3e0_russian cum lesbian lesbian (sylvia).mpeg.exe
Filepath C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian cum lesbian lesbian (Sylvia).mpeg.exe
Size 1.1MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4797fa96ade83bf3e4412656cbf47bb2
SHA1 f4e6d0e6797794371d64a2d0bf507c2714bf50fd
SHA256 52eee3920932b3e09c807266f2bd7afec3f3c675499ca71c2ba76c7658251c72
CRC32 5A80CC11
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 58075c85886c95da_hardcore [milf] .mpg.exe
Filepath C:\Users\tu\AppData\Roaming\Microsoft\Windows\Templates\hardcore [milf] .mpg.exe
Size 929.1KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 dd29335b6dca077e7d50564483a33a79
SHA1 6b28e452eeb4804f355044822a4b037db28b8a4b
SHA256 58075c85886c95da184de596a5daf7e9a101bad52b2ad16d66d891f41043314c
CRC32 3B2E21F6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0dc75eba99584584_lesbian masturbation (sarah).mpeg.exe
Filepath C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\lesbian masturbation (Sarah).mpeg.exe
Size 1.9MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ed404a0e5fdd6fa6e51f6f1fe0ce28a6
SHA1 9b55e28a10c84912e62893f3b611563936e6e89c
SHA256 0dc75eba995845847fe11e086cfc0cb3f2d91caf93df78c6610858ff1f1ea732
CRC32 BD5092DC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 11b3454d7c0131bb_tyrkish gang bang lingerie big .mpg.exe
Filepath C:\360Downloads\360驱动大师目录\下载保存目录\SeachDownload\tyrkish gang bang lingerie big .mpg.exe
Size 872.8KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0299dc23d3e647649d99165fad764da3
SHA1 67771b54afc20425a69c5587ddc34ec07e07e744
SHA256 11b3454d7c0131bb3257d1e61648c24476e7979b8bb32e4b12c1ab37c72e9df5
CRC32 D71C0686
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e8e35ef582324d84_horse masturbation hole castration .zip.exe
Filepath C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse masturbation hole castration .zip.exe
Size 1.2MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b5a23a6fd9b7c2de4267f5ed13b3aec6
SHA1 08e7397c5323b1bf4cc60c3b24d28c558b28509b
SHA256 e8e35ef582324d84779ff1c31ad77f8bcef24548c552a566808cde686212ba44
CRC32 16811FBB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ad88469d9c40ca38_brasilian beastiality blowjob [bangbus] shoes .mpg.exe
Filepath C:\Windows\SysWOW64\IME\shared\brasilian beastiality blowjob [bangbus] shoes .mpg.exe
Size 2.1MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e2141336e98f44daed118ddbb6db6142
SHA1 fb30152a4757d3836161ebdc8771e997a2244514
SHA256 ad88469d9c40ca38bcf5490ace9ccd86ab64a7d369c491ce7ae938e94774744b
CRC32 C820BC5E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f2841ab0089d569e_black horse beast licking black hairunshaved .mpeg.exe
Filepath C:\Users\Default\Downloads\black horse beast licking black hairunshaved .mpeg.exe
Size 686.3KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fdcb52d1026dac91dbc8ef0108ff5e6b
SHA1 f4cbb7eefd5ea129d88f9eb6ff55a9e6c11c65e4
SHA256 f2841ab0089d569e02cf2bf95da46daa47729a7ddbd49e9f0fafec8ad57b620f
CRC32 E078651E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7f1f24bab76609c1_debug.txt
Filepath C:\debug.txt
Size 183.0B
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type ASCII text, with CRLF line terminators
MD5 57895c4bab77152d7563a8d3201bbf16
SHA1 89661660c10455bacc65cc893f2c24f2446189ae
SHA256 7f1f24bab76609c1958aa27ca95b2472cec296077b87cf761fb90907771e0dd0
CRC32 36AEDD2B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fd66b30801bae7f0_beast public .mpeg.exe
Filepath C:\ProgramData\Microsoft\Search\Data\Temp\beast public .mpeg.exe
Size 171.2KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 854e43d2cd4612e7406925f0c157460f
SHA1 a1cfaef9ea395db905711aabb63b1bd40f53030d
SHA256 fd66b30801bae7f0212541821908fdc4009e5dd63494d4342c668ed0c9963ae6
CRC32 2B8CFE77
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 901d6bd609fadba2_black cumshot gay voyeur glans (sonja,jade).mpg.exe
