59dbc225207fb303c9eccc7b962c82ae212f5d302703d3154178b8afceeccd3c

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order documents.exe
Size 1.5MB
Sample260527-precwsdx3m
SHA256 59dbc225207fb303c9eccc7b962c82ae212f5d302703d3154178b8afceeccd3c
MD5 aa17ece2443ed014ea50139ce09ec500
SHA1 f3c70c8032af59a4477e826c92da38e6bf974ff3
SHA512 4a9332e23fb2254adf92ba1a34ececf5be3b3e4c3c075221fd3f3abd4f32ec9e42672d9187cfb2d67c9fdfad37c96e13cc1d04a2c46d76a9caa0468a2141f88f
SSDEEP 6144:gkL/A968meGyDW1T3yDW1TjkAzkAZqrEdrEAZUCwFjNN5Y9PRwmcpAbCN4:gkL/A9k6kfNPqrEdrEURwmcpsm4
TLSH
T180750D03F63AFCAAF96D3CF1D888DE902C1F3C5A4A8779613972FA5ED5331916600256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4664	attrib.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4804	attrib.exe
2828	attrib.exe
4720	attrib.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	pythonw.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4012	WINWORD.EXE
4012	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4012	WINWORD.EXE
4012	WINWORD.EXE
4012	WINWORD.EXE
4012	WINWORD.EXE
4012	WINWORD.EXE
4012	WINWORD.EXE
4012	WINWORD.EXE
4012	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 5220	4800	Order documents.exe	80
PID 5220 wrote to memory of 4012	5220	pythonw.exe	81
PID 5220 wrote to memory of 3828	5220	pythonw.exe	82
PID 5220 wrote to memory of 2560	5220	pythonw.exe	84
PID 5220 wrote to memory of 3924	5220	pythonw.exe	87
PID 5220 wrote to memory of 3920	5220	pythonw.exe	89
PID 5220 wrote to memory of 2504	5220	pythonw.exe	91
PID 5220 wrote to memory of 5348	5220	pythonw.exe	93
PID 5220 wrote to memory of 4112	5220	pythonw.exe	95
PID 5220 wrote to memory of 6008	5220	pythonw.exe	97
PID 5220 wrote to memory of 5828	5220	pythonw.exe	99
PID 5220 wrote to memory of 3800	5220	pythonw.exe	101
PID 5220 wrote to memory of 1800	5220	pythonw.exe	103
PID 5220 wrote to memory of 4868	5220	pythonw.exe	105
PID 5220 wrote to memory of 4364	5220	pythonw.exe	107
PID 5220 wrote to memory of 4748	5220	pythonw.exe	109
PID 5220 wrote to memory of 5492	5220	pythonw.exe	111
PID 5220 wrote to memory of 3128	5220	pythonw.exe	113
PID 5220 wrote to memory of 2232	5220	pythonw.exe	115
PID 5220 wrote to memory of 5184	5220	pythonw.exe	117
PID 5220 wrote to memory of 4864	5220	pythonw.exe	119
PID 5220 wrote to memory of 6076	5220	pythonw.exe	121
PID 5220 wrote to memory of 5756	5220	pythonw.exe	240
PID 5220 wrote to memory of 5460	5220	pythonw.exe	125
PID 5220 wrote to memory of 4664	5220	pythonw.exe	243
PID 5220 wrote to memory of 1936	5220	pythonw.exe	129
PID 5220 wrote to memory of 2104	5220	pythonw.exe	131
PID 5220 wrote to memory of 3500	5220	pythonw.exe	133
PID 5220 wrote to memory of 4172	5220	pythonw.exe	135
PID 5220 wrote to memory of 2828	5220	pythonw.exe	137
PID 5220 wrote to memory of 5736	5220	pythonw.exe	139
PID 5220 wrote to memory of 4752	5220	pythonw.exe	141
PID 5220 wrote to memory of 2860	5220	pythonw.exe	143
PID 5220 wrote to memory of 440	5220	pythonw.exe	274
PID 5220 wrote to memory of 4720	5220	pythonw.exe	147
PID 5220 wrote to memory of 5264	5220	pythonw.exe	149
PID 5220 wrote to memory of 2936	5220	pythonw.exe	151
PID 5220 wrote to memory of 3172	5220	pythonw.exe	153
PID 5220 wrote to memory of 236	5220	pythonw.exe	155
PID 5220 wrote to memory of 4804	5220	pythonw.exe	157
PID 5220 wrote to memory of 1020	5220	pythonw.exe	159
PID 5220 wrote to memory of 5776	5220	pythonw.exe	161
PID 5220 wrote to memory of 408	5220	pythonw.exe	163
PID 5220 wrote to memory of 668	5220	pythonw.exe	165
PID 5220 wrote to memory of 5848	5220	pythonw.exe	167
PID 5220 wrote to memory of 4492	5220	pythonw.exe	169
PID 5220 wrote to memory of 1316	5220	pythonw.exe	171
PID 5220 wrote to memory of 2764	5220	pythonw.exe	173
PID 5220 wrote to memory of 4756	5220	pythonw.exe	290
PID 5220 wrote to memory of 4448	5220	pythonw.exe	177
PID 5220 wrote to memory of 1288	5220	pythonw.exe	179
PID 5220 wrote to memory of 5560	5220	pythonw.exe	181
PID 5220 wrote to memory of 4896	5220	pythonw.exe	183
PID 5220 wrote to memory of 2264	5220	pythonw.exe	185
PID 5220 wrote to memory of 1140	5220	pythonw.exe	300
PID 5220 wrote to memory of 4256	5220	pythonw.exe	189
PID 5220 wrote to memory of 4212	5220	pythonw.exe	303
PID 5220 wrote to memory of 4232	5220	pythonw.exe	193
PID 5220 wrote to memory of 4488	5220	pythonw.exe	307
PID 5220 wrote to memory of 3688	5220	pythonw.exe	197
PID 5220 wrote to memory of 2012	5220	pythonw.exe	312
PID 5220 wrote to memory of 3916	5220	pythonw.exe	201
PID 5220 wrote to memory of 544	5220	pythonw.exe	203
PID 5220 wrote to memory of 2504	5220	pythonw.exe	205

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3500	attrib.exe
4364	attrib.exe
4212	attrib.exe
4492	attrib.exe
4256	attrib.exe
5736	attrib.exe
2200	attrib.exe
1504	attrib.exe
5348	attrib.exe
3400	attrib.exe
4868	attrib.exe
3916	attrib.exe
4328	attrib.exe
2880	attrib.exe
3920	attrib.exe
3940	attrib.exe
4720	attrib.exe
1788	attrib.exe
2468	attrib.exe
5180	attrib.exe
1400	attrib.exe
3296	attrib.exe
6100	attrib.exe
3828	attrib.exe
5756	attrib.exe
4488	attrib.exe
920	attrib.exe
5600	attrib.exe
3800	attrib.exe
4752	attrib.exe
2936	attrib.exe
4896	attrib.exe
544	attrib.exe
4488	attrib.exe
3920	attrib.exe
3840	attrib.exe
1844	attrib.exe
4884	attrib.exe
5084	attrib.exe
4804	attrib.exe
3144	attrib.exe
1128	attrib.exe
2684	attrib.exe
4016	attrib.exe
4768	attrib.exe
4448	attrib.exe
2264	attrib.exe
6076	attrib.exe
2860	attrib.exe
440	attrib.exe
3792	attrib.exe
5068	attrib.exe
5492	attrib.exe
4172	attrib.exe
5264	attrib.exe
3172	attrib.exe
1316	attrib.exe
5060	attrib.exe
3924	attrib.exe
5828	attrib.exe
2764	attrib.exe
4820	attrib.exe
5240	attrib.exe
3968	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Order documents.exe
"C:\Users\Admin\AppData\Local\Temp\Order documents.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\_\pythonw.exe
  "C:\Users\Admin\AppData\Local\Temp\_\pythonw.exe" "C:\Users\Admin\AppData\Local\Temp\_\setup.dat" "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Product Condition Summary for Recent Order Delivery.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4012
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\2534994503
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3828
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\60e99a4a-8fd6-44c0-ae10-862215c1592d.tmp
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\acrocef_low
    3⤵
    - Views/modifies file attributes
    PID:3924
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3920
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\AppvIsvSubsystems64.dll
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\aria-debug-3960.log
    3⤵
    - Views/modifies file attributes
    PID:5348
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1778715882.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\c2r64.dll
    3⤵
    PID:6008
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\c6ab5f87-2fbe-41f2-ad33-a533aa9c4ba9.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5828
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\cv_debug.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3800
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3CBE.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4868
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3CD8.txt
    3⤵
    - Views/modifies file attributes
    PID:4364
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI3CBE.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4748
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI3CD8.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5492
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\DefaultApps.xml
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\DefaultAppsNew.xml
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin
    3⤵
    PID:5184
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\jawshtml.html
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:6076
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\jusched.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5756
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Low
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\mapping.csv
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4664
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20260513_234100159.html"
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219"
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3500
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513234120.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4172
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513234120_000_dotnet_runtime_6.0.27_win_x64.msi.log
    3⤵
    - System Time Discovery
    PID:2828
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513234120_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5736
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513234120_002_dotnet_host_6.0.27_win_x64.msi.log
    3⤵
    - Views/modifies file attributes
    PID:4752
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260513234120_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2860
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513234139.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:440
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513234139_000_dotnet_runtime_7.0.16_win_x64.msi.log
    3⤵
    - System Time Discovery
    - Views/modifies file attributes
    PID:4720
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513234139_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
    3⤵
    - Views/modifies file attributes
    PID:5264
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513234139_002_dotnet_host_7.0.16_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2936
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260513234139_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
    3⤵
    - Views/modifies file attributes
    PID:3172
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513234159.log
    3⤵
    PID:236
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513234159_000_dotnet_runtime_8.0.15_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    - Views/modifies file attributes
    PID:4804
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513234159_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1020
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513234159_002_dotnet_host_8.0.15_win_x64.msi.log
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260513234159_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
    3⤵
    PID:408
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files
    3⤵
    - System Location Discovery: System Language Discovery
    PID:668
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
    3⤵
    - Views/modifies file attributes
    PID:4492
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\OneNote
    3⤵
    - Views/modifies file attributes
    PID:1316
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Order documents.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2764
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Outlook Logging"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4756
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\scoped_dir2516_195923320
    3⤵
    - Views/modifies file attributes
    PID:4448
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF54D.tmp
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF54F.tmp
    3⤵
    PID:5560
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF551.tmp
    3⤵
    - Views/modifies file attributes
    PID:4896
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF565.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2264
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF569.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1140
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF56C.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4256
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF573.tmp
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF588.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF589.tmp
    3⤵
    - Views/modifies file attributes
    PID:4488
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF58A.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3688
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF58B.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2012
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF58C.tmp
    3⤵
    - Views/modifies file attributes
    PID:3916
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF58D.tmp
    3⤵
    - Views/modifies file attributes
    PID:544
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF58E.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF590.tmp
    3⤵
    PID:3108
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF591.tmp
    3⤵
    - Views/modifies file attributes
    PID:3144
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF592.tmp
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5A2.tmp
    3⤵
    - Views/modifies file attributes
    PID:3792
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5A3.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1788
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5A5.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2276
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5A6.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3400
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5A7.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1128
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5A9.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5816
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5BD.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5060
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5BE.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4328
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5BF.tmp
    3⤵
    - Views/modifies file attributes
    PID:2684
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5C0.tmp
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5D2.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:920
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF5D4.tmp
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF604.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4820
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF626.tmp
    3⤵
    PID:4360
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5756
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF637.tmp
    3⤵
    - Views/modifies file attributes
    PID:4016
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF6A7.tmp
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF6F7.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5240
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF6F9.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2200
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF739.tmp
    3⤵
    - Views/modifies file attributes
    PID:2880
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF75B.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5180
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF76C.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4768
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF7AD.tmp
    3⤵
    - Views/modifies file attributes
    PID:3840
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF7FD.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:952
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF82E.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1720
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF87E.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF89F.tmp
    3⤵
    - Views/modifies file attributes
    PID:1400
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF8FF.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1028
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF910.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5232
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF970.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1684
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF991.tmp
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF9D2.tmp
    3⤵
    - Views/modifies file attributes
    PID:1504
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:440
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDF9F3.tmp
    3⤵
    - Views/modifies file attributes
    PID:3296
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFA43.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1844
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\TCDFA84.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3940
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\VBE
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5068
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
    3⤵
    - Views/modifies file attributes
    PID:5600
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\vcruntime140_1.dll
    3⤵
    - Views/modifies file attributes
    PID:6100
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wct73A9.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4684
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wct7560.tmp
    3⤵
    PID:2712
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4756
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wct780F.tmp
    3⤵
    - Views/modifies file attributes
    PID:3968
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wct84FE.tmp
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wctE615.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4884
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wctFDC8.tmp
    3⤵
    - Views/modifies file attributes
    PID:5084
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\wmsetup.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1140
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\ZDHIFHEM-20260513-2345.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\ZDHIFHEM-20260513-2345a.log
    3⤵
    - Views/modifies file attributes
    PID:4212
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\_
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2468
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\{117DE92E-A615-4167-9D53-8D27231FC1F4}
    3⤵
    - Views/modifies file attributes
    PID:4488
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\{151AECBA-C058-4068-8BD6-3340F8D4C219} - OProcSessId.dat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\{73724326-CA15-4548-9681-20F60856F12D} - OProcSessId.dat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2012
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\{8E2004EF-3F8E-4366-AA79-282028D51E96}
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3920
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s C:\Users\Admin\AppData\Local\Temp\~DFF8B562106A4019FD.TMP
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Product Condition Summary for Recent Order Delivery.docx

Path C:\Users\Admin\AppData\Local\Temp\Product Condition Summary for Recent Order Delivery.docx
Size 36KB
SHA256 e698cca3d1fa68a898e4777ec722d2f4f21edb30b72f99086d7e5aa66a2334ac
MD5 8cd3661bed6af0497b49420c90850df6
SHA1 a4821cc2312e31039f8e1d24b5dd1dccde845c23
SHA512 44c476d0c7bd09dca7e5a89ba4f532225886f3c74249eff03f628f2b970318a4e68196e714ba5af4f51e68a7057795cbc17c3000468e1d1438a3f24bb88aaf24
SSDEEP 768:lZopanm7rdW8RhejnaCRWrY/CGD5uLiNTKUUPhvA/foZ4wa:rTm7rZHITr/CGD5uLmdUpYB
TLSH
T1D103F134C61FA071F4A6F775FA1A4BA1F1685AA050C52BBB3C37C26D90B374FAA17204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4012-6-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-9-0x00007FFAFF024000-0x00007FFAFF025000-memory.dmp

Download

memory/4012-11-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-10-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-8-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-7-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-12-0x00007FFAFEF80000-0x00007FFAFF189000-memory.dmp

Download

memory/4012-14-0x00007FFAFEF80000-0x00007FFAFF189000-memory.dmp

Download

memory/4012-15-0x00007FFAFEF80000-0x00007FFAFF189000-memory.dmp

Download

memory/4012-13-0x00007FFAFEF80000-0x00007FFAFF189000-memory.dmp

Download

memory/4012-16-0x00007FFAFEF80000-0x00007FFAFF189000-memory.dmp

Download

memory/4012-17-0x00007FFABC470000-0x00007FFABC480000-memory.dmp

Download

memory/4012-18-0x00007FFAFEF80000-0x00007FFAFF189000-memory.dmp

Download

memory/4012-19-0x00007FFABC470000-0x00007FFABC480000-memory.dmp

Download

memory/4012-42-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-41-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-39-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-40-0x00007FFABF010000-0x00007FFABF020000-memory.dmp

Download

memory/4012-43-0x00007FFAFEF80000-0x00007FFAFF189000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads