agenttesla | 499d0e04aeabb42bfa3d686bc65b45b3b116116cf9231ea2717569e44dcfc8de

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order confirmation for PO 7UH2025.exe
Size

549KB
MD5

f61aec6b837c52490e5af74f2558decd
SHA1

90d0c4a77384dcfb04b27f66a889e8bb627ff06c
SHA256

9c0ad5329e00794b6b9591cf7f4f633cd2d0e3d1209d50b99cb48838fe63b79a
SHA512

c8cadeef5cf02efbfa34df770063a78b82ff2ca5280bb0b47f85e41e9609c3978ec88cc4ddb6cf2fc7fbbad0547215ef3c61f7721e1c66315061ec2ee8ec17fd
SSDEEP

12288:2pzQijkXRZXMnWJsGQkHgQ0cNrSdSG774u4U4U4U+H0U4H0U4UjU+J4J4H4f4D4z:kciwXvXrQkHg8NrSdSG779LLLS/o/L49

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.transotraval.cl
Port:
21
Username:
[email protected]
Password:
vIZ2P]dt&a!d

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com
7	ip-api.com
8	ip-api.com

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 set thread context of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 set thread context of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 set thread context of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 set thread context of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 set thread context of 2880	3060	Order confirmation for PO 7UH2025.exe	38
PID 3060 set thread context of 2368	3060	Order confirmation for PO 7UH2025.exe	39
PID 3060 set thread context of 1564	3060	Order confirmation for PO 7UH2025.exe	40
PID 3060 set thread context of 1680	3060	Order confirmation for PO 7UH2025.exe	41
PID 3060 set thread context of 600	3060	Order confirmation for PO 7UH2025.exe	42
PID 3060 set thread context of 2524	3060	Order confirmation for PO 7UH2025.exe	43
PID 3060 set thread context of 2056	3060	Order confirmation for PO 7UH2025.exe	44
PID 3060 set thread context of 1096	3060	Order confirmation for PO 7UH2025.exe	45
PID 3060 set thread context of 1104	3060	Order confirmation for PO 7UH2025.exe	46
PID 3060 set thread context of 1100	3060	Order confirmation for PO 7UH2025.exe	47
PID 3060 set thread context of 1644	3060	Order confirmation for PO 7UH2025.exe	48
PID 3060 set thread context of 796	3060	Order confirmation for PO 7UH2025.exe	49
PID 3060 set thread context of 644	3060	Order confirmation for PO 7UH2025.exe	51
PID 3060 set thread context of 2944	3060	Order confirmation for PO 7UH2025.exe	52
PID 3060 set thread context of 2484	3060	Order confirmation for PO 7UH2025.exe	53
PID 3060 set thread context of 672	3060	Order confirmation for PO 7UH2025.exe	54
PID 3060 set thread context of 2672	3060	Order confirmation for PO 7UH2025.exe	58
PID 3060 set thread context of 1748	3060	Order confirmation for PO 7UH2025.exe	59
PID 3060 set thread context of 1700	3060	Order confirmation for PO 7UH2025.exe	60
PID 3060 set thread context of 968	3060	Order confirmation for PO 7UH2025.exe	61
PID 3060 set thread context of 884	3060	Order confirmation for PO 7UH2025.exe	62
PID 3060 set thread context of 1984	3060	Order confirmation for PO 7UH2025.exe	63
PID 3060 set thread context of 1168	3060	Order confirmation for PO 7UH2025.exe	64
PID 3060 set thread context of 1636	3060	Order confirmation for PO 7UH2025.exe	66
PID 3060 set thread context of 2628	3060	Order confirmation for PO 7UH2025.exe	67
PID 3060 set thread context of 1376	3060	Order confirmation for PO 7UH2025.exe	69
PID 3060 set thread context of 2300	3060	Order confirmation for PO 7UH2025.exe	70
PID 3060 set thread context of 2444	3060	Order confirmation for PO 7UH2025.exe	71
PID 3060 set thread context of 1592	3060	Order confirmation for PO 7UH2025.exe	72
PID 3060 set thread context of 1768	3060	Order confirmation for PO 7UH2025.exe	73
PID 3060 set thread context of 1016	3060	Order confirmation for PO 7UH2025.exe	74
PID 3060 set thread context of 316	3060	Order confirmation for PO 7UH2025.exe	75
PID 3060 set thread context of 2408	3060	Order confirmation for PO 7UH2025.exe	76
PID 3060 set thread context of 2712	3060	Order confirmation for PO 7UH2025.exe	77
PID 3060 set thread context of 2128	3060	Order confirmation for PO 7UH2025.exe	78
PID 3060 set thread context of 1816	3060	Order confirmation for PO 7UH2025.exe	79
PID 3060 set thread context of 1884	3060	Order confirmation for PO 7UH2025.exe	80
PID 3060 set thread context of 2932	3060	Order confirmation for PO 7UH2025.exe	81
PID 3060 set thread context of 3032	3060	Order confirmation for PO 7UH2025.exe	83
PID 3060 set thread context of 2812	3060	Order confirmation for PO 7UH2025.exe	85
PID 3060 set thread context of 1740	3060	Order confirmation for PO 7UH2025.exe	86
PID 3060 set thread context of 372	3060	Order confirmation for PO 7UH2025.exe	87
PID 3060 set thread context of 2344	3060	Order confirmation for PO 7UH2025.exe	88
PID 3060 set thread context of 2960	3060	Order confirmation for PO 7UH2025.exe	92
PID 3060 set thread context of 552	3060	Order confirmation for PO 7UH2025.exe	93
PID 3060 set thread context of 1936	3060	Order confirmation for PO 7UH2025.exe	95
PID 3060 set thread context of 1732	3060	Order confirmation for PO 7UH2025.exe	96
PID 3060 set thread context of 3000	3060	Order confirmation for PO 7UH2025.exe	97
PID 3060 set thread context of 2420	3060	Order confirmation for PO 7UH2025.exe	98
PID 3060 set thread context of 2184	3060	Order confirmation for PO 7UH2025.exe	99
PID 3060 set thread context of 2644	3060	Order confirmation for PO 7UH2025.exe	100
PID 3060 set thread context of 2852	3060	Order confirmation for PO 7UH2025.exe	101
PID 3060 set thread context of 1980	3060	Order confirmation for PO 7UH2025.exe	103
PID 3060 set thread context of 912	3060	Order confirmation for PO 7UH2025.exe	104
PID 3060 set thread context of 2756	3060	Order confirmation for PO 7UH2025.exe	105
PID 3060 set thread context of 3028	3060	Order confirmation for PO 7UH2025.exe	106
PID 3060 set thread context of 2196	3060	Order confirmation for PO 7UH2025.exe	107
PID 3060 set thread context of 1356	3060	Order confirmation for PO 7UH2025.exe	108
PID 3060 set thread context of 2996	3060	Order confirmation for PO 7UH2025.exe	109

