91a4767026536af44716798ffc7149f1754c44f84c67bc6a237e03e4a0398d5b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

order pdf.exe
Size

1.5MB
MD5

dc425cdd4be9e881dc82e3d75c2f7771
SHA1

c1d47f92be936cbefb52899091ca2273869101bb
SHA256

c04e2a4dfc825504cc3b9b8917cc76d60c7d5a9a7a52eb8a191372a727eb5a23
SHA512

19a79889310e1d8ac40cea9dba528656e3e2ddb4d2298fd4ade3dc7df088b32624a6ccb57657b74c4f06eecbd35cf74c9e3110dfdda036ddaf57ff096c51bd97
SSDEEP

24576:yAHnh+eWsN3skA4RV1Hom2KXMmHakWQmuuvmkvpPyfwfqpUxXrSP5:1h+ZkldoPK8YalQmhvhlyfwypUFr2

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BthTelemetry.url	order pdf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	order pdf.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2204	order pdf.exe
2204	order pdf.exe
2204	order pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2280	2204	order pdf.exe	28
PID 2204 wrote to memory of 2280	2204	order pdf.exe	28
PID 2204 wrote to memory of 2280	2204	order pdf.exe	28
PID 2204 wrote to memory of 2280	2204	order pdf.exe	28
PID 2204 wrote to memory of 2292	2204	order pdf.exe	29
PID 2204 wrote to memory of 2292	2204	order pdf.exe	29
PID 2204 wrote to memory of 2292	2204	order pdf.exe	29
PID 2204 wrote to memory of 2292	2204	order pdf.exe	29
PID 2204 wrote to memory of 1984	2204	order pdf.exe	30
PID 2204 wrote to memory of 1984	2204	order pdf.exe	30
PID 2204 wrote to memory of 1984	2204	order pdf.exe	30
PID 2204 wrote to memory of 1984	2204	order pdf.exe	30
PID 2204 wrote to memory of 2272	2204	order pdf.exe	31
PID 2204 wrote to memory of 2272	2204	order pdf.exe	31
PID 2204 wrote to memory of 2272	2204	order pdf.exe	31
PID 2204 wrote to memory of 2272	2204	order pdf.exe	31
PID 2204 wrote to memory of 1652	2204	order pdf.exe	32
PID 2204 wrote to memory of 1652	2204	order pdf.exe	32
PID 2204 wrote to memory of 1652	2204	order pdf.exe	32
PID 2204 wrote to memory of 1652	2204	order pdf.exe	32
PID 2204 wrote to memory of 2008	2204	order pdf.exe	33
PID 2204 wrote to memory of 2008	2204	order pdf.exe	33
PID 2204 wrote to memory of 2008	2204	order pdf.exe	33
PID 2204 wrote to memory of 2008	2204	order pdf.exe	33
PID 2204 wrote to memory of 2264	2204	order pdf.exe	34
PID 2204 wrote to memory of 2264	2204	order pdf.exe	34
PID 2204 wrote to memory of 2264	2204	order pdf.exe	34
PID 2204 wrote to memory of 2264	2204	order pdf.exe	34
PID 2204 wrote to memory of 2252	2204	order pdf.exe	35
PID 2204 wrote to memory of 2252	2204	order pdf.exe	35
PID 2204 wrote to memory of 2252	2204	order pdf.exe	35
PID 2204 wrote to memory of 2252	2204	order pdf.exe	35
PID 2204 wrote to memory of 1972	2204	order pdf.exe	36
PID 2204 wrote to memory of 1972	2204	order pdf.exe	36
PID 2204 wrote to memory of 1972	2204	order pdf.exe	36
PID 2204 wrote to memory of 1972	2204	order pdf.exe	36
PID 2204 wrote to memory of 2300	2204	order pdf.exe	37
PID 2204 wrote to memory of 2300	2204	order pdf.exe	37
PID 2204 wrote to memory of 2300	2204	order pdf.exe	37
PID 2204 wrote to memory of 2300	2204	order pdf.exe	37
PID 2204 wrote to memory of 2580	2204	order pdf.exe	38
PID 2204 wrote to memory of 2580	2204	order pdf.exe	38
PID 2204 wrote to memory of 2580	2204	order pdf.exe	38
PID 2204 wrote to memory of 2580	2204	order pdf.exe	38
PID 2204 wrote to memory of 2392	2204	order pdf.exe	39
PID 2204 wrote to memory of 2392	2204	order pdf.exe	39
PID 2204 wrote to memory of 2392	2204	order pdf.exe	39
PID 2204 wrote to memory of 2392	2204	order pdf.exe	39
PID 2204 wrote to memory of 2472	2204	order pdf.exe	40
PID 2204 wrote to memory of 2472	2204	order pdf.exe	40
PID 2204 wrote to memory of 2472	2204	order pdf.exe	40
PID 2204 wrote to memory of 2472	2204	order pdf.exe	40
PID 2204 wrote to memory of 2892	2204	order pdf.exe	41
PID 2204 wrote to memory of 2892	2204	order pdf.exe	41
PID 2204 wrote to memory of 2892	2204	order pdf.exe	41
PID 2204 wrote to memory of 2892	2204	order pdf.exe	41
PID 2204 wrote to memory of 1828	2204	order pdf.exe	42
PID 2204 wrote to memory of 1828	2204	order pdf.exe	42
PID 2204 wrote to memory of 1828	2204	order pdf.exe	42
PID 2204 wrote to memory of 1828	2204	order pdf.exe	42
PID 2204 wrote to memory of 1460	2204	order pdf.exe	43
PID 2204 wrote to memory of 1460	2204	order pdf.exe	43
PID 2204 wrote to memory of 1460	2204	order pdf.exe	43
PID 2204 wrote to memory of 1460	2204	order pdf.exe	43

C:\Users\Admin\AppData\Local\Temp\order pdf.exe
"C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2292
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2272
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2300
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2392
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2472
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2960
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:3020
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1528
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2180
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2332
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:3056
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1548
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2072
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2644
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2896
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2808
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2520
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2424
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:304
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2444
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1772
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:848
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1076
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1252
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\order pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\order pdf.exe"
  2⤵
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-3-0x0000000000750000-0x000000000077E000-memory.dmp

Filesize
184KB

Download
memory/2204-4-0x0000000000120000-0x0000000000123000-memory.dmp

Filesize
12KB

Download