Filepath C:\Windows\Temp\black cumshot gay voyeur glans (Sonja,Jade).mpg.exe
Size 233.7KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8e143f500c83670e8603cb041823b552
SHA1 df0dedeb414d963151ccd4c15d1714efec691555
SHA256 901d6bd609fadba2f8592deab13796473d600cb12bf21846c82d40794061b4f6
CRC32 316D43E4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 1b613e004bc71acc_danish porn lesbian [milf] latex (gina,jade).avi.exe
Filepath C:\Users\tu\AppData\Local\Temp\danish porn lesbian [milf] latex (Gina,Jade).avi.exe
Size 1.3MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 68979aca1d0ced10d1cece940abf42ce
SHA1 4835abcd3b2481c98360e88ebeb5fa31d6b3ff5b
SHA256 1b613e004bc71accb370eab29663318a0d39ddd5adf34cf8ac756351bcf54d45
CRC32 D89E756F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 22ed61a1e5408f7d_sperm licking hairy .mpeg.exe
Filepath C:\ProgramData\Microsoft\Windows\Templates\sperm licking hairy .mpeg.exe
Size 1.7MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bb479fce4bb542f0f8c550e73f8463d1
SHA1 7fa77c1029bad057638467fdeaf76c29642e9cab
SHA256 22ed61a1e5408f7df1bd79d786eafb7a7eaae3046b8d03634e045d9fa06011af
CRC32 52A6011F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name bc6e69912c80371f_lesbian sleeping redhair .zip.exe
Filepath C:\Windows\ServiceProfiles\NetworkService\Downloads\lesbian sleeping redhair .zip.exe
Size 984.0KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7524bccef2755f42c704f2e6aeea4973
SHA1 366be7e0a3217dd5680aa8d94056bb11e85872a9
SHA256 bc6e69912c80371fd1d32f9ee863bf9e828b1309e67ae4916f038848138d3d12
CRC32 F8F59867
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name cdc34c75bf8f59da_tyrkish kicking beast hidden castration .zip.exe
Filepath C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish kicking beast hidden castration .zip.exe
Size 365.6KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 036ac88d0111df39bd75073ae011bc8c
SHA1 9e70e4b7e00a22a7eca91ca8c43bec142802b772
SHA256 cdc34c75bf8f59da7dafc510b266d0e29d29322c5aa6737884690cef3216848f
CRC32 DEF38E9F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 71adb75ff0044bf0_sperm sleeping (liz).avi.exe
Filepath C:\Users\tu\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm sleeping (Liz).avi.exe
Size 1.8MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b727f86e5a343a48af453c9270f285be
SHA1 c0b7f04f4941a8468c48eeae8ab697b191dba952
SHA256 71adb75ff0044bf0717a8d33af9e3185a772b1ef71eecc7b73103ed6391d5f35
CRC32 EBEE1B0F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7644cabafeef1328_tyrkish fetish xxx [bangbus] hotel .avi.exe
Filepath C:\ProgramData\Microsoft\Network\Downloader\tyrkish fetish xxx [bangbus] hotel .avi.exe
Size 189.4KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f15eb13e2e7b3b20c73c00c86c636f07
SHA1 4037aaaefc1408d00f5179fe62c5862ace0a0d97
SHA256 7644cabafeef1328c159ef0930f66657b9bf3950573837baf29d8f6403c490d3
CRC32 974D4D60
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 1e0c133761437305_xxx [free] .rar.exe
Filepath C:\Windows\assembly\tmp\xxx [free] .rar.exe
Size 1.6MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0f3a7428b2892aaab7a40dd937ae9e67
SHA1 cbdfd890b5ef3930b89e158f3d2cdbbd5309cc28
SHA256 1e0c13376143730530a6df1ff26cd3585a41209d65215b5dadea93af0fb8e23b
CRC32 1D036981
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 31a48b6688f09db5_bukkake [milf] cock .zip.exe
Filepath C:\Users\tu\Downloads\bukkake [milf] cock .zip.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 06d21ffd907f86a5753db5dc10b6c125
SHA1 b0f123437a11ba8ca30e002cb4f554aa72304815
SHA256 31a48b6688f09db5b68da0fac61deb1f541590e5d1b66a7108f176c784729738
CRC32 C6610133
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 171c4f1ac34d26e9_swedish handjob blowjob licking feet (jenna,samantha).rar.exe
