59dbc225207fb303c9eccc7b962c82ae212f5d302703d3154178b8afceeccd3c

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order documents.exe
Size 1.5MB
Sample260527-precwsdx3m
SHA256 59dbc225207fb303c9eccc7b962c82ae212f5d302703d3154178b8afceeccd3c
MD5 aa17ece2443ed014ea50139ce09ec500
SHA1 f3c70c8032af59a4477e826c92da38e6bf974ff3
SHA512 4a9332e23fb2254adf92ba1a34ececf5be3b3e4c3c075221fd3f3abd4f32ec9e42672d9187cfb2d67c9fdfad37c96e13cc1d04a2c46d76a9caa0468a2141f88f
SSDEEP 6144:gkL/A968meGyDW1T3yDW1TjkAzkAZqrEdrEAZUCwFjNN5Y9PRwmcpAbCN4:gkL/A9k6kfNPqrEdrEURwmcpsm4
TLSH
T180750D03F63AFCAAF96D3CF1D888DE902C1F3C5A4A8779613972FA5ED5331916600256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2768	attrib.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4148	attrib.exe
2712	attrib.exe
3628	attrib.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	pythonw.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3296	WINWORD.EXE
3296	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3296	WINWORD.EXE
3296	WINWORD.EXE
3296	WINWORD.EXE
3296	WINWORD.EXE
3296	WINWORD.EXE
3296	WINWORD.EXE
3296	WINWORD.EXE
3296	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1668	544	Order documents.exe	88
PID 1668 wrote to memory of 3296	1668	pythonw.exe	90
PID 1668 wrote to memory of 1596	1668	pythonw.exe	91
PID 1668 wrote to memory of 2524	1668	pythonw.exe	146
PID 1668 wrote to memory of 3080	1668	pythonw.exe	243
PID 1668 wrote to memory of 4072	1668	pythonw.exe	200
PID 1668 wrote to memory of 3192	1668	pythonw.exe	202
PID 1668 wrote to memory of 2348	1668	pythonw.exe	103
PID 1668 wrote to memory of 2652	1668	pythonw.exe	207
PID 1668 wrote to memory of 3944	1668	pythonw.exe	107
PID 1668 wrote to memory of 3940	1668	pythonw.exe	252
PID 1668 wrote to memory of 2852	1668	pythonw.exe	253
PID 1668 wrote to memory of 1448	1668	pythonw.exe	113
PID 1668 wrote to memory of 4388	1668	pythonw.exe	307
PID 1668 wrote to memory of 2216	1668	pythonw.exe	117
PID 1668 wrote to memory of 3816	1668	pythonw.exe	313
PID 1668 wrote to memory of 3208	1668	pythonw.exe	121
PID 1668 wrote to memory of 4208	1668	pythonw.exe	176
PID 1668 wrote to memory of 3776	1668	pythonw.exe	319
PID 1668 wrote to memory of 2152	1668	pythonw.exe	128
PID 1668 wrote to memory of 732	1668	pythonw.exe	229
PID 1668 wrote to memory of 4320	1668	pythonw.exe	231
PID 1668 wrote to memory of 4456	1668	pythonw.exe	134
PID 1668 wrote to memory of 2760	1668	pythonw.exe	136
PID 1668 wrote to memory of 3380	1668	pythonw.exe	138
PID 1668 wrote to memory of 4340	1668	pythonw.exe	140
PID 1668 wrote to memory of 2420	1668	pythonw.exe	143
PID 1668 wrote to memory of 1056	1668	pythonw.exe	145
PID 1668 wrote to memory of 3080	1668	pythonw.exe	243
PID 1668 wrote to memory of 840	1668	pythonw.exe	287
PID 1668 wrote to memory of 3260	1668	pythonw.exe	295
PID 1668 wrote to memory of 4436	1668	pythonw.exe	153
PID 1668 wrote to memory of 4200	1668	pythonw.exe	155
PID 1668 wrote to memory of 2768	1668	pythonw.exe	157
PID 1668 wrote to memory of 3908	1668	pythonw.exe	304
PID 1668 wrote to memory of 992	1668	pythonw.exe	161
PID 1668 wrote to memory of 3288	1668	pythonw.exe	163
PID 1668 wrote to memory of 4388	1668	pythonw.exe	307
PID 1668 wrote to memory of 2712	1668	pythonw.exe	167
PID 1668 wrote to memory of 3916	1668	pythonw.exe	169
PID 1668 wrote to memory of 3976	1668	pythonw.exe	171
PID 1668 wrote to memory of 4764	1668	pythonw.exe	173
PID 1668 wrote to memory of 5028	1668	pythonw.exe	175
PID 1668 wrote to memory of 3628	1668	pythonw.exe	320
PID 1668 wrote to memory of 1784	1668	pythonw.exe	179
PID 1668 wrote to memory of 2984	1668	pythonw.exe	181
PID 1668 wrote to memory of 4648	1668	pythonw.exe	276
PID 1668 wrote to memory of 1420	1668	pythonw.exe	185
PID 1668 wrote to memory of 4148	1668	pythonw.exe	236
PID 1668 wrote to memory of 4688	1668	pythonw.exe	332
PID 1668 wrote to memory of 3228	1668	pythonw.exe	191
PID 1668 wrote to memory of 3264	1668	pythonw.exe	193
PID 1668 wrote to memory of 3008	1668	pythonw.exe	195
PID 1668 wrote to memory of 3696	1668	pythonw.exe	341
PID 1668 wrote to memory of 1364	1668	pythonw.exe	290
PID 1668 wrote to memory of 1064	1668	pythonw.exe	201
PID 1668 wrote to memory of 4112	1668	pythonw.exe	203
PID 1668 wrote to memory of 116	1668	pythonw.exe	205
PID 1668 wrote to memory of 2652	1668	pythonw.exe	207
PID 1668 wrote to memory of 3984	1668	pythonw.exe	209
PID 1668 wrote to memory of 3784	1668	pythonw.exe	211
PID 1668 wrote to memory of 4296	1668	pythonw.exe	258
PID 1668 wrote to memory of 4860	1668	pythonw.exe	308
PID 1668 wrote to memory of 4412	1668	pythonw.exe	311

