Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

b87c096c10...31.exe

windows10-2004-x64

3

Resubmissions

17/08/2024, 00:49

240817-a6d84s1arp 3

17/08/2024, 00:45

240817-a4km4sxcnc 4

17/08/2024, 00:41

240817-a19g3axblb 3

16/08/2024, 15:13

240816-slrb2s1fra 3

Analysis

  • max time kernel
    196s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 00:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe

  • Size

    410KB

  • MD5

    18152e40100de9cafb257df76f17e51e

  • SHA1

    a310b69302d0945e5b4dcc02692c646a045bbf06

  • SHA256

    b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931

  • SHA512

    be22cdb522df9fe45cbb14db384fcfebfdcd520622455958f6b49f613186c440eb184c6bb2128976377aff02833df153df48f6c8d180ea3bda9bd3047165b0e1

  • SSDEEP

    12288:hHsEjxLDavg3JmwxY1kzE+QIrZoftjNB:lsA+vSoqYAQmZoftn

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
    "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3144
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2652
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3144
    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
      1⤵
        PID:3668
      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
        1⤵
        • System Location Discovery: System Language Discovery
        PID:4712
      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
        1⤵
          PID:5104
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:2684
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:2148
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:1688
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:4272
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:4388
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:2880
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:3356
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:3800
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:208
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:3732
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:5020
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:1244
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:4068
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
          • System Location Discovery: System Language Discovery
          PID:2252
        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
          1⤵
            PID:4360
          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
            1⤵
            • System Location Discovery: System Language Discovery
            PID:4492
          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
            1⤵
              PID:2336
            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
              1⤵
              • System Location Discovery: System Language Discovery
              PID:116
            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
              1⤵
                PID:4280
              • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                1⤵
                  PID:1972
                • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                  "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                  1⤵
                  • System Location Discovery: System Language Discovery
                  PID:4012
                • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                  "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                  1⤵
                    PID:4876
                  • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                    "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                    1⤵
                    • System Location Discovery: System Language Discovery
                    PID:1604
                  • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                    "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                    1⤵
                      PID:1472
                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                      1⤵
                      • System Location Discovery: System Language Discovery
                      PID:4956
                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                      1⤵
                      • System Location Discovery: System Language Discovery
                      PID:784
                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                      1⤵
                        PID:3604
                      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                        1⤵
                          PID:2156
                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          PID:1596
                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          PID:2688
                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          PID:3936
                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          PID:2044
                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          PID:4704
                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          PID:1524
                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                          1⤵
                            PID:1916
                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                            1⤵
                            • System Location Discovery: System Language Discovery
                            PID:3388
                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                            1⤵
                              PID:4388
                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                              1⤵
                              • System Location Discovery: System Language Discovery
                              PID:4692
                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                              1⤵
                              • System Location Discovery: System Language Discovery
                              PID:1568
                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                              1⤵
                                PID:4276
                              • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                1⤵
                                • System Location Discovery: System Language Discovery
                                PID:208
                              • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                1⤵
                                • System Location Discovery: System Language Discovery
                                PID:1120
                              • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                1⤵
                                • System Location Discovery: System Language Discovery
                                PID:1244
                              • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                1⤵
                                  PID:3184
                                • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                  1⤵
                                    PID:5108
                                  • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                    1⤵
                                      PID:2052
                                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                      1⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4472
                                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                      1⤵
                                        PID:4292
                                      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                        1⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5000
                                      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                        1⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2376
                                      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                        1⤵
                                          PID:4848
                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4500
                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3376
                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5092
                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1280
                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4984
                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3460
                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3668
                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                          1⤵
                                            PID:1432
                                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                            1⤵
                                              PID:2368
                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                              1⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3516
                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                              1⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2280
                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                              1⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2792
                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                              1⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1832
                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                              1⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3672
                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                              1⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1984
                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                              1⤵
                                                PID:1156
                                              • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                1⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4712
                                              • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                1⤵
                                                  PID:3936
                                                • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                  1⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1696
                                                • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                  1⤵
                                                    PID:3148
                                                  • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                    1⤵
                                                      PID:916
                                                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                      1⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3388
                                                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                      1⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3036
                                                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                      1⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1568
                                                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                      1⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2988
                                                    • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                      1⤵
                                                        PID:868
                                                      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                        1⤵
                                                          PID:1120
                                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                          1⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2252
                                                        • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                          1⤵
                                                            PID:1536
                                                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                            1⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2352
                                                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                            1⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2236
                                                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                            1⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3432
                                                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                            1⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:736
                                                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                            1⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2680
                                                          • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                            1⤵
                                                              PID:964
                                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                              1⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5008
                                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                              1⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4900
                                                            • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
                                                              1⤵
                                                                PID:1604

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                Filesize

                                                                64KB

                                                                MD5

                                                                d2fb266b97caff2086bf0fa74eddb6b2

                                                                SHA1

                                                                2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                SHA256

                                                                b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                SHA512

                                                                c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                Filesize

                                                                4B

                                                                MD5

                                                                f49655f856acb8884cc0ace29216f511

                                                                SHA1

                                                                cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                SHA256

                                                                7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                SHA512

                                                                599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                Filesize

                                                                944B

                                                                MD5

                                                                6bd369f7c74a28194c991ed1404da30f

                                                                SHA1

                                                                0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                SHA256

                                                                878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                SHA512

                                                                8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                Download Submit

                                                              • memory/4736-10-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-12-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-11-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-0-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-9-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-8-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-7-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-6-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-2-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download

                                                              • memory/4736-1-0x0000023846170000-0x0000023846171000-memory.dmp

                                                                Filesize

                                                                4KB

                                                                Download