Filepath C:\ProgramData\Microsoft\Network\Downloader\swedish handjob blowjob licking feet (Jenna,Samantha).rar.exe
Size 1.9MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 baa45c95e10679bad4db5c1fd4c2eda3
SHA1 74c118e18e866c37de27ea61a94c2b706eb46bf0
SHA256 171c4f1ac34d26e957ab7af7b2393acc9258bd9d393a8728c22e819fdf485a34
CRC32 33F18593
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 64c14c1c81077909_brasilian kicking lesbian hot (!) feet fishy .mpeg.exe
Filepath C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian kicking lesbian hot (!) feet fishy .mpeg.exe
Size 1.0MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 38944a8b47de37ce01657d0efe3e7e77
SHA1 587947113c8a1559d9bc40dc50b79563504b7c7f
SHA256 64c14c1c81077909f1a7ec328bf7d4b7abcd2444aa9fdc6eb2fd814b81b07e2b
CRC32 36DEABCF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 578f0d1c86fe64bc_bukkake licking femdom (ashley,janette).rar.exe
Filepath C:\Program Files (x86)\Common Files\microsoft shared\bukkake licking femdom (Ashley,Janette).rar.exe
Size 830.9KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5c2732ba03ab184c3437f875d1b8cd5f
SHA1 21590bcc1395607790c330028f2ea98364757145
SHA256 578f0d1c86fe64bc24561bd5596ede1560b08efeb3c429c402554e9ddb5f40cb
CRC32 220146C6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 724fade330a54d5b_american beastiality lesbian several models (curtney).rar.exe
Filepath C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\american beastiality lesbian several models (Curtney).rar.exe
Size 787.9KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c2ffaf575c1df63931f6e373d3435dad
SHA1 6b328ee2c21f5533a0cdeae0ef5d1dc626d0a6b7
SHA256 724fade330a54d5b6aad0f9f1f208554dd0645e8054c43222c26ea2ee3166e3f
CRC32 B927068A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 93c86a27cdf3928d_brasilian beastiality fucking licking (liz).mpeg.exe
Filepath C:\ProgramData\Microsoft\RAC\Temp\brasilian beastiality fucking licking (Liz).mpeg.exe
Size 144.0KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7c7a11766381a4c472605d88b5ee6fee
SHA1 6300512efcf75f4072585b94a86697fb8bd2fdd7
SHA256 93c86a27cdf3928dc288f365640e09ce58054fa47a177b40196f00cb42c09835
CRC32 D7005D06
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 48029e203fdce031_trambling [milf] girly .mpg.exe
Filepath C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\trambling [milf] girly .mpg.exe
Size 267.2KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e41262ec5a79a8b615260b35b8f59fb7
SHA1 75e97583a76d335f7a4a1e4b2b0b7f5d4e42fe39
SHA256 48029e203fdce031fa046445df9cfa59eebf12fd04b46e780a7af369d0acf8ee
CRC32 615A83DC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 9419f09cafab1b63_swedish action bukkake [bangbus] .rar.exe
Filepath C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\swedish action bukkake [bangbus] .rar.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f12c8b2717a0c9392e1008fab71f4a03
SHA1 5b252b2582cee01c67b1d4e58f1c357a36591aa6
SHA256 9419f09cafab1b631ea0f59cdd04bacbba002a23dddda922b312ce67c0481e2a
CRC32 D6A5CDAB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3d9931c656cce95f_american fetish fucking full movie hole hotel .mpg.exe
Filepath C:\Users\Default\AppData\Local\Temp\american fetish fucking full movie hole hotel .mpg.exe
Size 2.0MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1b444420d2962edde9ec06ee5c2fd602
SHA1 427a915a08a046da9c64b0fc1a00bdbedc646b3a
SHA256 3d9931c656cce95f000334824381c0b8ad3175f2742475485b288e3fcf490a2a
CRC32 DC7E2E50
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 418c851ae8314c28_chinese lingerie licking latex .rar.exe
Filepath C:\Users\tu\AppData\Local\Temp\tmp79750.WMC\chinese lingerie licking latex .rar.exe
Size 429.1KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bfc4307e46ee506adf081cc645a52408
SHA1 f0d7c36dcccac8004af24e18fb4b4a1f0152b9ea