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2524	attrib.exe
4072	attrib.exe
3264	attrib.exe
4484	attrib.exe
4412	attrib.exe
4200	attrib.exe
1064	attrib.exe
4168	attrib.exe
1596	attrib.exe
1904	attrib.exe
1784	attrib.exe
4948	attrib.exe
3820	attrib.exe
3936	attrib.exe
4320	attrib.exe
2348	attrib.exe
2852	attrib.exe
2216	attrib.exe
4436	attrib.exe
4296	attrib.exe
900	attrib.exe
3292	attrib.exe
3696	attrib.exe
3260	attrib.exe
4168	attrib.exe
1132	attrib.exe
992	attrib.exe
3696	attrib.exe
1512	attrib.exe
3816	attrib.exe
1364	attrib.exe
3080	attrib.exe
4208	attrib.exe
732	attrib.exe
3016	attrib.exe
1132	attrib.exe
2420	attrib.exe
4216	attrib.exe
2492	attrib.exe
224	attrib.exe
3776	attrib.exe
2712	attrib.exe
2340	attrib.exe
2768	attrib.exe
5028	attrib.exe
3324	attrib.exe
3628	attrib.exe
3776	attrib.exe
4512	attrib.exe
212	attrib.exe
3380	attrib.exe
4220	attrib.exe
3800	attrib.exe
840	attrib.exe
3124	attrib.exe
216	attrib.exe
2984	attrib.exe
2864	attrib.exe
220	attrib.exe
2284	attrib.exe
3080	attrib.exe
4340	attrib.exe
3936	attrib.exe
364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Order documents.exe
"C:\Users\Admin\AppData\Local\Temp\Order documents.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Temp\_\pythonw.exe
  "C:\Users\Admin\AppData\Local\Temp\_\pythonw.exe" "C:\Users\Admin\AppData\Local\Temp\_\setup.dat" "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Product Condition Summary for Recent Order Delivery.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3296
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\01db60a9-c405-47a9-b3e5-b3fd6dbc1f51.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1596
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\08e27684-eda6-4704-b3a0-055ccbf5c288.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2524
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\1153508724
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3080
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db
    3⤵
    - Views/modifies file attributes
    PID:4072
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3192
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\20336292-db06-47bb-b779-05417ad05df8.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2348
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\4657e4cc-2f3b-4e80-88a5-8e9e947fab1e.tmp
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\5203897d-236d-4594-a1b2-0327743a52ab.tmp
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\6e929bc5-dfd5-4d2d-82e3-972633c9245d.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\93337928-5454-4f4e-958d-03240b5b324d.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2852
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\acrocef_low
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4388
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\AppvIsvSubsystems64.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2216
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\aria-debug-4288.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3816
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\aria-debug-4480.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3208
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\aria-debug-5428.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4208
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\BIT738B.tmp
    3⤵
    - Views/modifies file attributes
    PID:3776
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\BITC40B.tmp
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1778706109.txt
    3⤵
    - Views/modifies file attributes
    PID:732
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\c2r64.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4320
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\cv_debug.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4456
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3F6D.txt
    3⤵
    - Views/modifies file attributes
    PID:3380
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3F91.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4340
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI3F6D.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2420
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI3F91.txt
    3⤵
    PID:1056
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2524
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3080
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
    3⤵
    - Views/modifies file attributes
    PID:840
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\jawshtml.html
    3⤵
    - Views/modifies file attributes
    PID:3260
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\jusched.log
    3⤵
    - Views/modifies file attributes
    PID:4436
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Low
    3⤵
    - Views/modifies file attributes
    PID:4200
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\mapping.csv
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Views/modifies file attributes
    PID:2768
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20260513_205740426.html"
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:992
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219"
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513205801.log
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513205801_000_dotnet_runtime_6.0.27_win_x64.msi.log
    3⤵
    - System Time Discovery
    - Views/modifies file attributes
    PID:2712
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513205801_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
    3⤵
    PID:3916
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513205801_002_dotnet_host_6.0.27_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3976
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513205801_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
    3⤵
    PID:4764
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513205822.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5028
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4208
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513205822_000_dotnet_runtime_7.0.16_win_x64.msi.log
    3⤵
    - System Time Discovery
    PID:3628
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513205822_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1784
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513205822_002_dotnet_host_7.0.16_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2984
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513205822_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513205845.log
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513205845_000_dotnet_runtime_8.0.15_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    PID:4148
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513205845_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513205845_002_dotnet_host_8.0.15_win_x64.msi.log
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513205845_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3264
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3696
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1364
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4072
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\offline
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1064
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3192
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\offline.session64
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\OneNote
    3⤵
    - System Location Discovery: System Language Discovery
    PID:116
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Order documents.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Outlook Logging"
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1880305382