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2548	AddInProcess32.exe
600	AddInProcess32.exe
2604	installutil.exe
2548	AddInProcess32.exe
2604	installutil.exe
672	AddInProcess32.exe
672	AddInProcess32.exe
2672	regasm.exe
2672	regasm.exe
968	AddInProcess32.exe
1700	AddInProcess32.exe
968	AddInProcess32.exe
1700	AddInProcess32.exe
1636	installutil.exe
1636	installutil.exe
2300	AddInProcess32.exe
2300	AddInProcess32.exe
1016	AddInProcess32.exe
1016	AddInProcess32.exe
1768	installutil.exe
1768	installutil.exe
1884	AddInProcess32.exe
1884	AddInProcess32.exe
3032	installutil.exe
3032	installutil.exe
1740	AddInProcess32.exe
1740	AddInProcess32.exe
552	AddInProcess32.exe
552	AddInProcess32.exe
2960	regasm.exe
2960	regasm.exe
1936	installutil.exe
1936	installutil.exe
2420	AddInProcess32.exe
2420	AddInProcess32.exe
1980	installutil.exe
1980	installutil.exe
912	AddInProcess32.exe
912	AddInProcess32.exe
1356	AddInProcess32.exe
1356	AddInProcess32.exe
2188	AddInProcess32.exe
2188	AddInProcess32.exe
2448	installutil.exe
2448	installutil.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	installutil.exe
Token: SeDebugPrivilege	2548	AddInProcess32.exe
Token: SeDebugPrivilege	600	AddInProcess32.exe
Token: SeDebugPrivilege	672	AddInProcess32.exe
Token: SeDebugPrivilege	2672	regasm.exe
Token: SeDebugPrivilege	968	AddInProcess32.exe
Token: SeDebugPrivilege	1700	AddInProcess32.exe
Token: SeDebugPrivilege	1636	installutil.exe
Token: SeDebugPrivilege	2300	AddInProcess32.exe
Token: SeDebugPrivilege	1016	AddInProcess32.exe
Token: SeDebugPrivilege	1768	installutil.exe
Token: SeDebugPrivilege	1884	AddInProcess32.exe
Token: SeDebugPrivilege	3032	installutil.exe
Token: SeDebugPrivilege	1740	AddInProcess32.exe
Token: SeDebugPrivilege	552	AddInProcess32.exe
Token: SeDebugPrivilege	2960	regasm.exe
Token: SeDebugPrivilege	1936	installutil.exe
Token: SeDebugPrivilege	2420	AddInProcess32.exe
Token: SeDebugPrivilege	1980	installutil.exe
Token: SeDebugPrivilege	912	AddInProcess32.exe
Token: SeDebugPrivilege	1356	AddInProcess32.exe
Token: SeDebugPrivilege	2188	AddInProcess32.exe
Token: SeDebugPrivilege	2448	installutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2788	3060	Order confirmation for PO 7UH2025.exe	31
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2676	3060	Order confirmation for PO 7UH2025.exe	32
PID 3060 wrote to memory of 2876	3060	Order confirmation for PO 7UH2025.exe	33
PID 3060 wrote to memory of 2876	3060	Order confirmation for PO 7UH2025.exe	33
PID 3060 wrote to memory of 2876	3060	Order confirmation for PO 7UH2025.exe	33
PID 3060 wrote to memory of 2876	3060	Order confirmation for PO 7UH2025.exe	33
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 1336	3060	Order confirmation for PO 7UH2025.exe	34
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2548	3060	Order confirmation for PO 7UH2025.exe	35
PID 3060 wrote to memory of 2992	3060	Order confirmation for PO 7UH2025.exe	36
PID 3060 wrote to memory of 2992	3060	Order confirmation for PO 7UH2025.exe	36
PID 3060 wrote to memory of 2992	3060	Order confirmation for PO 7UH2025.exe	36
PID 3060 wrote to memory of 2992	3060	Order confirmation for PO 7UH2025.exe	36
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2604	3060	Order confirmation for PO 7UH2025.exe	37
PID 3060 wrote to memory of 2880	3060	Order confirmation for PO 7UH2025.exe	38
PID 3060 wrote to memory of 2880	3060	Order confirmation for PO 7UH2025.exe	38
PID 3060 wrote to memory of 2880	3060	Order confirmation for PO 7UH2025.exe	38
PID 3060 wrote to memory of 2880	3060	Order confirmation for PO 7UH2025.exe	38
PID 3060 wrote to memory of 2880	3060	Order confirmation for PO 7UH2025.exe	38

C:\Users\Admin\AppData\Local\Temp\Order confirmation for PO 7UH2025.exe
"C:\Users\Admin\AppData\Local\Temp\Order confirmation for PO 7UH2025.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:1336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:1460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:1996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3060 -s 932
  2⤵
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2676-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2788-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2788-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2788-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2788-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2788-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2788-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2788-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download