SHA256 418c851ae8314c2840796ed7a396e06921e6cec35cc4a9f9aed5ba6889c90ef8
CRC32 A3CE353E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ddb7acd47fd2f73b_beast uncut .rar.exe
Filepath C:\Program Files\DVD Maker\Shared\beast uncut .rar.exe
Size 1.7MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0e8f19af7f2cbc40007900a50e6e099f
SHA1 7c8ba9ae80a36885e8389e4d5df3c608e38cd9a6
SHA256 ddb7acd47fd2f73b2b4d6270e81e2713cca27e4b9b4ec029129323465df9f21e
CRC32 0485F16B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0fb0dcc1ab032f99_russian action lesbian hidden hole sm .zip.exe
Filepath C:\Windows\SysWOW64\FxsTmp\russian action lesbian hidden hole sm .zip.exe
Size 120.2KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 177cc445ee69a19e93a18ed33054df8d
SHA1 b06938a8ffa3ae64953a89147b56e8f8f1bfd181
SHA256 0fb0dcc1ab032f9902208e4653e92713f701d47b791eb6e8f827a0421a02efb4
CRC32 A61FA027
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b9260d4a6321ce8a_lingerie public feet beautyfull (melissa).avi.exe
Filepath C:\Windows\System32\LogFiles\Fax\Incoming\lingerie public feet beautyfull (Melissa).avi.exe
Size 655.9KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8e08142bf0779a8095effd239d79efdc
SHA1 96e318e221a6353598747e6f2185fca362435a38
SHA256 b9260d4a6321ce8a6e173c9bfe950aecc24ee441986d3109a41accd5bffcc2c2
CRC32 AA677E05
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name bb84ab83800a0a55_swedish beastiality horse [free] cock balls .avi.exe
Filepath C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\swedish beastiality horse [free] cock balls .avi.exe
Size 1.9MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 de95e23031b4eb7ce83a853785302b31
SHA1 34688ffa39ca3aa3668f55eda739ef275cf97499
SHA256 bb84ab83800a0a55edb535a9897d98cfec9f4aabfcfcdd55ad99177a4b2b30b6
CRC32 EDF7F4AA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 488c6ef609990166_bukkake public redhair (sonja,curtney).rar.exe
Filepath C:\ProgramData\Microsoft\Windows\Templates\bukkake public redhair (Sonja,Curtney).rar.exe
Size 887.8KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 67d01aeda1fca5687b9222f6770612c7
SHA1 c9f07bce4bf7248ab1a9427e633ecf1266a541e7
SHA256 488c6ef6099901667e0400bc6ddaa87a5677b94678486eb38fa5a63713f6eded
CRC32 ADC71A3F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a6423abb8a7e6869_indian handjob hardcore big circumcision (christine,karin).avi.exe
Filepath C:\Windows\SysWOW64\FxsTmp\indian handjob hardcore big circumcision (Christine,Karin).avi.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4679871c2ec70bf75b5c6221c8254cb8
SHA1 7cbf53927f17dadbcd2de3517d104fa7a5604e64
SHA256 a6423abb8a7e6869642b7e8101f9f3b443243578faaa4e805313b78ae4b4fa70
CRC32 E980BE90
ssdeep None
Yara
  • vmdetect - Possibly employs anti-virtualization techniques
VirusTotal Search for analysis
Name 240d8ea98ef193d5_xxx sleeping hole .zip.exe
Filepath C:\Users\Administrator\Downloads\xxx sleeping hole .zip.exe
Size 2.0MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 208964f3019387cb929ed5599034835e
SHA1 9697bc222e301e8c852e81101a9a172250f6fdb2
SHA256 240d8ea98ef193d578c643a901e00a1521363ebdbf3bcd913b8c50f5ee2246ba
CRC32 F6646B88
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 42217ac5e13f54bb_hardcore sleeping glans .avi.exe
Filepath C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\hardcore sleeping glans .avi.exe
Size 927.6KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b7b58b9e2d69a81d04414d9ae0fefdb5
SHA1 50384ce40fb05d3dcc1c58cffbf5d5a4fed81f3c
SHA256 42217ac5e13f54bb77de24cb6fbc07559f9cfb502d0e801b5957cc8eb7981a1d
CRC32 27F17573
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0037c141a2af6be2_brasilian fetish hardcore uncut cock femdom .mpeg.exe
Filepath C:\Windows\SoftwareDistribution\Download\brasilian fetish hardcore uncut cock femdom .mpeg.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 94e223480d3dd45e04c99a20751163f2
SHA1 a405d48ddeeead4524d222108e97cf05e54730e6
SHA256 0037c141a2af6be2a3e0830d9306849449154b300ce8b00f3d59dd1df90fb938
CRC32 288E3B2B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 6698d22cba2db7eb_indian cum bukkake hidden latex .zip.exe
Filepath C:\Windows\assembly\temp\indian cum bukkake hidden latex .zip.exe
Size 224.3KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b98e73e71ee51aa0bf829fbc2c4f21dd
SHA1 31a80fd1620da19617852ce85ba7410c015675ca
SHA256 6698d22cba2db7eb4e5a0f57745db23f62241c9e01a79452148de847091861c9
CRC32 7D7EBC0C
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 11455132f4622286_american kicking beast [bangbus] .rar.exe
Filepath C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\american kicking beast [bangbus] .rar.exe
Size 849.0KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2e351f50c0da5c0a96e9e0e34381bd90
SHA1 06238475e1576074f82f4f73cb4e628d52d17354
SHA256 11455132f46222864bdc44d61d970bb682a7cb5045c9f970842026e901698c54
CRC32 BE7F60A6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name b2f7195176633105_fucking public titts (sandy,samantha).mpg.exe
Filepath C:\Users\Administrator\AppData\Local\Temp\fucking public titts (Sandy,Samantha).mpg.exe
Size 1.2MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 54e76c0b452af458400f2b30120ad016
SHA1 8687c977679b05feee432ceca8d05fb802db3cac
SHA256 b2f71951766331050e7533afc219bb45c08676ca4ccc3f75c3d92cbdd7ed9211
CRC32 377E724D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 02939fa56ed41bd4_trambling licking boots (christine,curtney).mpg.exe
Filepath C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\trambling licking boots (Christine,Curtney).mpg.exe
Size 1.6MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 34dd754580c96fc933cfeca3e9c1162b
SHA1 b619994267e1b04ab5d57abb14c54d0ed4ee17d9
SHA256 02939fa56ed41bd4052aae4cb34ef1f710d2f472748d055eefe1dc1bf83273f4
CRC32 AFA32A07
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 388f0f91fe494702_horse [bangbus] hole upskirt .avi.exe
Filepath C:\Program Files\Common Files\Microsoft Shared\horse [bangbus] hole upskirt .avi.exe
Size 186.2KB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8269748b1199f28697a4f908524df864
SHA1 82c13f2e0c0c2a33d6dc500e97bd63fdbd7689d1
SHA256 388f0f91fe4947029eb04c07ba0e6b5e60b297cbb6205f5fffba916600031abf
CRC32 8263CE54
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c6f63cf91223141c_hardcore uncut .avi.exe
Filepath C:\Users\Administrator\AppData\Local\Temp\{5612CBE7-9CDF-4014-9454-1A3AE75C0CEE}.tmp\hardcore uncut .avi.exe
Size 1.2MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 39d16cda83b2b2e336b06c4cacb32a2d
SHA1 9722c902ef5a28b80da0298e1d0dc6052927ccde
SHA256 c6f63cf91223141ce6d83c6cd9597ccb1f6bc7a54d61ce6c21be2715ad020ffa
CRC32 50FACF4A
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name da78c7c5ee626e8b_japanese cum fucking full movie hotel .mpg.exe
Filepath C:\ProgramData\Microsoft\RAC\Temp\japanese cum fucking full movie hotel .mpg.exe
Size 1.3MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 790cfe4f1b75780acbbe4202c7d69adc
SHA1 09720c61e4fcbbfd12253888a101589357dde45d
SHA256 da78c7c5ee626e8b86d1d767f6b8b06bb4e27bf284aabbae578b1b1074ad34f7
CRC32 9DB4E1CC
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 29375da46127a902_russian gang bang beast uncut hole .rar.exe
Filepath C:\Windows\Downloaded Program Files\russian gang bang beast uncut hole .rar.exe
Size 1.5MB
Processes 3012 (05915b6b457a62889347ac9b00b52dcabb0376014877e4d372ade3241a7977e8.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 32c9a81b6ee1ea7065543e295446ea98
SHA1 95f71c20ee7406ad6db532a8344382ecf4325094
SHA256 29375da46127a902303da85c4c30a27f5382da2d08f2cc9d79161bd2f53f3315
CRC32 5A7851DF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.