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\scoped_dir4328_1403869914
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4296
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\scoped_dir4328_2116463663
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCD179.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4412
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCD1E8.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3324
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCD209.tmp
    3⤵
    - Views/modifies file attributes
    PID:3936
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCD2A8.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCD2C9.tmp
    3⤵
    - Views/modifies file attributes
    PID:3016
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCD309.tmp
    3⤵
    - Views/modifies file attributes
    PID:3628
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCD33A.tmp
    3⤵
    PID:732
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCD3AA.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4320
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDD.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:900
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDEA.tmp
    3⤵
    - Views/modifies file attributes
    PID:4216
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4148
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC06.tmp
    3⤵
    - Views/modifies file attributes
    PID:4168
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC17.tmp
    3⤵
    - Views/modifies file attributes
    PID:2864
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC1C.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC1E.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3080
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC1F.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3656
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC20.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:220
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC34.tmp
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC35.tmp
    3⤵
    PID:4264
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3940
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC36.tmp
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC37.tmp
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC38.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4484
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4296
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC4D.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1132
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC4E.tmp
    3⤵
    - Views/modifies file attributes
    PID:4412
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC53.tmp
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC54.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3292
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC55.tmp
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC58.tmp
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC59.tmp
    3⤵
    - Views/modifies file attributes
    PID:2284
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC6A.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4220
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC6B.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3800
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4648
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC6C.tmp
    3⤵
    PID:4768
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC7E.tmp
    3⤵
    PID:5036
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC7F.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4168
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC83.tmp
    3⤵
    - Views/modifies file attributes
    PID:1596
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC84.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3316
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC85.tmp
    3⤵
    PID:840
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC97.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3124
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1364
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFC99.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3780
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFCAA.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4948
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFCAC.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFCCE.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:224
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFCCF.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1904
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFD0F.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3820
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFDCD.tmp
    3⤵
    PID:4176
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3908
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFDDE.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1512
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFE3E.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4860
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFE9E.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1132
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFEB0.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4412
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFEB2.tmp
    3⤵
    - Views/modifies file attributes
    PID:3816
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFF21.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3936
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TIGMGOLM-20260513-2102.log
    3⤵
    - Views/modifies file attributes
    PID:2340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1680
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TIGMGOLM-20260513-2102a.log
    3⤵
    - Views/modifies file attributes
    PID:3776
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3628
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\tmpA597.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4512
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\VBE
    3⤵
    PID:4248
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll
    3⤵
    PID:3712
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:900
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wct2611.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wct65CE.tmp
    3⤵
    PID:5036
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4688
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wct6F4A.tmp
    3⤵
    PID:2556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4168
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wctEADD.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wmsetup.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2492
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\_
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:364
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\{8C07953D-0BA3-4E8A-B1B1-D967BD455912} - OProcSessId.dat"
    3⤵
    - Views/modifies file attributes
    PID:3696
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\{8EB656AE-5C9C-47E6-9825-B44F87C1356A}
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\{C65A217E-09B5-435E-B0A4-7958092BE8A1}
    3⤵
    - Views/modifies file attributes
    PID:212
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\{DE1D13AF-66B1-4C23-86D6-06BA2906D966} - OProcSessId.dat"
    3⤵
    PID:932
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\~DF85483FF5DA2AFBE6.TMP
    3⤵
    - Views/modifies file attributes
    PID:216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Product Condition Summary for Recent Order Delivery.docx

