Analysis
-
max time kernel
36s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 22:20
Behavioral task
behavioral1
Sample
70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe
Resource
win7-20240903-en
General
-
Target
70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe
-
Size
3.9MB
-
MD5
c52d4fb4a49b05a1f665d2b9a4bb42ad
-
SHA1
4165fc93089a1b3517088db400963df219af05d3
-
SHA256
70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e
-
SHA512
a312ede14b3a771d75de0060a7bb8c97787d99114a828cb8b98d734463bc0ceb365b1677f3e1a3936c24439e5436451c11335f3f3f3d5f1138e4da28f6aed557
-
SSDEEP
98304:vjmtk2aw3jmtk2aH3jmtk2az3KK3dyaXXNJDWjBKUoLIkPeB1LnPnqn9:v+h3++3+y3b3rXXNJDGiLIkGB1zfk9
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral2/files/0x0009000000023c73-4.dat family_neshta behavioral2/files/0x0007000000023c78-16.dat family_neshta behavioral2/files/0x0007000000023c7d-114.dat family_neshta behavioral2/files/0x0007000000023c77-121.dat family_neshta behavioral2/memory/4436-122-0x0000000000400000-0x00000000007E7000-memory.dmp family_neshta behavioral2/memory/1608-136-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000600000002021e-196.dat family_neshta behavioral2/files/0x0006000000020216-195.dat family_neshta behavioral2/files/0x0001000000020294-204.dat family_neshta behavioral2/files/0x0004000000020348-208.dat family_neshta behavioral2/files/0x000600000002022d-213.dat family_neshta behavioral2/files/0x0004000000020309-212.dat family_neshta behavioral2/files/0x0001000000020225-203.dat family_neshta behavioral2/files/0x0007000000023c7e-220.dat family_neshta behavioral2/memory/2592-229-0x0000000000400000-0x0000000000720000-memory.dmp family_neshta behavioral2/memory/3608-241-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000214d8-253.dat family_neshta behavioral2/files/0x0007000000023c80-259.dat family_neshta behavioral2/files/0x0001000000022f67-278.dat family_neshta behavioral2/memory/1976-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000022e68-360.dat family_neshta behavioral2/files/0x000100000001691c-356.dat family_neshta behavioral2/files/0x000100000001692a-355.dat family_neshta behavioral2/files/0x0001000000016921-354.dat family_neshta behavioral2/files/0x000400000001e6a0-368.dat family_neshta behavioral2/files/0x000100000001691b-353.dat family_neshta behavioral2/files/0x0001000000022739-377.dat family_neshta behavioral2/files/0x000100000001691f-352.dat family_neshta behavioral2/files/0x000100000001691d-351.dat family_neshta behavioral2/files/0x000100000001dc18-350.dat family_neshta behavioral2/files/0x000100000001dc16-349.dat family_neshta behavioral2/files/0x000200000001dc0c-318.dat family_neshta behavioral2/memory/632-388-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000167ef-309.dat family_neshta behavioral2/files/0x00010000000167f0-307.dat family_neshta behavioral2/files/0x000100000001680d-304.dat family_neshta behavioral2/files/0x00010000000167d3-303.dat family_neshta behavioral2/files/0x000100000001685d-301.dat family_neshta behavioral2/files/0x00010000000167cf-294.dat family_neshta behavioral2/memory/5068-394-0x0000000000400000-0x00000000007E7000-memory.dmp family_neshta behavioral2/files/0x00010000000167d1-293.dat family_neshta behavioral2/files/0x00010000000167b6-292.dat family_neshta behavioral2/files/0x0001000000016808-291.dat family_neshta behavioral2/files/0x0001000000022f2b-273.dat family_neshta behavioral2/files/0x0001000000022f29-267.dat family_neshta behavioral2/files/0x00010000000214d9-265.dat family_neshta behavioral2/memory/2724-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000021533-249.dat family_neshta behavioral2/files/0x000200000002030d-248.dat family_neshta behavioral2/memory/2532-492-0x0000000000400000-0x0000000000720000-memory.dmp family_neshta behavioral2/memory/872-499-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4924-500-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4256-510-0x0000000000400000-0x000000000065A000-memory.dmp family_neshta behavioral2/memory/1772-520-0x0000000000400000-0x0000000000720000-memory.dmp family_neshta behavioral2/memory/4644-519-0x0000000000400000-0x0000000000720000-memory.dmp family_neshta behavioral2/memory/1860-531-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5016-592-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3652-602-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4852-611-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1988-620-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4720-624-0x0000000000400000-0x000000000065A000-memory.dmp family_neshta behavioral2/memory/2592-625-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4928-631-0x0000000000400000-0x000000000065A000-memory.dmp family_neshta behavioral2/memory/2452-645-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Xred family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~2.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~3.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~3.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~2.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~3.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _C578E~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ._cache__CACHE~3.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~4.EXE Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation _CACHE~4.EXE -
Executes dropped EXE 64 IoCs
pid Process 4436 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 3172 ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 5068 Synaptics.exe 1608 svchost.com 2592 _CACHE~1.EXE 3608 ._cache_Synaptics.exe 1976 ._cache__CACHE~1.EXE 2724 svchost.com 2532 _CACHE~2.EXE 632 svchost.com 4256 _CACHE~3.EXE 872 ._cache__CACHE~2.EXE 4924 svchost.com 4644 Synaptics.exe 4720 _CACHE~1.EXE 1860 ._cache__CACHE~3.EXE 1772 Synaptics.exe 3652 ._cache_Synaptics.exe 4852 ._cache__CACHE~1.EXE 2592 svchost.com 3488 _CACHE~2.EXE 5016 svchost.com 1988 svchost.com 4928 _CACHE~3.EXE 4948 Synaptics.exe 2452 ._cache__CACHE~3.EXE 3624 ._cache_Synaptics.exe 2384 Synaptics.exe 4752 svchost.com 4836 _CACHE~2.EXE 1404 svchost.com 3548 _CACHE~4.EXE 4468 ._cache_Synaptics.exe 3240 ._cache__CACHE~4.EXE 3348 svchost.com 2572 _CACHE~4.EXE 2028 svchost.com 1064 _C578E~1.EXE 2620 Synaptics.exe 2628 ._cache__CACHE~4.EXE 2288 svchost.com 848 _C578E~1.EXE 844 ._cache__C578E~1.EXE 3776 ._cache__C578E~1.EXE 760 Synaptics.exe 2152 svchost.com 4928 _C6820~1.EXE 4884 svchost.com 4964 _C6820~1.EXE 4752 Synaptics.exe 5032 ._cache_Synaptics.exe 4264 svchost.com 3344 _CACHE~4.EXE 4044 ._cache__CACHE~4.EXE 4732 svchost.com 3508 _C578E~1.EXE 5116 Synaptics.exe 1984 ._cache_Synaptics.exe 3272 ._cache__C578E~1.EXE 2816 svchost.com 760 _C6820~1.EXE 116 svchost.com 1608 _CACHE~4.EXE 392 Synaptics.exe -
Loads dropped DLL 58 IoCs
pid Process 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4644 Synaptics.exe 4644 Synaptics.exe 1772 Synaptics.exe 1772 Synaptics.exe 4928 _CACHE~3.EXE 4928 _CACHE~3.EXE 4948 Synaptics.exe 4948 Synaptics.exe 2384 Synaptics.exe 2384 Synaptics.exe 2572 _CACHE~4.EXE 2572 _CACHE~4.EXE 2620 Synaptics.exe 2620 Synaptics.exe 848 _C578E~1.EXE 848 _C578E~1.EXE 4752 Synaptics.exe 4752 Synaptics.exe 3344 _CACHE~4.EXE 3344 _CACHE~4.EXE 3508 _C578E~1.EXE 3508 _C578E~1.EXE 5116 Synaptics.exe 5116 Synaptics.exe 1608 _CACHE~4.EXE 1608 _CACHE~4.EXE 392 Synaptics.exe 392 Synaptics.exe 1588 _CACHE~4.EXE 1588 _CACHE~4.EXE 3304 Synaptics.exe 3304 Synaptics.exe 2196 _C578E~1.EXE 2196 _C578E~1.EXE 1164 Synaptics.exe 1164 Synaptics.exe 4172 _C578E~1.EXE 4172 _C578E~1.EXE 1584 Synaptics.exe 1584 Synaptics.exe 4296 Synaptics.exe 4296 Synaptics.exe 2428 _CACHE~4.EXE 2428 _CACHE~4.EXE 448 _CACHE~4.EXE 448 _CACHE~4.EXE 5004 Synaptics.exe 5004 Synaptics.exe 1524 _C578E~1.EXE 1524 _C578E~1.EXE 2380 _CACHE~4.EXE 2380 _CACHE~4.EXE 2116 _C578E~1.EXE 2116 _C578E~1.EXE 208 Synaptics.exe 208 Synaptics.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ._cache__CACHE~4.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _C578E~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _C578E~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _C578E~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _C578E~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~2.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~3.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~3.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _CACHE~4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" _C578E~1.EXE -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE ._cache__CACHE~4.EXE File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe ._cache__CACHE~4.EXE File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe ._cache__CACHE~4.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe ._cache__CACHE~4.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com ._cache__CACHE~4.EXE File opened for modification C:\Windows\svchost.com ._cache__CACHE~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys ._cache__C578E~1.EXE File opened for modification C:\Windows\svchost.com ._cache_Synaptics.exe File opened for modification C:\Windows\svchost.com ._cache_Synaptics.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com ._cache__C578E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys ._cache__C578E~1.EXE File opened for modification C:\Windows\directx.sys ._cache__CACHE~4.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys ._cache_Synaptics.exe File opened for modification C:\Windows\svchost.com ._cache_Synaptics.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys ._cache_Synaptics.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com ._cache__CACHE~4.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com ._cache__C578E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys ._cache__CACHE~3.EXE File opened for modification C:\Windows\svchost.com ._cache__CACHE~3.EXE File opened for modification C:\Windows\directx.sys ._cache_Synaptics.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com ._cache__CACHE~1.EXE File opened for modification C:\Windows\directx.sys ._cache_Synaptics.exe File opened for modification C:\Windows\svchost.com ._cache_Synaptics.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com ._cache_Synaptics.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys ._cache__CACHE~3.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys ._cache__C578E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys ._cache__CACHE~4.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com ._cache__C578E~1.EXE File opened for modification C:\Windows\svchost.com ._cache__C578E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys ._cache__CACHE~4.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys ._cache__C578E~1.EXE File opened for modification C:\Windows\directx.sys ._cache_Synaptics.exe File opened for modification C:\Windows\svchost.com ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~2.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__CACHE~3.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _C578E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _C578E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _C6820~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~2.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~3.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _C578E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__C578E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__CACHE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__C578E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _C6820~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~2.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__C578E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _C6820~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~3.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _CACHE~4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache__C578E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _C578E~1.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~4.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _C578E~1.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__C578E~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ._cache__CACHE~4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _C578E~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~3.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~1.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~4.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~3.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _C578E~1.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~4.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~4.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~2.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__C578E~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _C578E~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__C578E~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~3.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~4.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~4.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__C578E~1.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~2.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__C578E~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _C578E~1.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__C578E~1.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~3.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~4.EXE Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ._cache__CACHE~4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _C578E~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _CACHE~4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ _C578E~1.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 2532 _CACHE~2.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 4720 _CACHE~1.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE 3548 _CACHE~4.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 2532 _CACHE~2.EXE Token: SeSystemProfilePrivilege 4720 _CACHE~1.EXE Token: SeSystemProfilePrivilege 4720 _CACHE~1.EXE Token: SeSystemProfilePrivilege 4720 _CACHE~1.EXE Token: SeSystemProfilePrivilege 4720 _CACHE~1.EXE Token: SeSystemProfilePrivilege 4720 _CACHE~1.EXE Token: SeSystemProfilePrivilege 4720 _CACHE~1.EXE Token: SeSystemProfilePrivilege 4720 _CACHE~1.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 3548 _CACHE~4.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE Token: SeSystemProfilePrivilege 1064 _C578E~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1260 wrote to memory of 4436 1260 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 83 PID 1260 wrote to memory of 4436 1260 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 83 PID 1260 wrote to memory of 4436 1260 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 83 PID 4436 wrote to memory of 3172 4436 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 84 PID 4436 wrote to memory of 3172 4436 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 84 PID 4436 wrote to memory of 3172 4436 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 84 PID 4436 wrote to memory of 5068 4436 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 85 PID 4436 wrote to memory of 5068 4436 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 85 PID 4436 wrote to memory of 5068 4436 70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 85 PID 3172 wrote to memory of 1608 3172 ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 86 PID 3172 wrote to memory of 1608 3172 ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 86 PID 3172 wrote to memory of 1608 3172 ._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe 86 PID 1608 wrote to memory of 2592 1608 svchost.com 101 PID 1608 wrote to memory of 2592 1608 svchost.com 101 PID 1608 wrote to memory of 2592 1608 svchost.com 101 PID 5068 wrote to memory of 3608 5068 Synaptics.exe 88 PID 5068 wrote to memory of 3608 5068 Synaptics.exe 88 PID 5068 wrote to memory of 3608 5068 Synaptics.exe 88 PID 2592 wrote to memory of 1976 2592 _CACHE~1.EXE 89 PID 2592 wrote to memory of 1976 2592 _CACHE~1.EXE 89 PID 2592 wrote to memory of 1976 2592 _CACHE~1.EXE 89 PID 3608 wrote to memory of 2724 3608 ._cache_Synaptics.exe 90 PID 3608 wrote to memory of 2724 3608 ._cache_Synaptics.exe 90 PID 3608 wrote to memory of 2724 3608 ._cache_Synaptics.exe 90 PID 2724 wrote to memory of 2532 2724 svchost.com 91 PID 2724 wrote to memory of 2532 2724 svchost.com 91 PID 2724 wrote to memory of 2532 2724 svchost.com 91 PID 1976 wrote to memory of 632 1976 ._cache__CACHE~1.EXE 92 PID 1976 wrote to memory of 632 1976 ._cache__CACHE~1.EXE 92 PID 1976 wrote to memory of 632 1976 ._cache__CACHE~1.EXE 92 PID 632 wrote to memory of 4256 632 svchost.com 93 PID 632 wrote to memory of 4256 632 svchost.com 93 PID 632 wrote to memory of 4256 632 svchost.com 93 PID 2532 wrote to memory of 872 2532 _CACHE~2.EXE 94 PID 2532 wrote to memory of 872 2532 _CACHE~2.EXE 94 PID 2532 wrote to memory of 872 2532 _CACHE~2.EXE 94 PID 872 wrote to memory of 4924 872 ._cache__CACHE~2.EXE 96 PID 872 wrote to memory of 4924 872 ._cache__CACHE~2.EXE 96 PID 872 wrote to memory of 4924 872 ._cache__CACHE~2.EXE 96 PID 2532 wrote to memory of 4644 2532 _CACHE~2.EXE 95 PID 2532 wrote to memory of 4644 2532 _CACHE~2.EXE 95 PID 2532 wrote to memory of 4644 2532 _CACHE~2.EXE 95 PID 4924 wrote to memory of 4720 4924 svchost.com 148 PID 4924 wrote to memory of 4720 4924 svchost.com 148 PID 4924 wrote to memory of 4720 4924 svchost.com 148 PID 4256 wrote to memory of 1860 4256 _CACHE~3.EXE 98 PID 4256 wrote to memory of 1860 4256 _CACHE~3.EXE 98 PID 4256 wrote to memory of 1860 4256 _CACHE~3.EXE 98 PID 4256 wrote to memory of 1772 4256 _CACHE~3.EXE 99 PID 4256 wrote to memory of 1772 4256 _CACHE~3.EXE 99 PID 4256 wrote to memory of 1772 4256 _CACHE~3.EXE 99 PID 4644 wrote to memory of 3652 4644 Synaptics.exe 100 PID 4644 wrote to memory of 3652 4644 Synaptics.exe 100 PID 4644 wrote to memory of 3652 4644 Synaptics.exe 100 PID 1860 wrote to memory of 2592 1860 ._cache__CACHE~3.EXE 101 PID 1860 wrote to memory of 2592 1860 ._cache__CACHE~3.EXE 101 PID 1860 wrote to memory of 2592 1860 ._cache__CACHE~3.EXE 101 PID 4720 wrote to memory of 4852 4720 _CACHE~1.EXE 102 PID 4720 wrote to memory of 4852 4720 _CACHE~1.EXE 102 PID 4720 wrote to memory of 4852 4720 _CACHE~1.EXE 102 PID 2592 wrote to memory of 3488 2592 svchost.com 103 PID 2592 wrote to memory of 3488 2592 svchost.com 103 PID 2592 wrote to memory of 3488 2592 svchost.com 103 PID 3652 wrote to memory of 5016 3652 ._cache_Synaptics.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"C:\Users\Admin\AppData\Local\Temp\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"C:\Users\Admin\AppData\Local\Temp\._cache_70636c3fd3bdab42234e249084ebada003015df3d943b9d9e3c3cf61dd057e1e.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"9⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate6⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate9⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:4852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate13⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4836
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:4468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate18⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate19⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:848 -
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate21⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate22⤵
- Executes dropped EXE
PID:4928
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate17⤵
- Executes dropped EXE
PID:760
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate10⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate11⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate12⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate13⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate15⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate16⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate19⤵
- Executes dropped EXE
PID:4964
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate17⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate18⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate20⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate21⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate22⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate23⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:392 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate25⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate26⤵
- Drops file in Windows directory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate27⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate28⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4312 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate29⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate30⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate31⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate32⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate33⤵PID:3456
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate31⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate32⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:3924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate33⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate34⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:448 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate35⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate36⤵
- Drops file in Windows directory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate37⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate38⤵PID:1632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate39⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate40⤵PID:3920
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate38⤵PID:4044
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate35⤵PID:2904
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate28⤵
- Loads dropped DLL
PID:1164
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate21⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate22⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate25⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate26⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate27⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate28⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate29⤵
- Drops file in Windows directory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate30⤵
- System Location Discovery: System Language Discovery
PID:816
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate28⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate29⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate30⤵
- Drops file in Windows directory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate31⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate32⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate33⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate34⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate35⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate36⤵
- Drops file in Windows directory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate37⤵
- System Location Discovery: System Language Discovery
PID:1968
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate35⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:208
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate32⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate33⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate34⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate35⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate36⤵PID:4748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate37⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate38⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate39⤵PID:4704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate40⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate41⤵PID:3040
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate39⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate40⤵PID:552
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate41⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate42⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate43⤵PID:3016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate44⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate45⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate46⤵PID:1896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate47⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate48⤵PID:5052
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate46⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate47⤵PID:1880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate48⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate49⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate50⤵PID:4180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate51⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate52⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate53⤵PID:3084
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate54⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate55⤵PID:216
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate53⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate54⤵PID:3656
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate55⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate56⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate57⤵PID:3632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate58⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate59⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate60⤵PID:3084
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate61⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate62⤵PID:4012
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate60⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate61⤵PID:392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate62⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate63⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate64⤵PID:2928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate65⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate66⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate67⤵PID:2352
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate68⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate69⤵PID:1292
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate67⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate68⤵PID:2300
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate64⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate65⤵PID:688
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate66⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate57⤵PID:1428
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate50⤵PID:4884
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate43⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate44⤵PID:4424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate45⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate46⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate47⤵PID:5032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate48⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate49⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate50⤵PID:2648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate51⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate52⤵PID:3608
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate50⤵PID:4408
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate50⤵PID:3468
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate47⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate48⤵PID:2664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate49⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate50⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate51⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate52⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate53⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate54⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate55⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate56⤵PID:2596
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate54⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate55⤵PID:2436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate56⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate57⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate58⤵PID:2116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate59⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate60⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate61⤵PID:672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate62⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate63⤵PID:1160
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate61⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate62⤵PID:3008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate63⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate64⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate65⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate66⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate67⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate68⤵PID:2632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate69⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate70⤵PID:4860
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate68⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate69⤵PID:3032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate70⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate71⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate72⤵PID:2040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate73⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate74⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate75⤵PID:4732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate76⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate77⤵PID:2164
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate75⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate76⤵PID:4272
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate77⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate78⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate79⤵PID:1296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate80⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate81⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate82⤵PID:4344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate83⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate84⤵PID:672
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate82⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate83⤵PID:1664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate84⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate85⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate86⤵PID:452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate87⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate88⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate89⤵PID:1260
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate90⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate91⤵PID:2384
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate89⤵PID:4508
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate86⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate87⤵PID:3508
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate88⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate89⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate90⤵PID:3632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate91⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate92⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate93⤵PID:2412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate94⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate95⤵PID:4272
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate93⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate94⤵PID:2752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate95⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate96⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate97⤵PID:3948
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate98⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate99⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate100⤵PID:4044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate101⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate102⤵PID:4616
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate100⤵PID:5104
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate97⤵PID:2256
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate90⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate91⤵PID:2540
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate92⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate93⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate94⤵PID:3924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate95⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate96⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate97⤵PID:2452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate98⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate99⤵PID:4944
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate97⤵PID:1056
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate94⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate95⤵PID:1772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate96⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate97⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate98⤵PID:2792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate99⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate100⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate101⤵PID:4364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate102⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate103⤵PID:2532
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate101⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate102⤵PID:2436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate103⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate104⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate105⤵PID:2368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate106⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate107⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate108⤵PID:4456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate109⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate110⤵PID:3804
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate108⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate109⤵PID:452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate110⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate111⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate112⤵PID:1660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate113⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate114⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate115⤵PID:3820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate116⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate117⤵PID:4364
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate115⤵PID:3940
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate112⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate113⤵PID:2412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate114⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate115⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate116⤵PID:3644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate117⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate118⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C578E~1.EXE" InjUpdate119⤵PID:2528
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE" InjUpdate120⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C6820~1.EXE InjUpdate121⤵PID:2432
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate119⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate120⤵PID:3384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate121⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate122⤵PID:2512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-