Path C:\Users\Admin\AppData\Local\Temp\Product Condition Summary for Recent Order Delivery.docx
Size 36KB
SHA256 e698cca3d1fa68a898e4777ec722d2f4f21edb30b72f99086d7e5aa66a2334ac
MD5 8cd3661bed6af0497b49420c90850df6
SHA1 a4821cc2312e31039f8e1d24b5dd1dccde845c23
SHA512 44c476d0c7bd09dca7e5a89ba4f532225886f3c74249eff03f628f2b970318a4e68196e714ba5af4f51e68a7057795cbc17c3000468e1d1438a3f24bb88aaf24
SSDEEP 768:lZopanm7rdW8RhejnaCRWrY/CGD5uLiNTKUUPhvA/foZ4wa:rTm7rZHITr/CGD5uLmdUpYB
TLSH
T1D103F134C61FA071F4A6F775FA1A4BA1F1685AA050C52BBB3C37C26D90B374FAA17204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3296-6-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-7-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-9-0x00007FF9C280D000-0x00007FF9C280E000-memory.dmp

Download

memory/3296-8-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-10-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-11-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-13-0x00007FF9C2770000-0x00007FF9C2965000-memory.dmp

Download

memory/3296-15-0x00007FF9C2770000-0x00007FF9C2965000-memory.dmp

Download

memory/3296-14-0x00007FF9C2770000-0x00007FF9C2965000-memory.dmp

Download

memory/3296-17-0x00007FF9C2770000-0x00007FF9C2965000-memory.dmp

Download

memory/3296-16-0x00007FF980790000-0x00007FF9807A0000-memory.dmp

Download

memory/3296-12-0x00007FF9C2770000-0x00007FF9C2965000-memory.dmp

Download

memory/3296-18-0x00007FF9C2770000-0x00007FF9C2965000-memory.dmp

Download

memory/3296-19-0x00007FF980790000-0x00007FF9807A0000-memory.dmp

Download

memory/3296-50-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-47-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-49-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-48-0x00007FF9827F0000-0x00007FF982800000-memory.dmp

Download

memory/3296-51-0x00007FF9C2770000-0x00007FF9C2965000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads